Palantir Technologies Inc.

Previous wording

Our results of operations depend on sales to enterprise customers, which make product purchasing decisions based in part or entirely on factors, or perceived factors, not directly related to the features of the platforms, including, among others, that customer’s projections of business growth, uncertainty about macroeconomic conditions (including as a result of the ongoing Russia-Ukraine conflict and related economic sanctions, the conflict resulting from Hamas’ attack on Israel and the ongoing conflicts in the Middle East, including the escalation of hostilities resulting from the recent strikes by the United States and Israel on Iran and retaliatory strikes related thereto, fluctuating interest rates, monetary policy changes, foreign currency fluctuations, or the potential or actual imposition of tariffs or other impacts on trade relations), capital budgets, anticipated cost savings from the implementation of our platforms, potential preference for such customer’s internally-developed software solutions, perceptions about our business and platforms, more favorable terms offered by potential competitors, and previous technology investments. In addition, certain decision makers and other stakeholders within our potential customers tend to have vested interests in the continued use of internally developed or existing software, which may make it more difficult for us to sell our platforms and services. As a result of these and other factors, our sales efforts typically require an extensive effort throughout a customer’s organization, a significant investment of human resources, expense and time, including by our senior management, and there can be no assurances that we will be successful in making a sale to a potential customer. If our sales efforts to a potential customer do not result in sufficient revenue to justify our investments, including our investments in sales and marketing, our business, financial condition, and results of operations could be adversely affected.

Current wording

Our results of operations depend on sales to enterprise customers, which make product purchasing decisions based in part or entirely on factors, or perceived factors, not directly related to the features of the platforms, including, among others, that customer’s projections of business growth, uncertainty about macroeconomic conditions (including as a result of the ongoing Russia-Ukraine conflict and related economic sanctions, the conflict resulting from Hamas’ attack on Israel and the ongoing conflicts in the Middle East, including the hostilities in Iran, fluctuating interest rates, monetary policy changes, foreign currency fluctuations, or the potential or actual imposition of tariffs or other impacts on trade relations), capital budgets, anticipated cost savings from the implementation of our platforms, potential preference for such customer’s internally-developed software solutions, perceptions about our business and platforms, more favorable terms offered by potential competitors, and previous technology investments. In addition, certain decision makers and other stakeholders within our potential customers tend to have vested interests in the continued use of internally developed or existing software, which may make it more difficult for us to sell our platforms and services. As a result of these and other factors, our sales efforts typically require an extensive effort throughout a customer’s organization, a significant investment of human resources, expense and time, including by our senior management, and there can be no assurances that we will be successful in making a sale to a potential customer. If our sales efforts to a potential customer do not result in sufficient revenue to justify our investments, including our investments in sales and marketing, our business, financial condition, and results of operations could be adversely affected.

Previous wording

Our top three customers together accounted for 16% and 17% of our revenue for the years ended December 31, 2025 and 2024, respectively, and 16% and 17% of our revenue for the six months ended June 30, 2026 and 2025, respectively. Our top three customers by revenue, for the six months ended June 30, 2026, have been with us for an average of fifteen years as of June 30, 2026. Certain of our customers, including customers that represent a significant portion of our business, have in the past reduced, and others may choose in the future to reduce, their spend with us or terminated their agreements with us, which has reduced our anticipated future payments or revenue from these customers, and which has required us to refund some previously paid amounts to these customers. It is not possible for us to predict the future level of demand from our larger customers for our platforms and applications.

Current wording

Our top three customers together accounted for 16% and 17% of our revenue for the years ended December 31, 2025 and 2024, respectively, and 16% of our revenue for each of the nine months ended September 30, 2026 and 2025. Our top three customers by revenue, for the nine months ended September 30, 2026, have been with us for an average of fifteen years as of September 30, 2026. Certain of our customers, including customers that represent a significant portion of our business, have in the past reduced, and others may choose in the future to reduce, their spend with us or terminated their agreements with us, which has reduced our anticipated future payments or revenue from these customers, and which has required us to refund some previously paid amounts to these customers. It is not possible for us to predict the future level of demand from our larger customers for our platforms and applications.

Previous wording

Since our founding in 2003, we have experienced rapid growth. We operate in a growing market and have experienced, and may continue to experience, significant expansion of our operations. This growth has placed, and may continue to place, a strain on our employees, management systems, operational, financial, and other resources. As we have grown, we have increasingly managed larger and more complex deployments of our platforms and services with a broader base of government and commercial customers. As we continue to grow, we face challenges of integrating, developing, retaining, and motivating our employee base of 4,401 full-time employees as of June 30, 2026 in various countries around the world. In the event of continued growth of our operations, our operational resources, including our information technology systems, our employee base, or our internal controls and procedures may not be adequate to support our operations and deployments. Managing our growth may require significant expenditures and allocation of valuable management resources, improving our operational, financial, and management processes and systems, and effectively expanding, training, and managing our employee base. As our organization continues to grow and operate as a public company, we may find it increasingly difficult to maintain the benefits of our traditional company culture, including our ability to quickly respond to customers, and avoid unnecessary delays that may be associated with a formal corporate structure.

Current wording

Since our founding in 2003, we have experienced rapid growth. We operate in a growing market and have experienced, and may continue to experience, significant expansion of our operations. This growth has placed, and may continue to place, a strain on our employees, management systems, operational, financial, and other resources. As we have grown, we have increasingly managed larger and more complex deployments of our platforms and services with a broader base of government and commercial customers. As we continue to grow, we face challenges of integrating, developing, retaining, and motivating our employee base of 4,634 full-time employees as of September 30, 2026 in various countries around the world. In the event of continued growth of our operations, our operational resources, including our information technology systems, our employee base, or our internal controls and procedures may not be adequate to support our operations and deployments. Managing our growth may require significant expenditures and allocation of valuable management resources, improving our operational, financial, and management processes and systems, and effectively expanding, training, and managing our employee base. As our organization continues to grow and operate as a public company, we may find it increasingly difficult to maintain the benefits of our traditional company culture, including our ability to quickly respond to customers, and avoid unnecessary delays that may be associated with a formal corporate structure.

Previous wording

•general economic, regulatory, and market conditions, including the impacts of ongoing conflicts, such as those in Russia-Ukraine, Israel, and the broader Middle East, including the recent escalation of hostilities in Iran and surrounding nations, and any related economic sanctions and regional instability, fluctuating interest rates, monetary policy changes, foreign currency fluctuations, or the potential or actual imposition of tariffs or other impacts on trade relations.

Current wording

•general economic, regulatory, and market conditions, including the impacts of ongoing conflicts, such as those in Russia-Ukraine, Israel, and the broader Middle East, including the hostilities in Iran and surrounding nations, and any related economic sanctions and regional instability, fluctuating interest rates, monetary policy changes, foreign currency fluctuations, or the potential or actual imposition of tariffs or other impacts on trade relations.

Previous wording

Our relationships with government customers and customers that are engaged in certain sensitive industries, including organizations whose products or activities are or are perceived to be controversial, have resulted in public criticism, including from political and social activists; unfavorable coverage in the media; engagement on these issues from investors and potential customers; and increased security risks. These relationships could also result in exposure to congressional, regulatory, or other government investigations or inquiries, as well as lawsuits from private parties. For example, certain investors and advocacy groups have recently raised concerns regarding the perceived human rights implications of our products, services, and customer relationships. Such scrutiny may adversely affect our stock price, impair our ability to attract or retain institutional investors, divert management attention and resources, or result in increased costs, including costs associated with managing shareholder demands and related processes. Activists have also engaged, and may continue to engage, in public protests at our properties and other locations, including at the premises of our customers, partners, and third-party service providers. Such activity has, in certain instances, disrupted or threatened to disrupt operations and caused third parties to terminate or seek to limit their relationship with us, which could in turn disrupt our operations in affected jurisdictions. Actions we may take in response to media coverage, activism, investigations, inquiries, litigation, or to protect from security risks, may divert resources and our management’s attention, increase certain operating and other expenses, and further affect our public perception. Activist criticism and government or regulatory inquiries of our relationships with customers could potentially engender dissatisfaction among potential and existing customers, investors, and employees with how we address political and social concerns in our business activities, and our actual or perceived customer relationships and company values may factor into decisions by existing and potential customers regarding whether to award, renew, or expand contracts with us, regardless of the merits of our products or services, and any resulting loss of business could in turn further harm our reputation. Conversely, being perceived as yielding to activism targeted at certain customers could damage our relationships with certain customers, including governments and government agencies with which we do business, whose views may or may not be aligned with those of political and social activists. Actions we take in response to the activities of our customers, up to and including terminating our contracts or refusing a particular product use case could harm our brand and reputation. In either case, the resulting harm to our reputation could:

Current wording

Our relationships with government customers and customers that are engaged in certain sensitive industries, including organizations whose products or activities are or are perceived to be controversial, have resulted in public criticism, including from political and social activists; unfavorable coverage in the media; engagement on these issues from investors and potential customers; and increased security risks, including unauthorized communications. These relationships could also result in exposure to congressional, regulatory, or other government investigations or inquiries, as well as lawsuits from private parties. For example, certain investors and advocacy groups have recently raised concerns regarding the perceived human rights implications of our products, services, and customer relationships. Such scrutiny may adversely affect our stock price, impair our ability to attract or retain institutional investors, divert management attention and resources, or result in increased costs, including costs associated with managing shareholder demands and related processes. Activists have also engaged, and may continue to engage, in public protests at our properties and other locations, including at the premises of our customers, partners, and third-party service providers. Such activity has, in certain instances, disrupted or threatened to disrupt operations and caused third parties to terminate or seek to limit their relationship with us, which could in turn disrupt our operations in affected jurisdictions. Actions we may take in response to media coverage, activism, investigations, inquiries, litigation, or to protect from security risks, may divert resources and our management’s attention, increase certain operating and other expenses, and further affect our public perception. Activist criticism and government or regulatory inquiries of our relationships with customers could potentially engender dissatisfaction among potential and existing customers, investors, and employees with how we address political and social concerns in our business activities, and our actual or perceived customer relationships and company values may factor into decisions by existing and potential customers regarding whether to award, renew, or expand contracts with us, regardless of the merits of our products or services, and any resulting loss of business could in turn further harm our reputation. Conversely, being perceived as yielding to activism targeted at certain customers could damage our relationships with certain customers, including governments and government agencies with which we do business, whose views may or may not be aligned with those of political and social activists. Actions we take in response to the activities of our customers, up to and including terminating our contracts or refusing a particular product use case could harm our brand and reputation. In either case, the resulting harm to our reputation could:

Previous wording

Given the nature of our products and services, we are at increased risk of being targeted for security attacks, including threats to the physical security of our facilities and employees. These threats could involve terrorism, targeted threats against senior executives, workplace violence, and civil unrest. For example, the recent escalation of hostilities in Iran has demonstrated the intent to target Western technology infrastructure and companies, including us, and has increased the risk that our systems, facilities, or third-party providers could be subject to physical or cyber attack.

Current wording

Given the nature of our products and services, we have been, and may continue to be, targeted for security attacks, including threats to the physical security of our facilities and employees. These threats could involve, and in some cases have involved, terrorism, targeted threats against senior executives, workplace violence, and civil unrest. For example, the hostilities in Iran have demonstrated the intent to target Western technology infrastructure and companies, including us, and have increased the risk that our systems, facilities, or third-party providers could be subject to physical or cyber attack.

Previous wording

In addition, our ability to provide effective services is largely dependent on our ability to attract, train, and retain qualified personnel with experience in supporting customers on platforms such as ours. The number of our customers has grown significantly, and that growth has and may continue to put additional pressure on our services teams. Our services teams may need additional personnel to respond to customer demand, and we have, and may in the future continue to, partner with third parties in providing O&M services to our customers. We may be unable to respond quickly enough to accommodate short-term increases in customer demand for our O&M services. We also may be unable to modify the future scope and delivery of our O&M services to compete with changes in the services provided by our competitors. Increased customer demand for support, without corresponding revenue, could increase costs and negatively affect our business and results of operations. In addition, as we continue to grow our operations and expand outside of the United States, we need to be able to provide efficient services that meet our customers’ needs globally at scale, and our services teams may face additional challenges, including those associated with operating the platforms and delivering support, training, and documentation in languages other than English and providing services across expanded time-zones. If we are unable to provide efficient O&M services globally at scale, our ability to grow our operations may be harmed, and we may need to hire additional services personnel or partner with third-party organizations, which could increase our expenses, and negatively impact our business, financial condition, and results of operations.

Current wording

In addition, our ability to provide effective services is largely dependent on our ability to attract, train, and retain qualified personnel with experience in supporting customers on platforms such as ours. The number of our customers has grown significantly, and that growth has and may continue to put additional pressure on our services teams. Our services teams may need additional personnel to respond to customer demand, and we have partnered, and may in the future continue to partner, with third parties in providing O&M services to our customers. We may be unable to respond quickly enough to accommodate short-term increases in customer demand for our O&M services. We also may be unable to modify the future scope and delivery of our O&M services to compete with changes in the services provided by our competitors. Increased customer demand for support, without corresponding revenue, could increase costs and negatively affect our business and results of operations. In addition, as we continue to grow our operations and expand outside of the United States, we need to be able to provide efficient services that meet our customers’ needs globally at scale, and our services teams may face additional challenges, including those associated with operating the platforms and delivering support, training, and documentation in languages other than English and providing services across expanded time-zones. If we are unable to provide efficient O&M services globally at scale, our ability to grow our operations may be harmed, and we may need to hire additional services personnel or partner with third-party organizations, which could increase our expenses, and negatively impact our business, financial condition, and results of operations.

Previous wording

•any such transactions may negatively affect our financial results because it may require us to incur charges or assume substantial debt or other liabilities, may cause adverse tax consequences or unfavorable accounting treatment, may expose us to claims and disputes by third parties, including intellectual property claims and disputes, or may not generate sufficient financial return to offset additional costs and expenses related to such transactions;

Current wording

•any such transactions may negatively affect our financial results because they may require us to incur charges or assume substantial debt or other liabilities, may cause adverse tax consequences or unfavorable accounting treatment, may expose us to claims and disputes by third parties, including intellectual property claims and disputes, or may not generate sufficient financial return to offset additional costs and expenses related to such transactions;

Previous wording

Additionally, in connection with approving and signing the Investment Agreements, we and each Investee or an associated entity entered into a commercial contract for access to our products and services (collectively, the “Strategic Commercial Contracts”). The total value of Strategic Commercial Contracts, which is calculated as the sum of the cumulative revenue recognized from Strategic Commercial Contracts and the remaining deal value of such contracts, was $326 million, with no remaining contractual options, as of June 30, 2026. When determining the total value of these Strategic Commercial Contracts, we assess customers’ financial condition, including the consideration of their ability and intention to pay, and whether all or some portion of the value of the contracts continue to meet the criteria for revenue recognition, among other factors. Certain companies with which we have entered into commercial contracts have been, and may continue to be, unable to generate sufficient revenues or profitability or to access any necessary financing or funding in a timely manner or on favorable terms to them, which has negatively impacted, and may continue to negatively impact, our expected revenue and collections. These companies are generally engaged in businesses that involve novel and unproven technologies, products, and services and such companies have been, and may continue to be, unable to perform all or some of their obligations under any commercial contracts that we enter into with them in a timely manner or at all. For example, some of our early-stage Investee customers filed for bankruptcy or terminated their contracts with us, and the remaining value of the commercial contracts with such customers that is not expected to be recognized as revenue has been excluded from the total value of Strategic Commercial Contracts above. As of June 30, 2026, the cumulative amount of revenue recognized from Strategic Commercial Contracts was $325 million, of which $3 million was recognized by us during the six months ended June 30, 2026.

Current wording

Additionally, in connection with approving and signing the Investment Agreements, we and each Investee or an associated entity entered into a commercial contract for access to our products and services (collectively, the “Strategic Commercial Contracts”). The total value of Strategic Commercial Contracts, which is calculated as the sum of the cumulative revenue recognized from Strategic Commercial Contracts and the remaining deal value of such contracts, was $326 million, with no remaining contractual options, as of September 30, 2026. When determining the total value of these Strategic Commercial Contracts, we assess customers’ financial condition, including the consideration of their ability and intention to pay, and whether all or some portion of the value of the contracts continue to meet the criteria for revenue recognition, among other factors. Certain companies with which we have entered into commercial contracts have been, and may continue to be, unable to generate sufficient revenues or profitability or to access any necessary financing or funding in a timely manner or on favorable terms to them, which has negatively impacted, and may continue to negatively impact, our expected revenue and collections. These companies are generally engaged in businesses that involve novel and unproven technologies, products, and services and such companies have been, and may continue to be, unable to perform all or some of their obligations under any commercial contracts that we enter into with them in a timely manner or at all. For example, some of our early-stage Investee customers filed for bankruptcy or terminated their contracts with us, and the remaining value of the commercial contracts with such customers that is not expected to be recognized as revenue has been excluded from the total value of Strategic Commercial Contracts above. As of September 30, 2026, the cumulative amount of revenue recognized from Strategic Commercial Contracts was $325 million, of which $4 million was recognized by us during the nine months ended September 30, 2026.

Previous wording

Our platforms and services operate in conjunction with, and we are dependent upon, third-party products and components across a broad ecosystem, including our customer environments. There have been, and may continue to be, significant attacks on certain third-party providers, and we cannot guarantee that our or any third-party providers’ systems, networks, products, or components have not been breached or that they do not contain exploitable defects or bugs that could result in a breach of or disruption to our systems and networks or the systems and networks of third parties that support or otherwise interface with us and our platforms and services. Furthermore, changes such as configurations, updates or upgrades of third-party products or services have introduced and may in the future introduce or exacerbate vulnerabilities that may compromise our systems or those of our customers. If there is a security vulnerability, error, or other bug in one of these products or components and if there is a security exploit targeting them, we could face increased costs, claims, liability, reduced revenue, and harm to our reputation or competitive position. The natural sunsetting or phasing out of third-party products and operating systems that we use requires that our infrastructure teams reallocate time and attention to migration and updates, during which period potential security vulnerabilities could be exploited. In addition, the locations or environments in which our software is deployed have expanded, and may continue to expand, including on customer networks, on-premises at customer sites, on edge devices, on mobile devices, in data centers, in colocation spaces or in other locations or environments that we do not maintain or operate. In such locations or environments, we may not have full control over how our platforms and products are deployed, managed, or secured, our standards for information security may not be met, and our ability to deploy certain security features and controls may be limited. These locations and environments may be more vulnerable to cybersecurity attacks, phishing attacks, viruses, malware, ransomware, and hacking, or similar breaches and incidents, including those from nation-state actors or affiliated actors, and such attacks could harm our customers’ ability to operate and perform their obligations under our contracts, or result in increased costs or liabilities, a perceived or actual security breach of our platforms, or harm to our business and reputation. Moreover, if our platforms and products are not appropriately deployed, managed, and secured in these locations or environments, or such locations or environments are not appropriately secured or experience cybersecurity attacks or other security breaches or incidents, our platforms and products could be compromised, inappropriately accessed or acquired, or undergo unauthorized use, copying, and distribution, and reverse engineering of our intellectual property, which c…

Excerpt shortened here; the source contains the full paragraph.

Current wording

Our platforms and services operate in conjunction with, and we are dependent upon, third-party products and components across a broad ecosystem, including our customer environments. There have been, and may continue to be, significant attacks on certain third-party providers, and we cannot guarantee that our or any third-party providers’ systems, networks, products, or components have not been breached or that they do not contain exploitable defects or bugs that could result in a breach of or disruption to our systems and networks or the systems and networks of third parties that support or otherwise interface with us and our platforms and services. Furthermore, changes such as configurations, updates or upgrades of third-party products or services have introduced and may in the future introduce or exacerbate vulnerabilities that may compromise our systems or those of our customers. If there is a security vulnerability, error, or other bug in one of these products or components and if there is a security exploit targeting them, we could face increased costs, claims, liability, reduced revenue, and harm to our reputation or competitive position. The natural sunsetting or phasing out of third-party products and operating systems that we use requires that our infrastructure teams reallocate time and attention to migration and updates, during which period potential security vulnerabilities could be exploited. In addition, the locations or environments in which our software is deployed have expanded, and may continue to expand, including on customer networks, on-premises at customer sites, on edge devices, on mobile devices, in data centers, in colocation spaces or in other locations or environments that we do not maintain or operate. In such locations or environments, we may not have full control over how our platforms and products are deployed, managed, or secured, our standards for information security may not be met, and our ability to deploy certain security features and controls may be limited. These locations and environments may be more vulnerable to cybersecurity attacks, phishing attacks, viruses, malware, ransomware, and hacking, or similar breaches and incidents, including those from nation-state actors or affiliated actors, and such attacks could harm our customers’ ability to operate and perform their obligations under our contracts, or result in increased costs or liabilities, a perceived or actual security breach of our platforms, or harm to our business and reputation. Moreover, if our platforms and products are not appropriately deployed, managed, and secured in these locations or environments, or such locations or environments are not appropriately secured or experience cybersecurity attacks or other security breaches or incidents, our platforms and products could be compromised, inappropriately accessed or acquired, or undergo unauthorized use, copying, and distribution, and reverse engineering of our intellectual property, which c…

Excerpt shortened here; the source contains the full paragraph.

Previous wording

We, and the third-party vendors upon which we rely, have experienced, and may in the future experience, cybersecurity attacks and threats, including threats or attempts to disrupt our information technology infrastructure and unauthorized attempts to gain access to sensitive or confidential information. Our and our third-party vendors’ technology systems have been, and in the future may be, damaged, disrupted, or compromised by harmful events, including malicious activities, natural occurrences, inadvertent errors, cybersecurity incidents or cyberattacks (including computer viruses, ransomware, and other malicious and destructive code, phishing attacks, and denial of service attacks), physical or electronic security breaches and incidents, terrorist attacks, natural disasters, fire, power loss, telecommunications failures, personnel misconduct, and human error. Such attacks or security breaches or incidents may be perpetrated by internal bad actors, such as employees or contractors, or by third parties (including traditional computer hackers, persons involved with organized crime, or foreign state or foreign state-supported actors). Cybersecurity threats can employ a wide variety of methods and techniques, have included, and may continue to include, the use of social engineering techniques or supply-chain attacks, are constantly evolving, and have become increasingly complex and sophisticated, all of which increase the difficulty of detecting and successfully defending against them. Furthermore, because the techniques used to obtain unauthorized access or sabotage systems change frequently and generally are not identified until after they are launched against a target, we and our third-party vendors may not have the capacity to immediately detect such efforts, may be unable to anticipate these techniques, or may be unable to implement adequate preventative measures. Although prior known cyberattacks directed at us have not had a material impact on our financial results, and we are continuing to bolster our threat detection and mitigation processes and procedures, our security measures may be circumvented and we cannot guarantee that past, future, or ongoing cyberattacks or other security breaches or incidents against us or a third party, if successful, will not have a material impact on our business or financial results, whether directly or indirectly. Further, the practical security prioritization decisions we make based on our assessment of potential risks may not be successful in identifying or mitigating cyberattacks or other security breaches or incidents that could result in material impacts.

Current wording

We, and the third-party vendors upon which we rely, have experienced, and may in the future experience, cybersecurity attacks and threats, including threats or attempts to disrupt our information technology infrastructure and unauthorized attempts to gain access to sensitive or confidential information. Our and our third-party vendors’ technology systems have been, and in the future may be, damaged, disrupted, or compromised by harmful events, including malicious activities, natural occurrences, inadvertent errors, cybersecurity incidents or cyberattacks (including computer viruses, ransomware, and other malicious and destructive code, phishing attacks, and denial of service attacks), physical or electronic security breaches and incidents, terrorist attacks, natural disasters, fire, power loss, telecommunications failures, personnel misconduct, and human error. Such attacks or security breaches or incidents may be perpetrated by internal bad actors, such as employees or contractors, or by third parties (including traditional computer hackers, persons involved with organized crime, or foreign state or foreign state-supported actors). Cybersecurity threats can employ a wide variety of methods and techniques, have included, and may continue to include, the use of social engineering techniques or supply-chain attacks, are constantly evolving, and have become increasingly complex and sophisticated, all of which increase the difficulty of detecting and successfully defending against them. Advances in AI have also increased the speed and scale at which security vulnerabilities can be found and exploited. Furthermore, because the techniques used to obtain unauthorized access or sabotage systems change frequently and generally are not identified until after they are launched against a target, we and our third-party vendors may not have the capacity to immediately detect such efforts, may be unable to anticipate these techniques, or may be unable to implement adequate preventative measures. Although prior known cyberattacks directed at us have not had a material impact on our financial results, and we are continuing to bolster our threat detection and mitigation processes and procedures, our security measures may be circumvented and we cannot guarantee that past, future, or ongoing cyberattacks or other security breaches or incidents against us or a third party, if successful, will not have a material impact on our business or financial results, whether directly or indirectly. Further, the practical security prioritization decisions we make based on our assessment of potential risks may not be successful in identifying or mitigating cyberattacks or other security breaches or incidents that could result in material impacts.

Previous wording

We have provided, and may continue to provide, our platforms, products, personnel, and services to support operations in conflict zones. Such zones are subject to, among other things, political uncertainty, geopolitical tensions, and military actions, such as those associated with the ongoing Russia-Ukraine, Israel, and broader Middle East conflicts, including the escalation of hostilities resulting from the recent strikes by the United States and Israel on Iran and retaliatory strikes related thereto. As a result, we and our third-party vendors have been vulnerable to a heightened risk of, and have been exposed to, cybersecurity attacks, phishing attacks, supply-chain attacks, viruses, malware, ransomware, hacking or similar breaches and incidents, including increasingly sophisticated threats, from nation-state actors or affiliated actors, including attacks that could materially disrupt our systems and operations, supply chain, and ability to produce, sell, and distribute our products and services. While we have security measures in place to protect our information and our customers’ information and to prevent data loss and other security breaches and incidents, we have not always been able to do so and there can be no assurance that in the future we will be able to anticipate or prevent security breaches or incidents, or intentional or unintentional action or inaction by employees or third parties, which may result in unauthorized access of our information technology systems or the information technology systems of the third-party vendors upon which we rely. Despite our implementation of network security measures and internal information security policies, data stored on personnel computer systems is also vulnerable to similar security breaches and incidents, unauthorized tampering, bad actors, or human error.

Current wording

We have provided, and may continue to provide, our platforms, products, personnel, and services to support operations in conflict zones. Such zones are subject to, among other things, political uncertainty, geopolitical tensions, and military actions, such as those associated with the ongoing Russia-Ukraine, Israel, and broader Middle East conflicts, including the hostilities in Iran. As a result, we and our third-party vendors have been vulnerable to a heightened risk of, and have been exposed to, cybersecurity attacks, phishing attacks, supply-chain attacks, viruses, malware, ransomware, hacking or similar breaches and incidents, including increasingly sophisticated threats, from nation-state actors or affiliated actors, including attacks that could materially disrupt our systems and operations, supply chain, and ability to produce, sell, and distribute our products and services. While we have security measures in place to protect our information and our customers’ information and to prevent data loss and other security breaches and incidents, we have not always been able to do so and there can be no assurance that in the future we will be able to anticipate or prevent security breaches or incidents, or intentional or unintentional action or inaction by employees or third parties, which may result in unauthorized access of our information technology systems or the information technology systems of the third-party vendors upon which we rely. Despite our implementation of network security measures and internal information security policies, data stored on personnel computer systems is also vulnerable to similar security breaches and incidents, unauthorized tampering, bad actors, or human error.

Previous wording

AI is enabled by or integrated into some of our technology platforms and is a significant and growing element of our business. We have also incorporated AI into certain operations within our business, including by using our platforms for internal functions, and have developed internal policies and technological capabilities to govern AI use. As with many developing technologies, AI presents risks and challenges that could affect its further development, adoption, and use, and therefore our business. AI algorithms and models may be flawed. Datasets in AI training, development, or operations may be insufficient, of poor quality, reflect unwanted forms of bias, or raise other legal concerns (such as concerns regarding copyright protections and other intellectual property claims). Inappropriate or controversial data practices by, or practices reflecting inherent biases of, data scientists, engineers, and end-users of our systems could impair the acceptance of AI solutions. Third-party AI capabilities that can be integrated with our platforms could also produce false or “hallucinatory” inferences about customer data or enterprises, or other information or subject matter. If the recommendations, forecasts, or analyses that AI applications assist in producing are deficient, unreliable, or inaccurate, we could be subject to competitive harm, potential legal liability, including under existing, forthcoming, or proposed legislation regulating AI in jurisdictions such as the EU, and brand or reputational harm. The rapid evolution of AI and its evolving regulatory landscape may also require additional resources to develop, test, and maintain our platforms and products to help ensure that AI is implemented appropriately in order to minimize unintended or harmful impact, which may be costly and may not produce the benefits and results that we expect. Increased development and use of AI has also led to a strain on energy resources, which could lead to increased expenses or limited availability of resources needed for our business and operations.

Current wording

As with many developing technologies, AI systems, tooling, and agents present potentially significant risks and challenges that could affect further development, adoption, and use, and therefore our business and operations. AI algorithms and models may be flawed. Datasets in AI training, development, or operations may be insufficient, of poor quality, reflect unwanted forms of bias, or raise other legal concerns (such as concerns regarding copyright protections and other intellectual property claims). Inappropriate or controversial data practices by, or practices reflecting inherent biases of, data scientists, engineers, and end-users of our systems could impair the acceptance of AI solutions. Third-party AI capabilities that can be integrated with our platforms could also produce false or “hallucinatory” inferences about customer data or enterprises, or other information or subject matter. If the recommendations, forecasts, or analyses that AI applications assist in producing are deficient, unreliable, or inaccurate, we could be subject to competitive harm, potential legal liability, including under existing, forthcoming, or proposed legislation regulating AI in jurisdictions such as the EU, and brand or reputational harm. AI systems, tooling, and agents may also take unintended or unauthorized actions, including through misuse of otherwise authorized access, that delete, alter, or disclose data, modify software or system configurations, or disrupt our systems and business operations, or cause other cybersecurity, privacy, legal, or operational incidents. The rapid evolution of AI and its evolving regulatory landscape may also require additional resources to develop, test, and maintain our platforms and products to help ensure that AI is implemented appropriately in order to minimize unintended or harmful impact, which may be costly and may not produce the benefits and results that we expect. Increased development and use of AI has also led to a strain on energy resources, which could lead to increased expenses or limited availability of resources needed for our business and operations.

Previous wording

Our technologies and business practices are designed to mitigate many of these risks. For example, our platforms include data and AI use case governance, machine learning modeling, as well as model testing and evaluation tools which help to regulate and limit user access to data sets and develop, deploy, and manage more effective and responsible AI capabilities. However, if these controls are not properly implemented by, or for, our customers, or if we enable or offer AI solutions that are controversial or problematic because of their purported or real impact on fundamental rights, privacy, employment, or other societal issues, we may experience brand or reputational harm, as well as regulatory or legal scrutiny. There can be no assurance that the technologies and business practices we have designed will fully mitigate the risks presented by the growing use of AI in our platforms and business.

Current wording

Our software platforms, as well as our engineering, business and security practices, especially AIP and our Sovereign AI offering, are designed to mitigate as many of the risks related to AI as is reasonably possible. For example, our platforms include data and AI use case governance, machine learning modeling, as well as model testing and evaluation tools which help to regulate and limit user access to data sets and develop, deploy, and manage more effective and responsible AI capabilities. However, there can be no assurance that the technologies and business practices we have designed will fully mitigate the risks presented by the growing use of AI, or that our governance, access controls, and human oversight will prevent, detect, or contain unintended or unauthorized actions or uses in a timely manner, or at all.

Previous wording

Some AI scenarios present ethical issues, and the enablement or integration of AI into our platforms may subject us to new or heightened legal, regulatory, ethical, or other challenges, the application or interpretation of which are complex and will likely continue to evolve. Moreover, AI, including our use of AI, may create additional cybersecurity risks or increase existing cybersecurity risks, and may result in, or increase impacts of, cyberattacks, security breaches, phishing attacks, personal data breaches, or other incidents. For example, threat actors are increasingly using tools and techniques that circumvent controls, evade detection, and remove forensic evidence, which means that we and others may be unable to anticipate, detect, deflect, contain or recover from cyberattacks in a timely or effective manner. As AI capabilities improve and are increasingly adopted, we may see cyberattacks crafted with an AI tool to attack information systems by creating more effective phishing emails or social engineering and by exploiting vulnerabilities in electronic security programs utilizing false image or voice recognition. In addition, enhanced risk of cyberattacks could be a result of us or a third party incorporating the output of an AI tool, such as malicious code from an AI generated source code.

Current wording

Some AI scenarios present ethical issues, and the enablement or integration of AI into our platforms may subject us to new or heightened legal, regulatory, ethical, or other challenges, the application or interpretation of which are complex and will likely continue to evolve. Moreover, AI, including our use of AI, may create additional cybersecurity risks or increase existing cybersecurity risks, and may result in, or increase impacts of, cyberattacks, security breaches, phishing attacks, personal data breaches, or other incidents. For example, threat actors are increasingly using tools and techniques that circumvent controls, evade detection, and remove forensic evidence, which means that we and others may be unable to anticipate, detect, deflect, contain or recover from cyberattacks in a timely or effective manner. As AI capabilities improve and are increasingly adopted, we may see cyberattacks crafted with an AI tool to attack information systems by creating more effective phishing emails or social engineering and by exploiting vulnerabilities in electronic security programs utilizing false image or voice recognition. Increasingly capable AI models may also be able to find and exploit unknown vulnerabilities faster and at greater scale than before. In addition, enhanced risk of cyberattacks could be a result of us or a third party incorporating the output of an AI tool, such as malicious code from an AI generated source code. If our controls are not properly implemented by us or by, or for, our customers, or if we enable or offer AI solutions that are controversial or problematic because of their purported or real impact on fundamental rights, privacy, employment, or other societal issues, we may experience brand or reputational harm, as well as regulatory or legal scrutiny.

Previous wording

Our systems and the third-party systems upon which we and our customers rely are also vulnerable to damage or interruption from catastrophic occurrences such as earthquakes, floods, fires, power loss, telecommunication failures, cybersecurity threats, terrorist attacks, such as the conflict resulting from Hamas’ attack on Israel, natural disasters, public health crises, geopolitical tensions such as those that may be caused by the ongoing Russia-Ukraine conflict, or acts of misconduct and war. For example, the recent escalation of conflict in the Middle East has led to retaliatory strikes by Iran that have targeted, and may continue to target, private company infrastructure including data centers. Moreover, we have business operations in the San Francisco Bay Area, which is a seismically active region, as well as in the Miami, Florida area, which regularly experiences active hurricane seasons. Despite any precautions we may take, the occurrence of a catastrophic event or other unanticipated problems at our or our third-party vendors’ hosting facilities, or within our systems or the systems of third parties upon which we rely, could result in interruptions, performance problems, or failure of our infrastructure, technology, or platforms, which may adversely impact our business. In addition, our ability to conduct normal business operations could be severely affected. In the event of significant physical damage to or permanent loss of one of these facilities, it may take a significant period of time to achieve full resumption of our services, there may be inadequate or ineffective redundancy, and our disaster recovery planning may not account for all eventualities. In addition, any negative publicity arising from these disruptions could harm our reputation and brand and adversely affect our business.

Current wording

Our systems and the third-party systems upon which we and our customers rely are also vulnerable to damage or interruption from catastrophic occurrences such as earthquakes, floods, fires, power loss, telecommunication failures, cybersecurity threats, terrorist attacks, such as the conflict resulting from Hamas’ attack on Israel, natural disasters, public health crises, geopolitical tensions such as those that may be caused by the ongoing Russia-Ukraine conflict, or acts of misconduct and war. For example, the sustained conflict in the Middle East has led to retaliatory strikes by Iran that have targeted, and may continue to target, private company infrastructure including data centers. Moreover, we have business operations in the San Francisco Bay Area, which is a seismically active region, as well as in the Miami, Florida area, which regularly experiences active hurricane seasons. Despite any precautions we may take, the occurrence of a catastrophic event or other unanticipated problems at our or our third-party vendors’ hosting facilities, or within our systems or the systems of third parties upon which we rely, could result in interruptions, performance problems, or failure of our infrastructure, technology, or platforms, which may adversely impact our business. In addition, our ability to conduct normal business operations could be severely affected. In the event of significant physical damage to or permanent loss of one of these facilities, it may take a significant period of time to achieve full resumption of our services, there may be inadequate or ineffective redundancy, and our disaster recovery planning may not account for all eventualities. In addition, any negative publicity arising from these disruptions could harm our reputation and brand and adversely affect our business.

Previous wording

In addition, our platforms integrate a wide variety of other elements, and our platforms must successfully interoperate with products from other vendors and our customers’ internally developed software. As a result, when problems occur for a customer using our platforms, it may be difficult to identify the sources of these problems, and we may receive blame for a security, access control, or other compliance breach that was the result of the failure of one of the other elements in a customer’s or another vendor’s IT, security, or compliance infrastructure. The occurrence of software or errors in data, whether or not caused by our platforms, could delay or reduce market acceptance of our platforms and have an adverse effect on our business and financial performance, and any necessary revisions may cause us to incur significant expenses. The occurrence of any such problems could harm our business, financial condition, and results of operations. If an actual or perceived breach of information correctness, auditability, integrity, or availability occurs in one of our customers’ systems, regardless of whether the breach is attributable to our platforms, the market perception of the effectiveness of our platforms could be harmed. Alleviating any of these problems could require additional significant expenditures of our capital and other resources and could cause interruptions, delays, or cessation of our product licensing, which could cause us to lose existing or potential customers and could adversely affect our business, financial condition, results of operations, and growth prospects.

Current wording

In addition, our platforms integrate a wide variety of other elements, and our platforms must successfully interoperate with products from other vendors and our customers’ internally developed software. As a result, when problems occur for a customer using our platforms, it may be difficult to identify the sources of these problems, and we may receive blame for a security, access control, or other compliance breach that was the result of the failure of one of the other elements in a customer’s or another vendor’s IT, security, or compliance infrastructure. The occurrence of software errors or errors in data, whether or not caused by our platforms, could delay or reduce market acceptance of our platforms and have an adverse effect on our business and financial performance, and any necessary revisions may cause us to incur significant expenses. The occurrence of any such problems could harm our business, financial condition, and results of operations. If an actual or perceived breach of information correctness, auditability, integrity, or availability occurs in one of our customers’ systems, regardless of whether the breach is attributable to our platforms, the market perception of the effectiveness of our platforms could be harmed. Alleviating any of these problems could require additional significant expenditures of our capital and other resources and could cause interruptions, delays, or cessation of our product licensing, which could cause us to lose existing or potential customers and could adversely affect our business, financial condition, results of operations, and growth prospects.

Previous wording

Our technology platforms are distributed with software licensed by its authors or other third parties under “open source” licenses. Some of these licenses contain requirements that we make available source code for modifications or derivative works we create based upon the open source software, and that we license these modifications or derivative works under the terms of a particular open source license or other license granting third parties certain rights of further use. If we combine our proprietary software with open source software in a certain manner, we could, under certain provisions of the open source licenses, be required to release the source code of our proprietary software. In addition to risks related to license requirements, usage of open source software can lead to greater risks than use of third-party commercial software, as open source licensors generally do not provide updates, warranties, support, indemnities, assurances of title, or controls on origin of the software, and are provided on an “as-is” basis. Likewise, some open source projects have known security and other vulnerabilities and architectural instabilities, or are otherwise subject to security attacks due to their wide availability, and are provided on an “as-is” basis. We have established processes to help alleviate these risks, including a review process for screening requests from our development organization for the use of open source software, and the use of software tools to review our source code for open source software, but we cannot be sure that all open source software is submitted for approval prior to use in our platforms or that such software tools will be effective. In addition, open source license terms may be ambiguous and many of the risks associated with usage of open source software cannot be eliminated, and could, if not properly addressed, negatively affect our business. If we were found to have inappropriately used open source software, we may be required to re-engineer our platforms, to release proprietary source code, to discontinue the sale of our platforms in the event re-engineering could not be accomplished on a timely basis, or to take other remedial action that may divert resources away from our development efforts, any of which could adversely affect our business, results of operations, financial condition, and growth prospects. In addition, if the open source software we use is no longer maintained by the relevant open source community, then it may be more difficult to make the necessary revisions to our software, including modifications to address security vulnerabilities, which could impact our ability to mitigate cybersecurity risks or fulfill our contractual obligations to our customers. We may also face claims from copyright owners seeking to enforce the terms of an open source license governing the software, including by demanding release of the open source software, derivative works or our proprietary source code that was de…

Excerpt shortened here; the source contains the full paragraph.

Current wording

Our technology platforms are distributed with software licensed by its authors or other third parties under “open source” licenses. Some of these licenses contain requirements that we make available source code for modifications or derivative works we create based upon the open source software, and that we license these modifications or derivative works under the terms of a particular open source license or other license granting third parties certain rights of further use. If we combine our proprietary software with open source software in a certain manner, we could, under certain provisions of the open source licenses, be required to release the source code of our proprietary software. In addition to risks related to license requirements, usage of open source software can lead to greater risks than use of third-party commercial software, as open source licensors generally do not provide updates, warranties, support, indemnities, assurances of title, or controls on origin of the software, and are provided on an “as-is” basis. Likewise, some open source projects have known security and other vulnerabilities and architectural instabilities, or are otherwise subject to security attacks due to their wide availability, and are provided on an “as-is” basis. We have established processes to help alleviate these risks, including a review process for screening requests from our development organization for the use of open source software, and the use of software tools to review our source code for open source software, but we cannot be sure that all open source software is submitted for approval prior to use in our platforms or that such software tools will be effective. In addition, open source license terms may be ambiguous and many of the risks associated with usage of open source software cannot be eliminated, and could, if not properly addressed, negatively affect our business. If we were found to have inappropriately used open source software, we may be required to re-engineer our platforms, to release proprietary source code, to discontinue the sale of our platforms in the event re-engineering could not be accomplished on a timely basis, or to take other remedial action that may divert resources away from our development efforts, any of which could adversely affect our business, results of operations, financial condition, and growth prospects. In addition, if the open source software we use is no longer maintained by the relevant open source community, then it may be more difficult to make the necessary revisions to our software, including modifications to address security vulnerabilities, which could impact our ability to mitigate cybersecurity risks or fulfill our contractual obligations to our customers. We may also face claims from copyright owners seeking to enforce the terms of an open source license governing the software, including by demanding release of the open source software, derivative works or our proprietary source code that was de…

Excerpt shortened here; the source contains the full paragraph.

Previous wording

We are subject to a variety of local, state, national, and international laws, directives, and regulations in the United States and abroad that involve matters central to our business, including privacy and data protection, data security, data storage, retention, transfer and deletion, technology protection, and personal information. International data protection, data security, privacy, and other laws and regulations can impose different obligations or be more restrictive than those in the United States. These U.S. federal and state and foreign laws and regulations, which, depending on the regime, may be enforced by private parties or government entities, are constantly evolving and can be subject to significant change, and they are likely to continue to develop and evolve for the foreseeable future. In addition, the application, interpretation, and enforcement of these laws and regulations are often uncertain, particularly in the new and rapidly evolving software and technology industry in which we operate, and may be interpreted and applied inconsistently from country to country and inconsistently with our current policies and practices. A number of proposals are pending before U.S. federal, state, and foreign legislative and regulatory bodies that could significantly affect our business. For example, despite the EU’s adoption of an adequacy decision for the EU-U.S. Data Privacy Framework, legal challenges to the mechanisms allowing companies to transfer personal data from the European Economic Area to certain other jurisdictions, including the United States, have occurred and new legal challenges could emerge, resulting in further limitations on the ability to transfer data across borders. The California state legislature passed the California Consumer Privacy Act (“CCPA”) in 2018 and California voters approved a ballot measure establishing the California Privacy Rights Act (“CPRA”) in 2020. The CCPA and CPRA regulate the processing of personal information of California residents and increase the privacy and security obligations of entities handling certain personal information of California residents, including requiring covered companies to provide disclosures to California consumers, and affording such consumers abilities to opt-out of certain sales of personal information. The CCPA went into effect on January 1, 2020, and the California Attorney General may bring enforcement actions, with penalties for violations of the CCPA. The CPRA went into effect on January 1, 2023 instilling enforcement authority in a new dedicated regulatory body, the California Privacy Protection Agency (“CPPA”). In September 2025, the CPPA finalized regulations expanding compliance obligations under the CCPA, implementing requirements for businesses to conduct risk assessments and annual cybersecurity audits, as well as consumer rights related to automated decision-making technology, with compliance deadlines phased between January 2026 and April 2030. The CCPA’s…

Excerpt shortened here; the source contains the full paragraph.

Current wording

We are subject to a variety of local, state, national, and international laws, directives, and regulations in the United States and abroad that involve matters central to our business, including privacy and data protection, data security, data storage, retention, transfer and deletion, technology protection, and personal information. International data protection, data security, privacy, and other laws and regulations can impose different obligations or be more restrictive than those in the United States. These U.S. federal and state and foreign laws and regulations, which, depending on the regime, may be enforced by private parties or government entities, are constantly evolving and can be subject to significant change, and they are likely to continue to develop and evolve for the foreseeable future. In addition, the application, interpretation, and enforcement of these laws and regulations are often uncertain, particularly in the new and rapidly evolving software and technology industry in which we operate, and may be interpreted and applied inconsistently from country to country and inconsistently with our current policies and practices. A number of proposals are pending before U.S. federal, state, and foreign legislative and regulatory bodies that could significantly affect our business. For example, despite the EU’s adoption of an adequacy decision for the EU-U.S. Data Privacy Framework, legal challenges to the mechanisms allowing companies to transfer personal data from the European Economic Area to certain other jurisdictions, including the United States, have occurred and new legal challenges could emerge, resulting in further limitations on the ability to transfer data across borders. The enactment of the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020 (collectively, the “CCPA”), has influenced the adoption of comprehensive privacy laws across the United States. The CCPA regulates the processing of personal information of California residents and increases the privacy and security obligations of entities handling certain personal information of California residents. The CCPA authorizes enforcement by the California Attorney General and the California Privacy Protection Agency (the “CPPA”), and in certain circumstances, permits private actions. In September 2025, the CPPA finalized regulations expanding compliance obligations under the CCPA, including requirements relating to risk assessments, annual cybersecurity audits, and consumer rights related to automated decision-making technology, with compliance deadlines phased between January 2026 and April 2030. As of the third quarter of 2026, twenty states have operative comprehensive consumer privacy laws in effect, and several have enacted amendments expanding coverage or enhancing enforcement authority. Additionally, states have adopted other laws and regulations relating to privacy and cybersecurity such as Washington’s My Health My Data A…

Excerpt shortened here; the source contains the full paragraph.

Previous wording

We cannot yet fully assess the impact of these laws and other new laws or regulations on our business or operations, but developments regarding these and other privacy and data protection laws and regulations around the world may require us to modify our data processing practices and policies and to incur substantial costs and expenses in an effort to maintain compliance on an ongoing basis. Outside of the United States, virtually every jurisdiction in which we operate has established its own legal framework relating to privacy, data protection, and information security matters with which we and/or our customers must comply. Laws and regulations in these jurisdictions apply broadly to the collection, use, storage, retention, disclosure, security, transfer, and other processing of data that identifies or may be used to identify or locate an individual. Some countries and regions, including the EU, are considering or have passed legislation that imposes significant obligations in connection with privacy, data protection, and information security that could increase the cost and complexity of delivering our platforms and services, including the European General Data Protection Regulation (“GDPR”) which took effect in May 2018; the EU AIA, which entered into force in August 2024 but continues to be phased in and establishes a risk-based framework for AI systems; and the Network and Information Security Directive 2 (“NIS2”), which replaced the original NIS Directive as of October 2024, and imposes additional cybersecurity risk management and incident reporting obligations. The EU also implemented the Digital Operational Resilience Act (“DORA”), which introduces new standards for Information and Communication Technology risk management and incident reporting for financial and insurance entities, and the European Union’s Data Act (the “Data Act”) became applicable on September 12, 2025. Among other things, the Data Act may affect some customers’ ability to terminate service agreements with us or our competitors, and compliance with the Data Act may require us to adjust contract terms and technical measures for data portability for customers in the EU. These changes may impact the duration of customer relationships in the EU and result in additional compliance and operational costs, which may affect our business. Forthcoming EU regulatory developments, envisioned under the European Commission’s Digital Omnibus

Current wording

We cannot yet fully assess the impact of these laws and other new laws or regulations on our business or operations, but developments regarding these and other privacy and data protection laws and regulations around the world may require us to modify our data processing practices and policies and to incur substantial costs and expenses in an effort to maintain compliance on an ongoing basis. Outside of the United States, virtually every jurisdiction in which we operate has established its own legal framework relating to privacy, data protection, and information security matters with which we and/or our customers must comply. Laws and regulations in these jurisdictions apply broadly to the collection, use, storage, retention, disclosure, security, transfer, and other processing of data that identifies or may be used to identify or locate an individual. Some countries and regions, including the EU, are considering or have passed legislation that imposes significant obligations in connection with privacy, data protection, and information security that could increase the cost and complexity of delivering our platforms and services, including the European General Data Protection Regulation (“GDPR”) which took effect in May 2018; the EU AIA, which entered into force in August 2024 but continues to be phased in and establishes a risk-based framework for AI systems; and the Network and Information Security Directive 2 (“NIS2”), which replaced the original NIS Directive as of October 2024, and imposes additional cybersecurity risk management and incident reporting obligations. The EU also implemented the Digital Operational Resilience Act (“DORA”), which introduces new standards for Information and Communication Technology risk management and incident reporting for financial and insurance entities, and the European Union’s Data Act (the “Data Act”) became applicable on September 12, 2025. Among other things, the Data Act may affect some customers’ ability to terminate service agreements with us or our competitors, and compliance with the Data Act may require us to adjust contract terms and technical measures for data portability for customers in the EU. These changes may impact the duration of customer relationships in the EU and result in additional compliance and operational costs, which may affect our business. Forthcoming EU regulatory developments, envisioned under the European Commission’s Digital Omnibus Package initiative, while aimed at streamlining regulatory obligations, may introduce further considerations or challenges for us or our customers in addressing EU digital compliance frameworks. Complying with the GDPR, EU AIA, NIS2, DORA, the Data Act, or other EU laws, directives, and regulations as they emerge may cause us to incur substantial operational costs, lead to challenges for our customers’ implementation and use of our platform, or require us to modify our data handling practices on an ongoing basis. Non-compliance with the GDPR specif…

Excerpt shortened here; the source contains the full paragraph.

Previous wording

Additionally, post-Brexit updates to United Kingdom (“U.K.”) data protection laws and regulations, such as the Data (Use and Access) Act 2025, while largely conforming to EU GDPR standards paving the way for a 2021 European Commission adequacy determination for export of personal data from the European Economic Area to the U.K., may change over time as the U.K. and its regulator, the Information Commissioner’s Office, continue to examine its global market standing. In December 2025, the European Commission renewed the U.K. adequacy decisions originally adopted in 2021, subject to a term of six years and set to expire in December 2031; however, it also committed to a mid-point review of the decisions after four years to evaluate ongoing adequacy. Modifications in the standards for valid data transfer to the U.S. from the U.K., the EU, Switzerland, and other countries using standard contractual clauses or similar mechanisms may further require us to change our product and business practices, as well as to update client agreements in ways that introduce additional costs to our business.

Current wording

Additionally, post-Brexit updates to U.K. data protection laws and regulations may impact the U.K.’s continued alignment with EU data protection standards and its adequacy status for transfers of personal data from the European Economic Area. Following the implementation of the Data (Use and Access) Act of 2025, the European Commission renewed the U.K. adequacy decision adopted in 2021. The decision was renewed in December 2025, subject to a term of six years and set to expire in December 2031; however, the Commission committed to an interim review after four years to evaluate ongoing adequacy. Modifications in the standards for valid data transfer to the U.S. from the U.K., the EU, Switzerland, and other countries using standard contractual clauses or similar mechanisms may further require us to change our product and business practices, as well as to update client agreements in ways that introduce additional costs to our business.

Previous wording

Similarly, South Korea's Personal Information Protection Act (“PIPA”) has recent and forthcoming amendments that may materially increase our compliance costs and regulatory exposure. PIPA’s recent amendments have expanded the scope of the law and intensified enforcement, including expanded executive accountability and breach notification obligations (effective September 2026), mandatory certification requirements (effective July 2027), and substantially increased financial penalties (adopted in February 2026) which authorize the Personal Information Protection Commission to impose administrative fines of up to 10% of a company's total revenue for noncompliance. The revised penalty framework, together with the phased implementation of these amendments through 2027, may increase our potential financial exposure in the event of a data incident or regulatory finding and will require ongoing investment in compliance infrastructure. In addition, South Korea's Framework Act on the Development of Artificial Intelligence and the Establishment of a Foundation for Trust (the “AI Basic Act”) took effect in January 2026, introducing heightened obligations on providers and operators of “high-impact” AI systems, including transparency and risk management requirements, adding further complexity and cost to our operations.

Current wording

Similarly, recent and forthcoming amendments to South Korean data protection and information security laws, including the Personal Information Protection Act (“PIPA”), may increase our compliance costs. The amendments expand PIPA’s scope and enforcement mechanisms, including enhanced executive accountability, breach notification obligations, mandatory certification requirements, and revised financial penalties. Under the revised framework, the Personal Information Protection Commission may impose administrative fines of up to 10% of a company's total revenue for noncompliance. Customers may also impose additional due diligence and contractual requirements to support their compliance with laws applicable to their use of our products, increasing our compliance and operating costs. These developments may increase our financial exposure if we violate applicable requirements or fail to satisfy customer-imposed obligations and may require additional investment in compliance infrastructure. In addition, South Korea's Framework Act on the Development of Artificial Intelligence and the Establishment of a Foundation for Trust (the “AI Basic Act”) took effect in January 2026, introducing heightened obligations on providers and operators of “high-impact” AI systems, including transparency and risk management requirements, adding further complexity and cost to our operations.

Previous wording

The overarching complexity of laws and regulations relating to privacy, data protection, and information security around the world pose a compliance challenge that could manifest in costs, damages, or liability in other forms as a result of failure to implement proper programmatic controls, failure to adhere to those controls or to the commitments we make, or the malicious or inadvertent breach of applicable legal, regulatory, or contractual privacy, data protection, or information security requirements by us, our employees, our business partners, or our customers.

Current wording

The overarching complexity of laws and regulations relating to privacy, data protection, and information security around the world poses a compliance challenge that could manifest in costs, damages, or liability in other forms as a result of failure to implement proper programmatic controls, failure to adhere to those controls or to the commitments we make, or the malicious or inadvertent breach of applicable legal, regulatory, or contractual privacy, data protection, or information security requirements by us, our employees, our business partners, or our customers.

Previous wording

In addition to government regulation, self-regulatory standards and other industry standards may legally or contractually apply to us, be argued to apply to us, or we may elect to comply with such standards or to facilitate our customers’ compliance with such standards. Because privacy, data protection, and information security are critical competitive factors in our industry, we may make statements on our website, in marketing materials, or in other settings about our data security measures and our compliance with, or our ability to facilitate our customers’ compliance with, these standards. We also expect that there will continue to be new proposed laws and regulations concerning privacy, data protection, and information security, and we cannot yet determine the impact such future laws, regulations and standards, or amendments to or re-interpretations of existing laws and regulations, industry standards, or other obligations may have on our business. New laws, amendments to or re-interpretations of existing laws and regulations, industry standards, and contractual and other obligations may require us to incur additional costs and restrict our business operations. As these legal regimes relating to privacy, data protection, and information security continue to evolve, they may result in ever-increasing public scrutiny and escalating levels of enforcement and sanctions. Furthermore, because the interpretation and application of laws, standards, contractual obligations and other obligations relating to privacy, data protection, and information security are uncertain, these laws, standards, and contractual and other obligations may be interpreted and applied in a manner that is, or is alleged to be, inconsistent with our data management practices, our policies or procedures, or the features of our platforms, or we may simply fail to properly develop or implement our practices, policies, procedures, or features in compliance with such obligations. If so, in addition to the possibility of fines, lawsuits, investigations, and other claims or proceedings, we could be required to fundamentally change our business activities and practices or modify our platforms, which could have an adverse effect on our business. We may be unable to make such changes and modifications in a commercially reasonable manner or at all, and our ability to fulfill existing obligations, make enhancements, or develop new platforms and features could be limited. Furthermore, the costs of compliance with, and other burdens imposed by, the laws, regulations, and policies that are applicable to the businesses of our customers may limit the use and adoption of, and reduce the overall demand for, our platforms.

Current wording

In addition to government regulation, self-regulatory standards and other industry standards may legally or contractually apply to us, be argued to apply to us, or we may elect to comply with such standards or to facilitate our customers’ compliance with such standards. Because privacy, data protection, and information security are critical competitive factors in our industry, we may make statements on our website, in marketing materials, or in other settings about our data security measures and our compliance with, or our ability to facilitate our customers’ compliance with, these standards. We also expect that there will continue to be new proposed laws and regulations concerning privacy, data protection, artificial intelligence, and information security, and we cannot yet determine the impact such future laws, regulations and standards, or amendments to or re-interpretations of existing laws and regulations, industry standards, or other obligations may have on our business. New laws, amendments to or re-interpretations of existing laws and regulations, industry standards, and contractual and other obligations may require us to incur additional costs and restrict our business operations. As these legal regimes relating to privacy, data protection, and information security continue to evolve, they may result in ever-increasing public scrutiny and escalating levels of enforcement and sanctions. Furthermore, because the interpretation and application of laws, standards, contractual obligations and other obligations relating to privacy, data protection, and information security are uncertain, these laws, standards, and contractual and other obligations may be interpreted and applied in a manner that is, or is alleged to be, inconsistent with our data management practices, our policies or procedures, or the features of our platforms, or we may simply fail to properly develop or implement our practices, policies, procedures, or features in compliance with such obligations. If so, in addition to the possibility of fines, lawsuits, investigations, and other claims or proceedings, we could be required to fundamentally change our business activities and practices or modify our platforms, which could have an adverse effect on our business. We may be unable to make such changes and modifications in a commercially reasonable manner or at all, and our ability to fulfill existing obligations, make enhancements, or develop new platforms and features could be limited. Furthermore, the costs of compliance with, and other burdens imposed by, the laws, regulations, and policies that are applicable to the businesses of our customers may limit the use and adoption of, and reduce the overall demand for, our platforms.

Previous wording

•volatility in non-U.S. political and economic environments, including by way of examples, the potential effects of the ongoing Russia-Ukraine conflict, as well as economic sanctions the United States and other countries have imposed on Russia, the conflict resulting from Hamas’ attack on Israel, and the ongoing conflicts in the Middle East, including the escalation of hostilities resulting from the recent strikes by the United States and Israel on Iran and retaliatory strikes related thereto;

Current wording

•volatility in non-U.S. political and economic environments, including by way of examples, the potential effects of the ongoing Russia-Ukraine conflict, as well as economic sanctions the United States and other countries have imposed on

Previous wording

Our business is subject to regulation by various federal, state, local, and foreign governments in which we operate. In certain jurisdictions, the regulatory requirements imposed by foreign governments may be more stringent than those in the United States. Noncompliance with applicable regulations or requirements could subject us to investigations, administrative proceedings, sanctions, enforcement actions, disgorgement of profits, fines, damages, litigation, civil and criminal penalties, termination of contracts, exclusion from sales channels or sales opportunities, injunctions, or other consequences. Such matters may include, but are not limited to, claims, disputes, allegations, or investigations related to alleged violations of laws or regulations relating to anti-corruption requirements, lobbying or conflict-of-interest requirements, export or other trade controls, data privacy or data protection requirements, or laws or regulations relating to employment, procurement, cybersecurity, securities, or antitrust/competition requirements. The effects of recently imposed and proposed actions are uncertain because of the dynamic nature of governmental action and responses. For example, governmental bodies have implemented laws and are considering further regulation of AI (including machine learning), which could negatively impact our ability to use and develop platforms and products incorporating these technologies. The European Union Parliament adopted the EU AIA, that, despite recent moves to delay the implementation of some provisions, when effective, will likely impose onerous obligations related to the development, sale and use of AI-related systems. In January 2026, South Korea's AI Basic Act took effect, introducing heightened obligations on providers and operators of “high-impact” AI systems used in critical sectors, and authority to impose suspension of AI services along with administrative fines for noncompliance. While the South Korean government has indicated it will adopt a phased enforcement approach with an initial grace period of at least one year, the ultimate scope and rigor of enforcement remain uncertain. In addition, Colorado has passed a Consumer Protections for Artificial Intelligence bill introducing state-level oversight of “high-risk” AI systems, which mirrors language and several provisions appearing in the EU AIA. Many states, notably California, Utah, Texas, Colorado, New York, Washington, Tennessee, Georgia, and Indiana have signed private-sector AI governance legislation focused on various aspects of AI oversight. Further, certain administrations have encouraged companies to sign on to voluntary commitments to manage the risks posed by AI alongside related legislative or regulatory efforts, some of which we have signed. When such legislation or commitments, or if similar legislation or commitments in other jurisdictions, are enacted or adopted, compliance with such obligations may be difficult, onerous, and costly, an…

Excerpt shortened here; the source contains the full paragraph.

Current wording

States. Noncompliance with applicable regulations or requirements could subject us to investigations, administrative proceedings, sanctions, enforcement actions, disgorgement of profits, fines, damages, litigation, civil and criminal penalties, termination of contracts, exclusion from sales channels or sales opportunities, injunctions, or other consequences. Such matters may include, but are not limited to, claims, disputes, allegations, or investigations related to alleged violations of laws or regulations relating to anti-corruption requirements, lobbying or conflict-of-interest requirements, export or other trade controls, data privacy or data protection requirements, or laws or regulations relating to employment, procurement, cybersecurity, securities, or antitrust/competition requirements. The effects of recently imposed and proposed actions are uncertain because of the dynamic nature of governmental action and responses. For example, governmental bodies have implemented laws and are considering further regulation of AI (including machine learning), which could negatively impact our ability to use and develop platforms and products incorporating these technologies. The European Union Parliament adopted the EU AIA, that, despite recent moves to delay the implementation of some provisions, imposes onerous obligations related to the development, sale and use of AI-related systems. In January 2026, South Korea's AI Basic Act took effect, introducing heightened obligations on providers and operators of “high-impact” AI systems used in critical sectors, and authority to impose suspension of AI services along with administrative fines for noncompliance. While the South Korean government has indicated it will adopt a phased enforcement approach with an initial grace period of at least one year, the ultimate scope and rigor of enforcement remain uncertain. In addition, Colorado has passed a Consumer Protections for Artificial Intelligence bill introducing state-level oversight of “high-risk” AI systems, which mirrors language and several provisions appearing in the EU AIA. Many states, notably California, Utah, Texas, Colorado, New York, Washington, Tennessee, Georgia, Indiana, and Illinois have signed private-sector AI governance legislation focused on various aspects of AI oversight. Further, certain administrations have encouraged companies to sign on to voluntary commitments to manage the risks posed by AI alongside related legislative or regulatory efforts, some of which we have signed. When such legislation or commitments, or if similar legislation or commitments in other jurisdictions, are enacted or adopted, compliance with such obligations may be difficult, onerous, and costly, and could adversely affect our business, reputation, financial condition, results of operations, and growth prospects.

Previous wording

We have previously been, and are currently, or in the future may become, involved in a number of legal, regulatory, and administrative inquiries and proceedings, and unfavorable outcomes in litigation or other of these matters could negatively impact our business, financial conditions, and results of operations.

Current wording

We have previously been, and are currently, or in the future may become, involved in a number of legal, regulatory, and administrative inquiries and proceedings, and unfavorable outcomes in litigation or other of these matters could negatively impact our business, financial condition, and results of operations.

Previous wording

The number and significance of our legal disputes and inquiries may increase as we continue to grow larger, as our business expands in employee headcount, scope, and geographic reach, and as our platforms and services become more complex. Additionally, if customers fail to pay us under the terms of our agreements, we may be adversely affected due to the cost of enforcing the terms of our contracts through litigation. Litigation or other proceedings can be expensive and time consuming and can divert our resources and leadership’s attention from our primary business operations. The results of our litigation also cannot be predicted with certainty. If we are unable to prevail in litigation, we could incur payments of substantial monetary damages or fines, or undesirable changes to our platforms or business practices, and accordingly, our business, financial condition, or results of operations could be materially and adversely affected. Furthermore, if we accrue a loss contingency for pending litigation and determine that it is probable, any disclosures, estimates, and reserves we reflect in our financial statements with regard to these matters may not reflect the ultimate disposition or financial impact of litigation or other such matters. These proceedings could also result in negative publicity, which could harm customer and public perception of our business, regardless of whether the allegations are valid or whether we are ultimately found liable. Additional information regarding certain of the lawsuits we are involved in is described further in Note 7. Commitments and Contingencies in our condensed consolidated financial statements included elsewhere in this Quarterly Report on Form 10-Q.

Current wording

Additionally, if customers fail to pay us under the terms of our agreements, we may be adversely affected due to the cost of enforcing the terms of our contracts through litigation. Litigation or other proceedings can be expensive and time consuming and can divert our resources and leadership’s attention from our primary business operations. The results of our litigation also cannot be predicted with certainty. If we are unable to prevail in litigation, we could incur payments of substantial monetary damages or fines, or undesirable changes to our platforms or business practices, and accordingly, our business, financial condition, or results of operations could be materially and adversely affected. Furthermore, if we accrue a loss contingency for pending litigation and determine that it is probable, any disclosures, estimates, and reserves we reflect in our financial statements with regard to these matters may not reflect the ultimate disposition or financial impact of litigation or other such matters. These proceedings could also result in negative publicity, which could harm customer and public perception of our business, regardless of whether the allegations are valid or whether we are ultimately found liable. Additional information regarding certain of the lawsuits we are involved in is described further in Note 7. Commitments and Contingencies in our condensed consolidated financial statements included elsewhere in this Quarterly Report on Form 10-Q.

Previous wording

We prepare our condensed consolidated financial statements in accordance with Generally Accepted Accounting Principles (“GAAP”) in the United States. In particular, we make certain estimates and assumptions related to the adoption and interpretation of these principles including related to the recognition of our revenue. If these assumptions turn out to be incorrect, our financial results and position could materially differ from our expectations and could be materially adversely affected. A change in any of these principles or guidance, or in their interpretations or application to us, may have a significant effect on our reported results, as well as our processes and related controls, and may retroactively affect previously reported results or our forecasts, which may negatively impact our financial statements.

Current wording

We prepare our condensed consolidated financial statements in accordance with GAAP in the United States. In particular, we make certain estimates and assumptions related to the adoption and interpretation of these principles including related to the recognition of our revenue. If these assumptions turn out to be incorrect, our financial results and position could materially differ from our expectations and could be materially adversely affected. A change in any of these principles or guidance, or in their interpretations or application to us, may have a significant effect on our reported results, as well as our processes and related controls, and may retroactively affect previously reported results or our forecasts, which may negatively impact our financial statements.

Previous wording

Many countries are beginning to implement legislation and other guidance to align their international tax rules with the Organisation for Economic Co-operation and Development’s (“OECD”) Base Erosion and Profit Shifting (“BEPS”) recommendations and action plan that aim to standardize and modernize global corporate tax policy, including changes to cross-border tax, transfer pricing documentation rules, and nexus-based tax incentive practices. The OECD is also continuing discussions surrounding fundamental changes in allocation of profits among tax jurisdictions in which companies do business, as well as the implementation of a global minimum tax (namely the “Pillar One” and “Pillar Two” proposals). Many countries have enacted or begun the process of enacting laws based on Pillar Two proposals, which may adversely impact our provision for income taxes, net income, and cash flows. We have considered the impact of the currently enacted Pillar Two rules and determined that we became subject to certain rules starting January 1, 2024 in some jurisdictions, and it did not have a material impact on our financial condition or results of operations for the six months ended June 30, 2026. Furthermore, in response to trade negotiations with the United States, the Group of 7 countries (the “G7”) announced a joint understanding to exempt U.S.-parented multinational corporations from Pillar Two by adopting a “side-by-side” system between Pillar Two and the existing U.S. global minimum tax provisions, and the OECD released“Tax Challenges Arising from the Digitalisation of the Economy – Global Anti-Base Erosion Model Rules (Pillar Two), Side-by-Side Package: Inclusive Framework on BEPS” on January 5, 2026, to this effect, which reduces the impact of Pillar Two rules on us. We continue to monitor developments and evaluate impacts, if any, of these provisions on our financial condition or results of operations in the future.

Current wording

Many countries are beginning to implement legislation and other guidance to align their international tax rules with the Organisation for Economic Co-operation and Development’s (“OECD”) Base Erosion and Profit Shifting (“BEPS”) recommendations and action plan that aim to standardize and modernize global corporate tax policy, including changes to cross-border tax, transfer pricing documentation rules, and nexus-based tax incentive practices. The OECD is also continuing discussions surrounding fundamental changes in allocation of profits among tax jurisdictions in which companies do business, as well as the implementation of a global minimum tax (namely the “Pillar One” and “Pillar Two” proposals). Many countries have enacted or begun the process of enacting laws based on Pillar Two proposals, which may adversely impact our provision for income taxes, net income, and cash flows. We have considered the impact of the currently enacted Pillar Two rules and determined that we became subject to certain rules starting January 1, 2024 in some jurisdictions, and it did not have a material impact on our financial condition or results of operations for the nine months ended September 30, 2026. Furthermore, in response to trade negotiations with the United States, the Group of 7 countries (the “G7”) announced a joint understanding to exempt U.S.-parented multinational corporations from Pillar Two by adopting a “side-by-side” system between Pillar Two and the existing U.S. global minimum tax provisions, and the OECD released“Tax Challenges Arising from the Digitalisation of the Economy – Global Anti-Base Erosion Model Rules (Pillar Two), Side-by-Side Package: Inclusive Framework on BEPS” on January 5, 2026, to this effect, which reduces the impact of Pillar Two rules on us. We continue to monitor developments and evaluate impacts, if any, of these provisions on our financial condition or results of operations in the future.

Previous wording

•changes in the political environment, including before or after a change to the leadership or overall composition within the government, or due to ongoing conflicts such as the Russia-Ukraine conflict and related economic sanctions, the conflict resulting from Hamas’ attack on Israel and the ongoing conflicts in the Middle East, including the escalation of hostilities resulting from the recent strikes by the United States and Israel on Iran and retaliatory strikes related thereto, and regional instability, and any resulting uncertainty or changes in policy or priorities and resultant funding;

Current wording

•changes in the political environment, including before or after a change to the leadership or overall composition within the government, or due to ongoing conflicts such as the Russia-Ukraine conflict and related economic sanctions, the conflict resulting from Hamas’ attack on Israel and the ongoing conflicts in the Middle East, including the hostilities in Iran, and regional instability, and any resulting uncertainty or changes in policy or priorities and resultant funding;

Previous wording

•budgetary constraints, including automatic reductions as a result of “sequestration” or similar measures and constraints imposed by any lapses in appropriations for the federal government or certain of its departments and agencies, for example in connection with an extended federal government shutdown, including the federal government’s shutdown in the third quarter of 2025;

Current wording

•budgetary constraints, including automatic reductions as a result of “sequestration” or similar measures and constraints imposed by any lapses in appropriations for the federal government or certain of its departments and agencies, for example in connection with an extended federal government shutdown, including the federal government’s shutdown in the fourth quarter of 2025;

Previous wording

U.S. government agencies, including our customers, often award large developmental item and service contracts to build custom software rather than firm fixed-price contracts for commercial products. We sell commercial items and services and do not contract for non-commercial developmental services. The U.S. government is required to procure commercial items and services to the maximum extent practicable in accordance with FASA, 10 U.S.C. § 2377; 41 U.S.C. § 3307, and the U.S. government may instead decide to procure non-commercial developmental items and services if commercial items and services are not practicable. In order to challenge a government decision to procure developmental items and services instead of commercial items and services, we would be required to file a bid protest at the agency level and/or with the Government Accountability Office. This can result in contentious communications with government agency legal and contracting offices, and may escalate to litigation in federal court. The results of any future challenges or potential litigation cannot be predicted with certainty, however, and any dispute or litigation with the U.S. government may not be resolved in our favor; moreover, whether or not it is resolved in our favor, such disputes or litigation could result in significant expense and divert the efforts of our technical and management personnel. These proceedings could adversely affect our reputation and relationship with government customers and could also result in negative publicity, which could harm customer and public perception of our business. The enforcement of FASA has resulted in a significant increase in our business with the U.S. federal government. Any change in or repeal of FASA, or a contrary interpretation of FASA by a court of competent jurisdiction, would adversely affect our competitive position for U.S. federal government contracts.

Current wording

U.S. government agencies, including our customers, often award large developmental product and service contracts to build custom software rather than firm fixed-price contracts for commercial products. We sell commercial products and services and do not contract for non-commercial developmental services. The U.S. government is required to procure commercial products and commercial services to the maximum extent practicable in accordance with FASA, 10 U.S.C. § 3453; 41 U.S.C. § 3307, and the U.S. government may instead decide to procure non-commercial developmental products and services if commercial products and services are not practicable. In order to challenge a government decision to procure developmental products and services instead of commercial items and services, we would be required to file a bid protest at the agency level and/or with the Government Accountability Office. This can result in contentious communications with government agency legal and contracting offices, and may escalate to litigation in federal court. The results of any future challenges or potential litigation cannot be predicted with certainty, however, and any dispute or litigation with the U.S. government may not be resolved in our favor; moreover, whether or not it is resolved in our favor, such disputes or litigation could result in significant expense and divert the efforts of our technical and management personnel. These proceedings could adversely affect our reputation and relationship with government customers and could also result in negative publicity, which could harm customer and public perception of our business. The enforcement of FASA has resulted in a significant increase in our business with the U.S. federal government. Any change in or repeal of FASA, or a contrary interpretation of FASA by a court of competent jurisdiction, would adversely affect our competitive position for U.S. federal government contracts.

Previous wording

•other events or factors, including those resulting from war, including the ongoing Russia-Ukraine and Middle East conflicts, including the escalation of hostilities resulting from the recent strikes by the United States and Israel on Iran and retaliatory strikes related thereto, incidents of terrorism, such as Hamas’ attack against Israel, pandemics, or responses to these events; and

Current wording

•other events or factors, including those resulting from war, including the ongoing Russia-Ukraine and Middle East conflicts, including the hostilities in Iran, incidents of terrorism, such as Hamas’ attack against Israel, pandemics, or responses to these events; and

Previous wording

In addition to the supply and demand and volatility risk factors discussed above, sales of a substantial number of shares of our Class A common stock into the public market, particularly sales by our directors, executive officers, and principal stockholders, or the perception that these sales might occur in large quantities, could cause the trading price of our Class A common stock to decline. As of June 30, 2026, approximately 1.69 million options will expire through December 2026 if not exercised prior to their respective expiration dates, and we expect many holders will elect to exercise such options prior to expiration. Upon exercise, the holders will receive shares of our Class A or Class B common stock, which may subsequently be sold.

Current wording

In addition to the supply and demand and volatility risk factors discussed above, sales of a substantial number of shares of our Class A common stock into the public market, particularly sales by our directors, executive officers, and principal stockholders, or the perception that these sales might occur in large quantities, could cause the trading price of our Class A common stock to decline. As of September 30, 2026, approximately 0.83 million options will expire through December 2026 if not exercised prior to their respective expiration dates, and we expect many holders will elect to exercise such options prior to expiration. Upon exercise, the holders will receive shares of our Class A or Class B common stock, which may subsequently be sold.

Previous wording

As of June 30, 2026, there were 2,300,516,590 shares of our Class A common stock outstanding, 101,375,151 shares of our Class B common stock outstanding and 1,005,000 shares of our Class F common stock outstanding. Substantially all of these shares may be immediately sold, although sales by our affiliates remain subject to compliance with the volume limitations of Rule 144.

Current wording

As of September 30, 2026, there were 2,306,361,081 shares of our Class A common stock outstanding, 101,787,133 shares of our Class B common stock outstanding, and 1,005,000 shares of our Class F common stock outstanding. Substantially all of these shares may be immediately sold, although sales by our affiliates remain subject to compliance with the volume limitations of Rule 144.

Previous wording

Further, as of June 30, 2026, there were outstanding options to purchase an aggregate of 19,746,179 shares of our Class A common stock and 129,930,461 shares of our Class B common stock, 14,167,216 shares of our Class A common stock and 19,500,000 shares of Class B common stock subject to RSUs, 13,690,664 shares of our Class A common stock subject to SARs and 121,393 shares of our Class A common stock subject to P-RSUs. All shares of our common stock reserved for future issuance under our equity compensation plans have been registered for sale under the Securities Act. Subject to compliance with Rule 144 or the availability of an alternative exemption, the shares issued upon exercise of stock options or SARs, or upon settlement of RSUs or P-RSUs will be available for immediate resale in the United States in the open market.

Current wording

Further, as of September 30, 2026, there were outstanding options to purchase an aggregate of 17,722,197 shares of our Class A common stock and 129,119,109 shares of our Class B common stock, 17,450,316 shares of our Class A common stock and 18,525,000 of Class B common stock subject to RSUs, 18,530,721 shares of our Class A common stock subject to SARs, and 139,562 shares of our Class A common stock subject to P-RSUs. All shares of our common stock reserved for future issuance under our equity compensation plans have been registered for sale under the Securities Act. Subject to compliance with Rule 144 or the availability of an alternative exemption, the shares issued upon exercise of stock options or SARs, or upon settlement of RSUs or P-RSUs will be available for immediate resale in the United States in the open market.

Previous wording

The trading market for our Class A common stock will depend in part on the research and reports that securities or industry analysts publish about us, our business, our market or our competitors. If one or more of the analysts who cover us downgrade our ordinary shares or publish inaccurate or unfavorable research about us, the trading price of our Class A common stock would likely decline. If these analysts publish target prices for our Class A common stock that are below the then-current public price of our Class A common stock, it could cause the trading price of our Class A common stock to decline significantly. Further, if one or more of these analysts cease coverage of Palantir or fail to publish reports on us regularly, demand for our Class A common stock could decrease, which might cause our Class A common stock trading price and trading volume to decline.

Current wording

The trading market for our Class A common stock will depend in part on the research and reports that securities or industry analysts publish about us, our business, our market or our competitors. If one or more of the analysts who cover us downgrade our Class A common stock or publish inaccurate or unfavorable research about us, the trading price of our Class A common stock would likely decline. If these analysts publish target prices for our Class A common stock that are below the then-current public price of our Class A common stock, it could cause the trading price of our Class A common stock to decline significantly. Further, if one or more of these analysts cease coverage of Palantir or fail to publish reports on us regularly, demand for our Class A common stock could decrease, which might cause our Class A common stock trading price and trading volume to decline.

Previous wording

Corporation Equity Securities may exceed the number of shares of our outstanding capital stock, as a comparison, there were 2,402,896,741 shares of our common stock outstanding as of June 30, 2026. Except for certain equitable adjustments as provided in our amended and restated certificate of incorporation, future issuances of Corporation Equity Securities by us will not increase the Ownership Threshold that must be met on any applicable record date and, accordingly, will decrease the percentage of outstanding Corporation Equity Securities represented by the Ownership Threshold.

Current wording

The Ownership Threshold that must be met on any applicable record date is currently 100,000,000 Corporation Equity Securities, which is a small minority of our outstanding Corporation Equity Securities. While the number of outstanding Corporation Equity Securities may exceed the number of shares of our outstanding capital stock, as a comparison, there were 2,409,153,214 shares of our common stock outstanding as of September 30, 2026. Except for certain equitable adjustments as provided in our amended and restated certificate of incorporation, future issuances of Corporation Equity Securities by us will not increase the Ownership Threshold that must be met on any applicable record date and, accordingly, will decrease the percentage of outstanding Corporation Equity Securities represented by the Ownership Threshold.

Previous wording

In addition, in the future we could create a new class of equity securities with different economic or voting rights than existing classes. If we were to create a new class of equity security, because of the broad definition of “Corporation Equity Securities,” such security could qualify as Corporation Equity Securities and therefore count towards the Ownership Threshold if held by our Founders who are then party to the Founder Voting Agreement or certain of their affiliates. If such security has lesser or no economic rights, it could have the effect of further increasing the divergence between the economic interests of our Founders who are then party to the Founder Voting Agreement and their affiliates, on the one hand, and the voting power of such Founders and their affiliates, on the other. Further, Corporation Equity Securities includes, among other things, any warrants, calls, options or other right, whether vested or unvested, to acquire from the Company certain voting or equity securities from the Company. Accordingly, the Board of Directors could issue additional equity securities, or additional options, RSUs, warrants or other rights to acquire equity securities (whether vested or unvested), to our Founders or certain of their affiliates, which would increase the number of Corporation Equity Securities they hold and enable them to meet the Ownership Threshold notwithstanding sales of Corporation Equity Securities that they currently hold. As a result, any Founders who are then party to the Founder Voting Agreement or certain of their affiliates could hold a nominal equity interest with little to no voting rights but meet the Ownership Threshold and therefore have voting power that provides effective control of our company.

Current wording

In addition, in the future we could create a new class of equity securities with different economic or voting rights than existing classes. If we were to create a new class of equity security, because of the broad definition of “Corporation Equity Securities,” such security could qualify as Corporation Equity Securities and therefore count towards the Ownership Threshold if held by our Founders who are then party to the Founder Voting Agreement or certain of their affiliates. If such security has lesser or no economic rights, it could have the effect of further increasing the divergence between the economic interests of our Founders who are then party to the Founder Voting Agreement and their affiliates, on the one hand, and the voting power of such Founders and their affiliates, on the other. Further, Corporation Equity Securities includes, among other things, any warrants, calls, options, or other right, whether vested or unvested, to acquire from the Company certain voting or equity securities. Accordingly, the Board of Directors could issue additional equity securities, or additional options, RSUs, warrants or other rights to acquire equity securities (whether vested or unvested), to our Founders or certain of their affiliates, which would increase the number of Corporation Equity Securities they hold and enable them to meet the Ownership Threshold notwithstanding sales of Corporation Equity Securities that they currently hold. As a result, any Founders who are then party to the Founder Voting Agreement or certain of their affiliates could hold a nominal equity interest with little to no voting rights but meet the Ownership Threshold and therefore have voting power that provides effective control of our company.