OOMA INC

Previous wording

We have and will continue to incorporate both internally developed and third-party AI solutions into our products and services, including call transcription, call answering, and receptionist services. We are also increasingly using third-party AI technologies internally in our business. AI technologies are complex and rapidly evolving, and the successful integration of new and emerging AI technologies, such as generative AI, automated speech recognition, text-to-speech and natural language processing into our products and services will require additional investment, and the development of new approaches and processes, which could be costly and may increase our expenses, yet we may not realize the desired or anticipated benefits from AI in a timely or cost-effective manner.

Current wording

We have and will continue to incorporate both internally developed and third-party AI solutions into our products and services, including call transcription, call answering, and receptionist services. We are also increasingly using third-party AI technologies internally in our business. AI technologies are complex and rapidly evolving, and the successful integration of new and emerging AI technologies, such as generative AI, automated speech recognition, text-to-speech, natural language processing, and AI agents into our products and services will require additional investment, and the development of new approaches and processes, which could be costly and may increase our expenses, yet we may not realize the desired or anticipated benefits from AI in a timely or cost-effective manner.

Previous wording

Use of AI tools by us or our third-party vendors could also result in unintended consequences. For example, AI algorithms that we and our third-party vendors use may be flawed or may be based on datasets that are biased or insufficient. Inaccuracies from relying on AI tools could lead to errors in our decision-making, product development, or other business activities. Any disruption or failure in our or our third-party vendors’ AI systems or infrastructure could result in delays or errors in our operations, which could harm our business, reputation, financial condition and results of operation. In addition, any latency, disruption, or failure in AI tools or infrastructure incorporated into our business could result in security vulnerabilities, delays, or errors in our offerings. Further, the incorporation of AI-powered features into our products and services may subject us to new or enhanced governmental or regulatory scrutiny, data privacy and information security laws, litigation, including class-action suits, confidentiality or security risks, ethical concerns, or other complications that could harm our business, reputation, financial condition or results of operations.

Current wording

Use of AI tools by us or our third-party vendors could also result in unintended consequences. For example, AI algorithms, generative AI, automated speech recognition, text-to-speech, natural language processing, and AI agents that we and our third-party vendors use may be flawed or may be based on datasets that are biased or insufficient. Such AI tools may also fail to perform as intended, or may operate in ways that are inconsistent with our policies, customer expectations, contractual commitments, or legal obligations. Inaccuracies from relying on AI tools could lead to errors in our decision-making, product development, or other business activities. Any disruption or failure in our or our third-party vendors’ AI systems or infrastructure could result in delays or errors in our operations, which could harm our business, reputation, financial condition and results of operation. In addition, any latency, disruption, or failure in AI tools or infrastructure incorporated into our business could result in security vulnerabilities, delays, or errors in our offerings. Our use of third-party AI tools may expose confidential, proprietary, personal, or customer information if not properly governed. Further, the incorporation of AI-powered features into our products and services may subject us to new or enhanced governmental or regulatory scrutiny, data privacy and information security laws, litigation, including class-action suits, confidentiality or security risks, ethical concerns, or other complications that could harm our business, reputation, financial condition or results of operations.

Previous wording

Trade restrictions, including tariffs, quotas, embargoes, safeguards and customs restrictions, and uncertainty related to such restrictions, could increase the cost or reduce the supply of products available to us, or have in the past and could in the future increase the lead times of certain components and equipment that we may purchase from foreign vendors. These events have in the past and may in the future require us to modify our supply chain organization or other current business practices, any of which could harm our business, financial condition and results of operations. For example, the current U.S. administration announced tariffs on goods imported from various countries, including from China and Vietnam where we source some of our products and components, under the IEEPA. In February 2026, the U.S. Supreme Court issued a ruling striking down certain tariffs previously imposed under IEEPA. The Supreme Court only ruled on IEEPA tariffs and did not invalidate any other tariffs, nor did the court address whether or how the U.S. government might issue refunds of IEEPA tariffs. If the U.S. government is ultimately required to issue refunds, the process likely will take many months or years. Following the Supreme Court's decision, the U.S. presidential administration announced its intention to invoke other laws to collect tariffs and announced new tariffs on imports from all countries, in addition to any existing non-IEEPA tariffs. There remains substantial uncertainty regarding the duration of existing and newly announced tariffs, potential changes or pauses to such tariffs, tariff levels, and whether further additional tariffs or other retaliatory actions may be imposed, modified, or suspended. The ultimate impact on us of any tariffs imposed remains uncertain and will depend on several factors, including whether additional or incremental U.S. tariffs or other measures are announced or imposed, to what extent other countries implement tariffs or other retaliatory measures in response, and the overall magnitude and duration of these measures. If disputes and conflicts further escalate, actions by governments in response could be significantly more severe and restrictive. Any of the foregoing may require us to raise our prices or increase inventory levels, or find new sources of system assembly or other products that we import, any of which could negatively impact our revenue, gross margins, and results of operations may be materially harmed.

Current wording

Trade restrictions, including tariffs, quotas, embargoes, safeguards and customs restrictions, and uncertainty related to such restrictions, could increase the cost or reduce the supply of products available to us, or have in the past and could in the future increase the lead times of certain components and equipment that we may purchase from foreign vendors. These events have in the past and may in the future require us to modify our supply chain organization or other current business practices, any of which could harm our business, financial condition and results of operations. For example, the current U.S. administration announced tariffs on goods imported from various countries, including from China and Vietnam where we source some of our products and components, under the International Emergency Economic Powers Act (IEEPA). In February 2026, the U.S. Supreme Court issued a ruling striking down certain tariffs previously imposed under IEEPA. Following the Supreme Court's decision, the U.S. administration imposed new tariffs under Section 301 of the Trade Act of 1974, which apply at differing rates depending on the country of origin, including with respect to any goods we may import from China, Taiwan, Vietnam, or other listed countries. The U.S. administration has also initiated additional investigations that could result in further tariffs on imports of electronics and other products, including from countries where we source products and components. There remains substantial uncertainty regarding the duration of existing and newly announced tariffs, potential changes or pauses to such tariffs, tariff levels, and whether further additional tariffs or other retaliatory actions may be imposed, modified, or suspended. For example, in August 2026, following the imposition of additional U.S. tariffs on Canadian goods, the Canadian government announced that it intends to impose retaliatory tariffs on certain U.S. goods, including electronics, effective in September 2026. Depending on the final scope of these measures, our products could become subject to additional duties on entry into Canada, which could increase prices to our Canadian customers and channel partners, reduce demand, cause us to absorb additional costs, or require us to establish alternative distribution or importation arrangements outside the United States. The ultimate impact on us of any tariffs imposed remains uncertain and will depend on several factors, including whether additional or incremental U.S. tariffs or other measures are announced or imposed, to what extent other countries implement tariffs or other retaliatory measures in response, and the overall magnitude and duration of these measures. If disputes and conflicts further escalate, actions by governments in response could be significantly more severe and restrictive. Any of the foregoing may require us to raise our prices or increase inventory levels, or find new sources of system assembly or other products that we …

Excerpt shortened here; the source contains the full paragraph.

Previous wording

In past periods, we have increased our inventory levels to mitigate supply disruptions caused by component shortages, longer lead times and increased transportation uncertainty. Additionally, we experienced higher unit costs for some products that have been impacted by supply chain constraints, certain components being subject to end-of-life, and inflationary pressure, such as the increase in pricing of the memory chips due to the surge in AI. We are increasing and may continue to increase inventory levels due to certain components becoming subject to end-of-life as well as uncertainty related to restrictions on goods imported into the United States or to otherwise mitigate related supply chain risks and uncertainties, such as the FCC’s recent update to the “Covered List” of communications equipment deemed to pose an unacceptable risk to U.S. national security to include all consumer-grade routers produced in foreign countries. Increased inventory levels have in the past and may in the future result in write-down charges from excess or obsolete inventory if demand shifts or products become non-viable, charges from excess purchase commitments, the sale of inventory at discounted prices, and other actions, which may cause our gross margin to decline and harm our reputation and brand.

Current wording

In past periods, we have increased our inventory levels to mitigate supply disruptions caused by component shortages, longer lead times and increased transportation uncertainty. Additionally, we experienced higher unit costs for some products that have been impacted by supply chain constraints, certain components being subject to end-of-life, and inflationary pressures, such as those resulting from increased pricing of memory and other components due to surging demand for such components to support AI infrastructure and product orders. We are increasing and may continue to increase inventory levels due to shortages in the electronic components industry due to the rise in AI demand, certain components becoming subject to end-of-life, and uncertainty related to restrictions on goods imported into the United States or to otherwise mitigate related supply chain risks and uncertainties, such as the FCC’s recent update to the “Covered List” of communications equipment deemed to pose an unacceptable risk to U.S. national security to include all consumer-grade routers produced in foreign countries. Increased inventory levels have in the past and may in the future result in write-down charges from excess or obsolete inventory if demand shifts or products become non-viable, charges from excess purchase commitments, the sale of inventory at discounted prices, and other actions, which may cause our gross margin to decline and harm our reputation and brand.

Previous wording

The cloud-based communications and connected services industries are highly competitive and we expect that competition will continue to be intense in the future. Increased competition may result in pricing pressures, reduced profit margins and may impede our ability to continue to increase the sales of our services and products or cause us to lose market share, any of which could substantially harm our business and results of operations. We face continued competition from established communications providers, such as Comcast Corporation, Verizon Communications Inc., AT&T Inc., Charter Communications Inc. and Rogers Communications Inc.; as well as from traditional on-premise, hardware business communications providers, mobile communications app companies providing “over-the-top” solutions, large internet companies that offer services with features that compete with some of what we offer, and certain other communications companies. These companies currently or may in the future host their solutions through the cloud.

Current wording

The cloud-based communications and connected services industries are highly competitive and we expect that competition will continue to be intense in the future. Increased competition may result in pricing pressures, reduced profit margins and may impede our ability to continue to increase the sales of our services and products or cause us to lose market share, any of which could substantially harm our business and results of operations. We face continued competition from established communications providers, such as Comcast Corporation, Verizon Communications Inc., AT&T Inc., and Rogers Communications Inc and other cloud-based communications companies such as RingCentral Inc., Vonage Holdings Corp. (acquired by Ericsson), 8x8 Inc., Nextiva, Inc., Intermedia.net Inc., Dialpad Inc., Microsoft Corporation, Zoom Video Communications, Inc., Alphabet Inc. (Google Voice), Crexendo, Inc. and Alianza, Inc.; as well as from traditional on-premise, hardware business communications providers, such as Cisco Systems, Inc. and Mitel, Inc., mobile communications app companies providing “over-the-top” solutions, large internet companies that offer services with features that compete with some of what we offer, and certain other communications companies. These companies currently or may in the future host their solutions through the cloud.

Previous wording

The market for our CPaaS and CCaaS 2600Hz solutions is rapidly evolving, significantly fragmented and highly competitive, with relatively low barriers to entry in some segments. Our competitors in this segment of the market are primarily (i) CPaaS companies that offer communications products and applications, and (ii) other software companies that compete with portions of these and CCaaS solutions. Some of our competitors and potential competitors in this segment are larger and have greater name recognition, longer operating histories, more established customer relationships, larger budgets, lower operating costs, and significantly greater resources than we do. As a result, our competitors may be able to respond more quickly and effectively than we can to new or changing opportunities, technologies, standards, customer requirements or changing economic conditions. Our competitors may also offer products or services that address one or a limited number of functions at lower prices, with greater depth than our products or in different geographies. Our current and potential competitors may develop and market new products and services with comparable functionality to our products, and this could lead to us having to decrease prices in order to remain competitive. Additionally, in connection with our AirDial product offering, we face competition in the POTS replacement market from a range of other companies, such as Verizon Communications Inc., Granite Telecommunications LLC, MetTel Inc., AT&T Inc. and Napco Security Technologies, Inc., as well as other service providers that bundle their offerings with POTS-related products from POTS replacement equipment manufacturers, such as DataRemote Inc.

Current wording

The market for our CPaaS and CCaaS 2600Hz solutions is rapidly evolving, significantly fragmented and highly competitive, with relatively low barriers to entry in some segments. Our competitors in this segment of the market are primarily (i) CPaaS companies that offer communications products and applications, such as Twilio Inc., Vonage Holdings Corp. (acquired by Ericsson), Plivo Inc., and Sinch Inc., and (ii) other software companies that compete with portions of these and CCaaS solutions such as RingCentral Inc., 8x8 Inc., Dialpad Inc., Five9 Inc., and NICE Systems Ltd. Some of our competitors and potential competitors in this segment are larger and have greater name recognition, longer operating histories, more established customer relationships, larger budgets, lower operating costs, and significantly greater resources than we do. As a result, our competitors may be able to respond more quickly and effectively than we can to new or changing opportunities, technologies, standards, customer requirements or changing economic conditions. Our competitors may also offer products or services that address one or a limited number of functions at lower prices, with greater depth than our products or in different geographies. Our current and potential competitors may develop and market new products and services with comparable functionality to our products, and this could lead to us having to decrease prices in order to remain competitive. Additionally, in connection with our AirDial product offering, we face competition in the POTS replacement market from a range of other companies, such as Verizon Communications Inc., Granite Telecommunications

Previous wording

Any one of the factors above, or the cumulative effect of some or all of the factors referred to above, may result in significant fluctuations in our quarterly and annual results of operations and cash flows. This variability and unpredictability could result in our failure to meet our internal operating plan or the expectations of securities analysts or investors for any period, which could cause our stock price to decline. In addition, a significant percentage of our operating expenses is fixed in nature and is based on forecasted revenue trends. Accordingly, in the event of revenue shortfalls, we may not be able to mitigate the negative impact on net (loss) income and margins in the short term. If we fail to meet or exceed the expectations of securities analysts or investors, the market price of our shares could fall substantially and we could face costly lawsuits, including securities class-action suits.

Current wording

Any one of the factors above, or the cumulative effect of some or all of the factors referred to above, may result in significant fluctuations in our quarterly and annual results of operations and cash flows. This variability and unpredictability could result in our failure to meet our internal operating plan or the expectations of securities analysts or investors for any period, which could cause our stock price to decline. In addition, a significant percentage of our operating expenses is fixed in nature and is based on forecasted revenue trends. Accordingly, in the event of revenue shortfalls, we may not be able to mitigate the negative impact on net income and margins in the short term. If we fail to meet or exceed the expectations of securities analysts or investors, the market price of our shares could fall substantially and we could face costly lawsuits, including securities class-action suits.

Previous wording

We must comply with certain federal, state and local requirements regarding our products and services, including marketing practices, consumer protection, privacy, and the provision of 9-1-1 emergency service. New and evolving legislative or regulatory actions could adversely affect our business and expose us to liability. For example, on March 23, 2026, the FCC updated the “Covered List” of communications equipment deemed to pose an unacceptable risk to U.S. national security to include all consumer-grade routers produced in foreign countries, effectively prohibiting the importation, marketing, or sale in the United States of such routers. Although previously authorized routers may continue to be imported and sold in the United States, modifications to such routers, including firmware and software updates, often require additional FCC authorization. While the FCC has provided a waiver permitting previously authorized routers to continue receiving software and firmware updates at least until March 1, 2027, thereafter we may be prevented from making updates or modifications to our products, such as Ooma Telo and Ooma Telo Air. An inability to deliver updates could adversely affect device functionality, interoperability, product quality, and security, and could lead to increased customer dissatisfaction, higher support and warranty costs, increased return rates, and reputational harm. These restrictions may also inhibit our ability to introduce new or upgraded consumer products on our desired timeline and we may be required to: (i) delay, redesign, or discontinue certain offerings; (ii) shift manufacturing, assembly, or development activities to the United States or other approved pathways at higher cost; (iii) maintain older product models longer than planned, potentially reducing competitiveness; (iv) carry higher inventory levels or incur write-downs if demand shifts or products become non-viable; and/or (v) devote significant management attention and resources to engineering changes, testing, certification, and vendor transitions. Any of these outcomes could adversely affect our revenue, gross margins, and cash flows. Further, any changes that broaden the definition of covered devices, limit waivers or transition periods, or otherwise extend restrictions to additional categories of equipment could further increase our compliance costs and operational risks.

Current wording

We must comply with certain federal, state and local requirements regarding our products and services, including marketing practices, consumer protection, privacy, and the provision of 9-1-1 emergency service. New and evolving legislative or regulatory actions could adversely affect our business and expose us to liability. For example, on March 23, 2026, the FCC updated the “Covered List” of communications equipment deemed to pose an unacceptable risk to U.S. national security to include all consumer-grade routers produced in foreign countries, effectively prohibiting the importation, marketing, or sale in the United States of such routers.

Previous wording

The failure of our products and services to comply, or delays in compliance, with various existing and evolving standards could delay or interrupt volume production of our VoIP telephony products, subject us to fines or other imposed penalties, or harm the perception and adoption rates of our service, any of which would have a material adverse effect on our business, financial condition or operating results.

Current wording

While we believe that our current product offerings are not considered consumer-grade routers under the FCC’s guidance updated on April 22, 2026, this effective ban may in the future limit the type of products we can develop, limit manufacturing locations, or increase the costs of offering such products. The failure of our products and services to comply, or delays in compliance, with various existing and evolving standards could delay or interrupt volume production of our VoIP telephony products, subject us to fines or other imposed penalties, or harm the perception and adoption rates of our service, any of which would have a material adverse effect on our business, financial condition or operating results.

Previous wording

We rely on a variety of marketing techniques in connection with our sales efforts, including telemarketing and email marketing campaigns. We also record certain telephone calls between our customers or potential customers and our sales and service representatives for training and quality assurance purposes. These activities are subject to a variety of federal U.S. and Canadian laws and regulations such as the Telephone Consumer Protection Act of 1991 (also known as the Federal Do-Not-Call law, or the TCPA), the Telemarketing Sales Rule, the CRTC’s Unsolicited Telecommunications Rules, the CRTC’s National Do Not Call List Rules, the Controlling the Assault of Non-Solicited Pornography and Marketing Act of 2003 (also known as the CAN-SPAM Act), and various U.S. state and Canadian provincial laws regarding telemarketing, email marketing, social media marketing, and telephone call recording. The FCC continues to adopt and consider additional rules related to robocalling, robotexting, and autodialing. For example, in December 2023, the FCC adopted a one-to-one consent rule requiring companies to obtain consent from consumers to receive automated or robotic calls or texts only from one specific good or service provider at a time. These laws are subject to varying interpretations by courts and governmental authorities and often require subjective interpretation, making it difficult to predict their application and therefore making our compliance efforts more challenging. For example, on January 24, 2025, the FCC postponed the one-to-one consent requirements until January 26, 2026, due to challenges to the new rule in the United States Court of Appeals for the Eleventh Circuit, and the court ultimately vacated the rule. We cannot be certain our efforts to comply with these laws, rules and regulations will be successful, or, if they are successful, that the cost of such compliance will not be material to our business. Changes to these or similar laws, or to their application or interpretation, or new laws, rules and regulations governing our communication and marketing activities could adversely affect our business. In the event that any of these laws, rules or regulations significantly restrict our business, we may not be able to develop adequate alternative communication and marketing strategies. Further, non-compliance with these laws, rules and regulations carries significant financial penalties and the risk of class action litigation. For example, in September 2025 we were named as a defendant in a putative class action complaint in the U.S. District Court for the Northern District of California, alleging violations of the TCPA, which was dismissed with prejudice in February 2026. If we are unable to successfully defend future putative class actions, our financial performance, reputation and business could be adversely affected.

Current wording

We rely on a variety of marketing techniques in connection with our sales efforts, including telemarketing and email marketing campaigns. We also record certain telephone calls between our customers or potential customers and our sales and service representatives for training and quality assurance purposes. These activities are subject to a variety of federal U.S. and Canadian laws and regulations such as the Telephone Consumer Protection Act of 1991 (also known as the Federal Do-Not-Call law, or the TCPA), the Telemarketing Sales Rule, the CRTC’s Unsolicited Telecommunications Rules, the CRTC’s National Do Not Call List Rules, the Controlling the Assault of Non-Solicited Pornography and Marketing Act of 2003 (also known as the CAN-SPAM Act), and various U.S. state and Canadian provincial laws regarding telemarketing, email marketing, social media marketing, and telephone call recording. The FCC continues to adopt and consider additional rules related to robocalling, robotexting, and autodialing. For example, in December 2023, the FCC adopted a one-to-one consent rule that would have required companies to obtain consent from consumers to receive automated or robotic calls or texts only from one specific good or service provider at a time. These laws are subject to varying interpretations by courts and governmental authorities and often require subjective interpretation, making it difficult to predict their application and therefore making our compliance efforts more challenging. For example,the Eleventh Circuit vacated the one-to-one consent rule in January 2025 and the FCC subsequently removed the rule from the TCPA.

Previous wording

In the United States and in other jurisdictions, a variety of regulations are currently being proposed that would increase restrictions on online service providers in the field of data privacy and security, and we believe that the adoption of such increasingly restrictive regulation is likely. For example, the California Consumer Privacy Act (the “CCPA”) regulates the processing of personal data, which could result in civil penalties for violations. In addition, the California Privacy Rights Act (“CPRA”) took effect on January 1, 2023 and many states are now adopting similar privacy laws. We will continue to monitor developments related to new privacy laws like the CPRA which will require us to incur additional costs and expenses in an effort to monitor and comply with such laws. Legislators and regulators in the United States and elsewhere are also increasingly focused on privacy protections for minors under 18 years of age. For example, the Children’s Online Privacy Protection Act (“COPPA”) applies to operators of commercial websites and online services directed to children under the age of 13 that collect personal information from children, and to operators of general audience websites with actual knowledge that they are collecting information from children under the age of 13. Our MyPhone TM VoIP services are directed at parents of children and include features such as green listing, quiet hours, and advanced call blocking to enhance children’s safety and privacy. Although we strive to ensure this will be compliant with applicable COPPA and other children’s privacy laws, any noncompliance could subject us to governmental enforcement actions, litigation, fines and penalties or adverse publicity, and we could be in breach of our customer contracts and our customers could lose trust in us, which could harm our reputation and business. Additionally, proposed legislation may impose new obligations on online services which may be accessed by older teens, including, in some cases, 16- and 17-year-old children.

Current wording

In the United States and in other jurisdictions, a variety of regulations are currently being proposed that would increase restrictions on online service providers in the field of data privacy and security, and we believe that the adoption of such increasingly restrictive regulation is likely. For example, the California Consumer Privacy Act (the “CCPA”) regulates the processing of personal data, which could result in civil penalties for violations. In addition, the California Privacy Rights Act (“CPRA”) took effect on January 1, 2023 and many states are now adopting similar privacy laws. We will continue to monitor developments related to new privacy laws like the CPRA which will require us to incur additional costs and expenses in an effort to monitor and comply with such laws. Legislators and regulators in the United States and elsewhere are also increasingly focused on privacy protections for minors under 18 years of age. For example, the Children’s Online Privacy Protection Act (“COPPA”) applies to operators of commercial websites and online services directed to children under the age of 13 that collect personal information from children, and to operators of general audience websites with actual knowledge that they are collecting information from children under the age of 13. Our MyPhone TM VoIP services are directed at parents of children and include features such as green listing, quiet hours, and advanced call blocking to enhance children’s safety and privacy. Although we strive to ensure this will be compliant with applicable COPPA and other children’s privacy laws, any noncompliance could subject us to governmental enforcement actions, litigation, fines and penalties or adverse publicity, and we could be in breach of our customer contracts and our customers could lose trust in us, which could harm our reputation and business. Additionally, state laws and regulatory initiatives increasingly address online services, connected products, and digital features that are likely to be accessed by minors under the age of 18. Depending on how these laws are interpreted and applied, services such as MyPhone or related settings, parental controls, and privacy disclosures, among others, may become subject to additional obligations. Compliance with these requirements may require product, engineering, marketing, legal, and operational changes, may limit features or data processing practices, and may increase litigation, regulatory, reputational, and customer trust risks, particularly because laws directed to children and teens may be interpreted differently from COPPA and may apply even where a product is directed primarily to parents.

Previous wording

The EU has implemented strict laws that apply in connection with the Processing of personal information, and other customer data. Data protection regulators within the EU and other jurisdictions have the power to fine non-compliant organizations significant amounts and seek injunctive relief, including the cessation of certain data processing activities. For example, the EU’s General Data Protection Regulation, or GDPR, provides for significant penalties for violations, including fines of up to 4% of the violating company’s worldwide revenue. While the United Kingdom’s Data Protection Act substantially implements the GDPR, the United Kingdom’s exit from the European Union has created regulatory uncertainty, including the cross-border transfer of data. Such uncertainty may adversely impact the operations of our U.K. subsidiary by adding operational complexities and expenses. In addition, there is uncertainty about data transfer to the United States. For example, although the new U.S. Data Privacy Framework was formally approved by the European Commission in July 2023, the framework may still be invalidated by the Court of Justice of the European Union, which invalidated the framework's predecessor, the Privacy Shield Program, in 2020.

Current wording

The EU has implemented strict laws that apply in connection with the Processing of personal information, and other customer data. Data protection regulators within the EU and other jurisdictions have the power to fine non-compliant organizations significant amounts and seek injunctive relief, including the cessation of certain data processing activities. For example, the EU Data Act became effective in September 2025 and imposes additional obligations on companies offering connected products, related digital services, or data-processing services in the EU, including requirements relating to user access to data generated by connected products, data sharing, contractual terms, interoperability, and switching between data-processing or cloud services. As such, we may need to modify customer contracts, product designs, data-export capabilities, data-sharing processes, and vendor or reseller arrangements. These changes could increase compliance and engineering costs, create operational complexity, limit our ability to use certain data, increase customer or third-party disputes, or affect our competitive position in the EU. In addition, the EU’s General Data Protection Regulation, or GDPR, provides for significant penalties for violations, including fines of up to 4% of the violating company’s worldwide revenue. While the United Kingdom’s Data Protection Act substantially implements the GDPR, the United Kingdom’s exit from the European Union has created regulatory uncertainty, including the cross-border transfer of data. Such uncertainty may adversely impact the operations of our U.K. subsidiary by adding operational complexities and expenses. In addition, there is uncertainty about data transfer to the United States. For example, although the new U.S. Data Privacy Framework was formally approved by the European Commission in July 2023, the framework may still be invalidated by the Court of Justice of the European Union, which invalidated the framework's predecessor, the Privacy Shield Program, in 2020.

Previous wording

Our international operations are subject to U.S. tax laws, including limitations on the ability to defer U.S. taxation on earnings outside of the United States until those earnings are repatriated to the United States, which could affect the tax treatment of our foreign earnings. Any changes in our effective tax rate could adversely affect our results of operations.

Current wording

Our international operations are subject to U.S. tax laws, including limitations on the ability to defer U.S. taxation on earnings outside of the United States until those earnings are repatriated to the United States, which could affect the tax treatment of our foreign earnings. Any changes in our effective tax rate could adversely affect our results of operations. In addition, from time to time our income tax returns may be examined by the Internal Revenue Service and other tax authorities. We assess the likelihood of adverse outcomes resulting from any such examinations when and as appropriate to determine the adequacy of our provision for income taxes. There can be no assurance that the outcomes from any such examinations will not have an adverse effect on our results of operations and financial condition.

Previous wording

As of January 31, 2026, we had federal net operating loss carryforwards of approximately $81.4 million available to offset future income, of which $79.4 million may be carried forward indefinitely. We also had state net operating loss carryforwards of $96.9 million which will expire in various amounts beginning in fiscal 2029. Additionally, we have federal and research and development tax credit carryforwards that will begin to expire in fiscal 2030 and California research and development tax credit carryforwards with no expiration date. Realization of these net operating loss and research tax credit carryforwards depends on future income, and there is a risk that our existing carryforwards could expire unused and be unavailable to offset future income tax liabilities, which could materially and adversely affect our results of operations. No deferred tax assets have been recognized on our balance sheet related to these NOLs, as they are fully reserved by a valuation allowance. If we have previously had, or have in the future, one or more Section 382 “ownership changes”, or if we do not generate sufficient taxable income, we may not be able to utilize a material portion of our NOLs, even if we achieve profitability. If we are limited in our ability to use our NOLs in future years in which we have taxable income, we will pay more taxes than if we were able to fully utilize our NOLs. This could materially and adversely affect our results of operations.

Current wording

As of January 31, 2026, we had federal net operating loss carryforwards of approximately $81.4 million available to offset future income, of which $79.4 million may be carried forward indefinitely. We also had state net operating loss carryforwards of $96.9 million which will expire in various amounts beginning in fiscal 2029. Additionally, we have federal and research and development tax credit carryforwards that will begin to expire in fiscal 2030 and California research and development tax credit carryforwards with no expiration date. Realization of these net operating loss and research tax credit carryforwards depends on future income, and there is a risk that our existing carryforwards could expire unused and be unavailable to offset future income tax liabilities, which could materially and adversely affect our results of operations. No deferred tax assets have been recognized on our balance sheet related to these NOLs, as they are fully reserved by a valuation allowance. If we have previously had, or have in the future, one or more Section 382 “ownership changes”, or if we do not generate sufficient taxable income, we may not be able to utilize a material portion of our NOLs, even if we sustain profitability. If we are limited in our ability to use our NOLs in future years in which we have taxable income, we will pay more taxes than if we were able to fully utilize our NOLs. This could materially and adversely affect our results of operations.

Previous wording

The Company, its directors, and certain officers were named as defendants in a consolidated securities class action in connection with its initial public offering, and in October 2019, the Court dismissed the lawsuit with prejudice. In addition, in February 2021 the Company and Ooma Canada Inc. were named as defendants in a class action complaint in the Federal Court of Canada, alleging violations of Canada’s Trademarks Act and Competition Act, and in September 2025, the Company was named as a defendant in a putative class action complaint in the U.S. District Court for the Northern District of California, alleging violations of the TCPA, which was dismissed with prejudice in February 2026. In the future, especially following periods of volatility in the market price of our shares, additional purported class action or derivative complaints may be filed against us. The outcome of any pending and potential future litigation is difficult to predict and quantify and the defense of such claims or actions can be costly. In addition to diverting financial and management resources and general business disruption, we may suffer from adverse publicity that could harm our brand or reputation, regardless of whether the allegations are valid or whether we are ultimately held liable. A judgment or settlement that is not covered by or is significantly in excess of our insurance coverage for any claims, or our obligations to indemnify the underwriters and the individual defendants, could materially and adversely affect our financial condition, results of operations and cash flows.

Current wording

The Company, its directors, and certain officers were named as defendants in a consolidated securities class action in connection with its initial public offering, and in October 2019, the Court dismissed the lawsuit with prejudice. In addition, in February 2021 the Company and Ooma Canada Inc. were named as defendants in a class action complaint in the Federal Court of Canada, alleging violations of Canada’s Trademarks Act and Competition Act. In the future, especially following periods of volatility in the market price of our shares, additional purported class action or derivative complaints may be filed against us. The outcome of any pending and potential future litigation is difficult to predict and quantify and the defense of such claims or actions can be costly. In addition to diverting financial and management resources and general business disruption, we may suffer from adverse publicity that could harm our brand or reputation, regardless of whether the allegations are valid or whether we are ultimately held liable. A judgment or settlement that is not covered by or is significantly in excess of our insurance coverage for any claims, or our obligations to indemnify the underwriters and the individual defendants, could materially and adversely affect our financial condition, results of operations and cash flows.