Workday Inc

Previous wording

The use of new and evolving technologies in our offerings at Workday, including AI, may result in reputational harm and increased litigation.

Current wording

The use of new and evolving technologies in our offerings at Workday, including AI, may result in reputational harm and increased litigation, and adversely affect our operating results.

Previous wording

We are increasingly building AI into Workday’s core and specific offerings. As with many cutting-edge innovations, these technologies can present new risks and challenges. A quickly evolving legal and regulatory environment may cause us to incur increased research and development costs, or divert resources from other development efforts, to address social, ethical, and other issues related to AI. Furthermore, existing laws and regulations may apply to us in new ways, the nature and extent of which are difficult to predict and subject to change over time. The risks and challenges presented by these technologies could undermine public confidence in AI, which could slow its adoption and affect our business. Many of our products are powered by AI, some of which include the use of large language models and generative AI, for use cases that could potentially impact human, civil, privacy, or employment rights and dignities. Our developers are also experimenting with the use of large language models provided by third parties for domain-specific use cases, and at this stage the line between developers and deployers of these technologies, including their respective responsibilities and liabilities, is unclear. Our failure to accurately identify and address our responsibilities and liabilities in this uncertain environment, and adequately address relevant ethical and social issues that may arise with such technologies and use cases, as well as failure by others in our industry, or actions taken by our customers, employees, or end users (including misuse of these technologies), could negatively affect the adoption of our solutions and subject us to reputational harm, regulatory action, or litigation, which may harm our financial condition and operating results. We already are defending against a lawsuit alleging that our products and services enable discrimination, and although we believe that such claims lack merit, and we succeeded in our initial motion to dismiss the claims, legal proceedings can be lengthy, expensive, and disruptive to our operations (particularly where, as in the present litigation, Plaintiff may seek to also litigate against certain of Workday’s customers). We may be subject to other litigation and regulatory actions that may cause financial, competitive, and developmental impacts, and could lead to legal liability. In addition, regardless of outcome, these types of claims could cause reputational harm to our brand. Our employees, customers, or customers’ employees who are dissatisfied with our public statements, policies, practices, or solutions related to the development and use of AI may express opinions that could introduce reputational or business harm, or cease their relationship with us.

Current wording

We are increasingly building AI into Workday’s core and specific offerings. As with many cutting-edge innovations, these technologies can present new risks and challenges. A quickly evolving legal and regulatory environment may cause us to incur increased research and development costs, or divert resources from other development efforts, to address ethical, legal, or compliance requirements or other issues related to AI. For example, the European Union’s AI Act puts new requirements on providers of AI technologies that will need to be addressed in alignment with various deadlines in the coming years. Additionally, existing laws and regulations may apply to us in new ways, the nature and extent of which are difficult to predict and subject to change over time. The risks and challenges presented by these technologies could undermine public confidence in AI, which could slow its adoption and affect our business. Many of our products are powered by AI, some of which include the use of large language models and generative AI, for use cases that could potentially impact human, civil, privacy, or employment rights and dignities. Our developers are also experimenting with the use of large language models provided by third parties for domain-specific use cases, and at this stage the line between developers and deployers of these technologies, including their respective responsibilities and liabilities, remains largely unclear. Our failure to accurately identify and address our responsibilities and liabilities in this uncertain environment, and adequately address relevant ethical and social issues that may arise with such technologies and use cases, as well as failure by others in our industry, or actions taken by our customers, employees, or end users (including misuse of these technologies), could negatively affect the adoption of our solutions and subject us to reputational harm, regulatory action, or litigation, which may harm our financial condition and operating results. We already are defending against a lawsuit alleging that our products and services enable discrimination, and although we believe that such claims lack merit, and the majority of the claims have been dismissed, legal proceedings can be lengthy, expensive, and disruptive to our operations and customers (particularly where, as in the present litigation, the plaintiff may seek to also litigate against certain of Workday’s customers). We may be subject to other litigation and regulatory actions that may cause financial, competitive, and developmental impacts, and could lead to legal liability. In addition, regardless of outcome, these types of claims could cause reputational harm to our brand, including our ability to sell newly acquired products that use AI. Our employees, customers, or customers’ employees who are dissatisfied with our public statements, policies, practices, or solutions related to the development and use of AI may express opinions that could introduce reputational or …

Excerpt shortened here; the source contains the full paragraph.

Previous wording

We believe that developing and maintaining widespread positive awareness of our brand is critical to our growth. However, brand promotion activities may not generate the customer awareness or increased revenues we anticipate, and even if they do, any increase in revenues may not offset the significant expenses we incur in building our brand.

Current wording

We believe that developing and maintaining widespread positive awareness of our brand is critical to our growth. However, brand promotion activities may not generate the awareness or increased revenues we anticipate, and even if they do, any increase in revenues may not offset the significant expenses we incur in building our brand.

Previous wording

Our corporate headquarters are located in Pleasanton, California, and we have data centers located in the United States, Canada, and Europe. The west coast of the United States contains active earthquake zones and the southeast is subject to seasonal hurricanes or other extreme weather conditions. Additionally, we rely on internal technology systems, our website, our network, and third-party infrastructure and enterprise applications, which are located in a wide variety of regions, for our development, marketing, operational support, hosted services, and sales activities. In the event of a major earthquake, hurricane, or other natural disaster, or a catastrophic event such as fire, power loss, telecommunications failure, vandalism, civil unrest, cyber-attack, geopolitical instability, war, terrorist attack, insurrection, pandemics or other public health emergencies, or the effects of climate change (such as drought, flooding, heat waves, wildfires, increased storm severity, and sea level rise), we may be unable to continue our operations and have, and may in the future, endure system interruptions, and may experience delays in our product development, lengthy interruptions in our services, breaches of data security, and loss of critical data, all of which could cause reputational harm or otherwise have an adverse effect on our business and operating results. In addition, the impacts of climate change on the global economy and our industry are rapidly evolving. We may be subject to increased regulations, reporting requirements, standards, or stakeholder expectations regarding climate change that may impact our business, financial condition, and operating results.

Current wording

Our corporate headquarters are located in Pleasanton, California, and we have data centers located in North America and Europe. The west coast of the United States contains active earthquake zones and the southeast is subject to seasonal hurricanes or other extreme weather conditions. Additionally, we rely on internal technology systems, our website, our network, and third-party infrastructure and enterprise applications, which are located in a wide variety of regions, for our development, marketing, operational support, hosted services, and sales activities. In the event of a major earthquake, hurricane, or other natural disaster, or a catastrophic event such as fire, power loss, telecommunications failure, vandalism, civil unrest, cyber-attack, geopolitical instability, war, terrorist attack, insurrection, pandemics or other public health emergencies, or the effects of climate change (such as drought, flooding, heat waves, wildfires, increased storm severity, and sea level rise), we may be unable to continue our operations and have, and may in the future, endure system interruptions, and may experience delays in our product development, lengthy interruptions in our services, breaches of data security, and loss of critical data, all of which could cause reputational harm or otherwise have an adverse effect on our business and operating results. In addition, the impacts of climate change on the global economy and our industry are rapidly evolving. We may be subject to increased regulations, reporting requirements, standards, or stakeholder expectations regarding climate change that may impact our business, financial condition, and operating results.

Previous wording

Our applications involve the storage and transmission of our customers’ and other users’ sensitive and proprietary information, including personal or identifying information regarding our customers, their employees, job candidates, customers, prospectus, and suppliers, as well as financial, accounting, health, and payroll data. Additionally, our operations and the availability of the services we provide also depend on our information technology systems. As a result, a compromise of our applications or systems, or unauthorized access to, acquisition, use, tampering, release, alteration, theft, loss, or destruction of sensitive data, or unavailability of data or our applications, has and could disrupt our operations or impact the availability or performance of our applications; expose us and our customers to regulatory obligations and enforcement actions, litigation, investigations, remediation and indemnity obligations, or supplemental disclosure obligations; damage our reputation and brand; or result in loss of customer, consumer, and partner confidence in the security of our applications, an increase in our insurance premiums, loss of authorization under the Federal Risk and Authorization Management Program (“FedRAMP”) or other authorizations, impairment to our business, and other potential liabilities or related fees, expenses, or loss of revenues.

Current wording

Our applications involve the storage and transmission of our customers’ and other users’ sensitive and proprietary information, including personal or identifying information regarding our customers, their employees, job candidates, customers, prospects, and suppliers, as well as financial, accounting, health, and payroll data. Additionally, our operations and the availability of the services we provide also depend on our information technology systems. As a result, a compromise of our applications or systems, or unauthorized access to, acquisition, use, tampering, release, alteration, theft, loss, or destruction of sensitive data, or unavailability of data or our applications, has and could disrupt our operations or impact the availability or performance of our applications; expose us and our customers to regulatory obligations and enforcement actions, litigation, investigations, remediation and indemnity obligations, or supplemental disclosure obligations; damage our reputation and brand; or result in loss of customer, consumer, and partner confidence in the security of our applications, an increase in our insurance premiums, loss of authorization under the Federal Risk and Authorization Management Program (“FedRAMP”) or other authorizations, impairment to our business, and other potential liabilities or related fees, expenses, or loss of revenues.

Previous wording

Cybersecurity threats and attacks are often targeted at companies such as ours and may take a variety of forms ranging from individuals or groups of security researchers, including those who appear to offer a solution to a vulnerability in exchange for some compensation, and insiders, to sophisticated hacker organizations, including state-sponsored actors who may launch coordinated attacks, such as retaliatory cyber attacks stemming from the Russia-Ukraine conflict or attacks motivated by the type of data that is processed by our customers, including our public sector customers, on our platform. In the normal course of business, we are and have been the target of malicious cyber-attack attempts and have experienced other security events. As our market presence grows, we face increased risks of cybersecurity attack or other security threats. Key cybersecurity risks range from viruses, worms, ransomware, and other malicious software programs, to phishing attacks, to credential theft or abuse, to exploitation of software bugs or other defects, to targeted attacks against cloud services and other hosted software, to exploitation of unmanaged software or systems, any of which can result in a compromise of our applications or systems and the data we store or process, disclosure of Workday confidential information and intellectual property, production downtimes, reputational harm, and an increase in costs to the business. As the techniques used to obtain unauthorized access or sabotage systems change frequently, are becoming increasingly sophisticated and complex, and often are not identified until they are launched against a target, and because evidence of unauthorized activity may not have been captured or retained, or may be proactively destroyed by unauthorized actors, we may be unable to anticipate these attacks, assess the true impact they may have on our business and operations, or to implement adequate preventative measures. Future cyber-attacks and other security events may have a significant or material impact on our business and operating results.

Current wording

Cybersecurity threats and attacks are often targeted at companies such as ours and may take a variety of forms ranging from individuals or groups of security researchers, including those who appear to offer a solution to a vulnerability in exchange for some compensation, and insiders, to sophisticated hacker organizations, including state-sponsored actors who may launch coordinated attacks, such as retaliatory cyber attacks stemming from the Russia-Ukraine conflict or attacks motivated by the type of data that is processed by our customers, including our public sector customers, on our platform. In the normal course of business, we are and have been the target of malicious cyber-attack attempts and have experienced other security events. As our market presence grows, we face increased risks of cybersecurity attack or other security threats. Additionally, as AI technologies, including generative AI models, develop rapidly, threat actors are using these technologies to create sophisticated new attack methods that are increasingly automated, targeted, and coordinated and more difficult to defend against. Key cybersecurity risks range from viruses, worms, ransomware, and other malicious software programs, to phishing attacks, to credential theft or abuse, to exploitation of software bugs or other defects, to targeted attacks against cloud services and other hosted software, to exploitation of unmanaged software or systems, any of which can result in a compromise of our applications or systems and the data we store or process, disclosure of Workday confidential information and intellectual property, production downtimes, reputational harm, and an increase in costs to the business. As the techniques used to obtain unauthorized access or sabotage systems change frequently, are becoming increasingly sophisticated and complex, and often are not identified until they are launched against a target, and because evidence of unauthorized activity may not have been captured or retained, or may be proactively destroyed by unauthorized actors, we may be unable to anticipate these attacks, assess the true impact they may have on our business and operations, or to implement adequate preventative measures. Future cyber-attacks and other security events may have a significant or material impact on our business and operating results.

Previous wording

We rely on sophisticated information systems and technology, including those provided by third parties, for the secure collection, processing, transmission, storage of confidential, proprietary, and personal information, and to support our business operations and the availability of our applications. In the past several years, supply chain attacks have increased in frequency and severity. As we are both a provider and consumer of information systems and technology, we are at higher risk of being impacted either directly or indirectly by these attacks. The control systems, cybersecurity program, infrastructure, physical facilities of, and personnel associated with third parties that we rely on are beyond our control. The audits we periodically conduct of some of our third-party vendors do not guarantee the security of and may be unable to prevent security events impacting the information technology systems of third parties that are part of our supply chain or that provide valuable services to us, which have resulted and could result in the unauthorized access to data of Workday, our employees, our customers, our third-party partners, or other end users; acquisition, destruction, alteration, use, tampering, release, unavailability, theft or loss of confidential, proprietary, or personal data of Workday, our employees, our customers, our third party partners, or other end users; or the disruption of our operations and our ability to conduct our business or the availability of our applications; or could otherwise adversely affect our business, financial condition, operating results, or reputation.

Current wording

We rely on sophisticated information systems and technology, including those provided by third parties, for the secure collection, processing, transmission, and storage of confidential, proprietary, and personal information, and to support our business operations and the availability of our applications. In the past several years, supply chain attacks have increased in frequency and severity. As we are both a provider and consumer of information systems and technology, we are at higher risk of being impacted either directly or indirectly by these attacks. The control systems, cybersecurity program, infrastructure, physical facilities of, and personnel associated with third parties that we rely on or partner with are beyond our control. Our customers may authorize third-party technology providers to access their customer data and any unauthorized use of the third-party technology may result in unauthorized access to such data. The audits we periodically conduct of some of our third-party vendors do not guarantee the security of and may be unable to prevent security events impacting the information technology systems of third parties that are part of our supply chain or that provide valuable services to us, which have resulted and could result in the unauthorized access to data of Workday, our employees, our customers, our third-party partners, or other end users; acquisition, destruction, alteration, use, tampering, release, unavailability, theft or loss of confidential, proprietary, or personal data of Workday, our employees, our customers, our third party partners, or other end users; or the disruption of our operations and our ability to conduct our business or the availability of our applications; or could otherwise adversely affect our business, financial condition, operating results, or reputation.

Previous wording

Legal requirements related to collecting, storing, handling, and transferring personal data are rapidly evolving at both the national and international level in ways that require our business to adapt to support customer compliance. As the regulatory focus on privacy intensifies worldwide, and jurisdictions increasingly consider and adopt privacy laws, the potential risks related to managing personal data by our business may grow. In addition, possible adverse interpretations of existing privacy-related laws and regulations by governments in countries where our customers operate, as well as the potential implementation of new legislation, could impose significant obligations in areas affecting our business or prevent us from offering certain services in jurisdictions where we operate.

Current wording

Legal requirements related to collecting, storing, handling, retaining, and transferring (collectively, “processing”) personal data are rapidly evolving at both the national and international level in ways that require our business to adapt to support customer compliance. As the complexity of our products grow, the regulatory focus on privacy intensifies worldwide, and jurisdictions increasingly consider and adopt privacy laws, the risks related to processing personal data by our business also grow. In addition, possible adverse interpretations of existing privacy-related laws and regulations by governments in countries where our customers operate, as well as the potential implementation of new legislation, could impose significant obligations in areas affecting our business or prevent us from offering certain services in jurisdictions where we operate.

Previous wording

Following the European Union’s (“EU”) passage of the General Data Protection Regulation (“GDPR”), which became effective in May 2018, the global data privacy compliance landscape has grown increasingly complex, fragmented, and financially relevant to business operations. As a result, our business faces current and prospective risks related to increased regulatory compliance costs, government enforcement actions and/or financial penalties for non-compliance, and reputational harm. For example, a new EU-U.S. Data Privacy Framework (“DPF”) is in place under which EU data can legally be transferred to the United States. However, it is expected to face legal challenges. Until challenges to the DPF make their way through the court system, uncertainty may continue about the legal requirements for transferring customer personal data to and from Europe, an integral process of our business that remains governed by, and subject to, GDPR requirements. Failure to comply with the GDPR data processing requirements by either ourselves or our subcontractors could lead to regulatory enforcement actions, which can result in monetary penalties of up to 4% of worldwide revenue, private lawsuits, reputational damage, and loss of customers. Other countries such as Russia, China, and India have also passed laws imposing varying degrees of restrictive data residency requirements. Regulatory developments in the United States present additional risks. For example, the California Consumer Privacy Act (“CCPA”) took effect on January 1, 2020, and the California Privacy Rights Act (“CPRA”), which expands upon the CCPA, came into effect on January 1, 2023. The CCPA and CPRA give California consumers, including employees, certain rights similar to those provided by the GDPR, and also provide for statutory damages or fines on a per violation basis that could be very large depending on the severity of the violation. Numerous states have enacted, or are considering, privacy laws as well, creating a patchwork of state laws that may create compliance challenges. Furthermore, the U.S. Congress is considering numerous privacy bills, and the U.S. Federal Trade Commission continues to fine companies for unfair or deceptive data protection practices and may undertake its own privacy rulemaking exercise. In addition to government activity, privacy advocacy and other industry groups have established or may establish various new, additional, or different self-regulatory standards that customers may require us to adhere to and which may place additional burdens on us. Increasing sensitivity of individuals to unauthorized processing of personal data, whether real or perceived, and an increasingly uncertain trust climate has and may continue to create a negative public reaction to technologies, products, and services such as ours or otherwise expose us to liability.

Current wording

Following the European Union’s (“EU”) passage of the General Data Protection Regulation (“GDPR”), which became effective in May 2018, the global data privacy compliance landscape has grown increasingly complex, fragmented, and financially relevant to business operations. As a result, our data processing creates current and prospective risks related to increased regulatory compliance costs, government enforcement actions and/or financial penalties for non-compliance, and reputational harm. For example, a new EU-U.S. Data Privacy Framework (“DPF”) is in place under which EU data can legally be transferred to the United States. However, it is expected to face legal challenges. Until challenges to the DPF make their way through the court system, uncertainty may continue about the legal requirements for transferring customer personal data to and from Europe, an integral process of our business that remains governed by, and subject to, GDPR requirements. Failure to comply with the GDPR data processing requirements by either ourselves or our subcontractors could lead to regulatory enforcement actions, which can result in monetary penalties of up to 4% of worldwide revenue, private lawsuits, reputational damage, and loss of customers. Other countries such as Russia, China, and India have also passed laws imposing varying degrees of restrictive data residency requirements. Regulatory developments in the United States present additional risks. For example, the California Consumer Privacy Act (“CCPA”) took effect on January 1, 2020, and the California Privacy Rights Act (“CPRA”), which expands upon the CCPA, came into effect on January 1, 2023. The CCPA and CPRA give California consumers, including employees, certain rights similar to those provided by the GDPR, and also provide for statutory damages or fines on a per violation basis that could be very large depending on the severity of the violation. Numerous states have enacted, or are considering, privacy laws as well, creating a patchwork of state laws that may create compliance challenges. Furthermore, the U.S. Congress is considering numerous privacy bills, and the U.S. Federal Trade Commission continues to fine companies for unfair or deceptive data protection practices and may undertake its own privacy rulemaking exercise. In addition to government activity, privacy advocacy and other industry groups have established or may establish various new, additional, or different self-regulatory standards that customers may require us to adhere to and which may place additional burdens on us. Increasing sensitivity of individuals to unauthorized processing of personal data, whether real or perceived, and an increasingly uncertain trust climate has and may continue to create a negative public reaction to technologies, products, and services such as ours or otherwise expose us to liability.

Previous wording

Taken together, the costs of compliance with and other obligations imposed by data protection laws and regulations may require modification of our services, limit use and adoption of our services, reduce overall demand for our services, lead to significant fines, penalties, or liabilities for noncompliance, or slow the pace at which we close sales transactions, or otherwise cause us to modify our operations, any of which could harm our business. The perception of privacy concerns, whether or not valid, may inhibit the adoption, effectiveness, or use of our applications or otherwise impact our business. Compliance with applicable laws and regulations regarding personal data may require changes in services, business practices, or internal systems that result in increased costs, lower revenue, reduced efficiency, or greater difficulty competing with foreign-based firms which could adversely affect our business and operating results.

Current wording

Taken together, the costs of compliance with and other obligations imposed by data protection laws and regulations may require modification of our services, limit use and adoption of our services, reduce overall demand for our services, lead to significant fines, penalties, or liabilities for noncompliance, or slow the pace at which we close sales transactions, or otherwise cause us to modify our operations, any of which could harm our business. The data protection laws set forth requirements impacting how personal data must be stored, accessed, and deleted within the products. The perception of privacy concerns, whether or not valid, may inhibit the adoption, effectiveness, or use of our applications or otherwise impact our business. Compliance with applicable laws and regulations regarding personal data may require changes in services, business practices, or internal systems that result in increased costs, lower revenue, reduced efficiency, or greater difficulty competing with foreign-based firms which could adversely affect our business and operating results.

Previous wording

Some of our applications include software covered by open source licenses, which may include, by way of example, GNU General Public License and the Apache License. The terms of various open source licenses have not been interpreted by United States courts, and there is a risk that such licenses could be construed in a manner that imposes unanticipated conditions or restrictions on our ability to market our applications. We attempt to avoid adverse licensing conditions in our use of open source software in our products and services. By the terms of certain open source licenses, we could be required to release the source code of our proprietary software, and to make our proprietary software available under open source licenses, if we combine our proprietary software with open source software in a certain manner. In the event that portions of our proprietary software are determined to be impacted by an open source license, we could be required to publicly release the affected portions of our source code, re-engineer all or a portion of our technologies, or otherwise be limited in the licensing of our technologies, each of which could reduce or eliminate the value of our technologies and services. In addition, the open source license terms for future versions of open source software that we use might change, requiring us to pay for a commercial license or re-engineer all or a portion of our technologies. In addition to risks related to license requirements, usage of open source software can lead to greater risks than use of third-party commercial software, as open source licensors generally do not provide warranties or controls on the origin of the software. Many of the risks associated with usage of open source software cannot be eliminated and could negatively affect our business.

Current wording

Some of our applications include software covered by open source licenses, which may include, by way of example, GNU General Public License and the Apache License. Few terms used in open source licenses have been interpreted by United States courts, and there is a risk that such licenses could be construed in a manner that imposes unanticipated conditions or restrictions on our ability to market our applications. We attempt to comply with all open source licensing conditions that apply to our use of open source software. By the terms of certain open source licenses, we could be required to release the source code of our proprietary software, and to make our proprietary software available under open source licenses, if we combine our proprietary software with open source software in a certain manner. In the event that portions of our proprietary software are determined to be impacted by an open source license, we could be required to publicly release portions of our source code, re-engineer all or a portion of our technologies, or otherwise be limited in the use or licensing of our technologies, which could reduce or eliminate the value of our technologies, products, and services. In addition, the license terms for certain previously open source software that we use have changed and the license terms for future versions of open source software that we use might change, requiring us to pay for a commercial license or re-engineer all or a portion of our technologies. In addition to risks related to open source license requirements, usage of open source software can lead to greater risks than use of third-party commercial software, as open source licensors generally do not provide warranties or controls on the origin of the software. Many of the risks associated with usage of open source software cannot be eliminated and could negatively affect our business.

Previous wording

Unfavorable laws, regulations, interpretive positions, or standards governing new and evolving technologies that we incorporate into our products and services could result in significant cost and compliance challenges and adversely affect our business and operating results.

Current wording

Unfavorable laws, regulations, interpretive positions, or standards governing new and evolving technologies that we incorporate into our products and services, including those involving AI uses, could result in significant cost and compliance challenges and adversely affect our business and operating results.

Previous wording

Some of our products and services, such as Workday’s People Experience, Talent Optimization, and Financial product suites, currently utilize or will utilize new and evolving technologies such as AI. The overall regulatory environment governing these types of technologies is likely to evolve as government interest in these technologies increases. Regulation of these technologies, as well as other technologies that we utilize in our products and services, also varies greatly among international, federal, state, and local jurisdictions and is subject to significant uncertainty. Governments and agencies domestic and abroad may in the future change or amend existing laws, or adopt new laws, regulations, or guidance, or take other actions which may severely impact the permitted uses of our technologies. Any failure by us to comply with applicable laws, regulations, guidance, or other rules could result in costly litigation, penalties, or fines. In addition, these regulations and any related enforcement actions could establish and further expand our obligations to customers, individuals, and other third parties with respect to our products and services, limit the countries in which such products and services may be used, restrict the way we structure and operate our business, require us to divert development and other resources, and reduce the types of customers and individuals who can use our products and services. Furthermore, our customers may operate in foreign jurisdictions, including countries in which we don’t operate, and may be subject to additional laws and regulations outside the scope of our products. Increased regulation and oversight of products or services which utilize or rely on these technologies may result in costly compliance burdens or otherwise increase our operating costs, detrimentally affecting our business. These new technologies could subject us to additional litigation brought by private parties, which could be costly, time-consuming, and distracting to management and could result in substantial expenses and losses.

Current wording

Any failure by us to comply with applicable laws, regulations, guidance, or other rules could result in costly litigation, penalties, or fines. In addition, these regulations and any related enforcement actions could establish and further expand our obligations to customers, individuals, and other third parties with respect to our products and services, limit the countries in which such products and services may be used, restrict the way we structure and operate our business, require us to divert development and other resources, and reduce the types of customers and individuals who can use our products and services. Furthermore, our customers may operate in foreign jurisdictions, including countries in which we don’t operate, and may be subject to additional laws and regulations outside the scope of our products. Increased regulation and oversight of products or services which utilize or rely on these technologies may result in costly compliance burdens or otherwise increase our operating costs, detrimentally affecting our business. These new technologies could subject us to additional litigation brought by private parties, which could be costly, time-consuming, and distracting to management and could result in substantial expenses and losses.

Previous wording

Our contracts with federal, state, local, and foreign government entities are subject to various procurement regulations and other requirements relating to their formation, administration, performance, and termination, which could adversely impact our business and operating results. Government certification requirements applicable to our platform, including FedRAMP, may change and, in doing so, restrict our ability to sell into the governmental sector until we have attained the full or revised certification. These laws and regulations provide public sector customers various rights, many of which are not typically found in commercial contracts. For instance, the process of evaluating potential conflicts of interest and developing necessary provisions and contract clauses, where needed, may delay or prevent Workday from being awarded certain U.S. federal government contracts.

Current wording

Our contracts with federal, state, local, and foreign government entities are subject to various procurement regulations and other requirements relating to their formation, administration, and performance, which could adversely impact our business and operating results. Government certification requirements applicable to our platform, including FedRAMP, may change and, in doing so, restrict our ability to sell into the governmental sector until we have attained the full or revised certification. These laws and regulations provide public sector customers various with rights, many of which are not typically found in commercial contracts. For example, some federal contracts provide for delays, interruptions, or termination by the government at any time, with or without cause, which can adversely affect our business and operating results and impact other existing or prospective government contracts.

Previous wording

Additionally, we have obtained authorization under FedRAMP, which allows us to enter into the U.S. federal government market. Such certification is subject to rigorous compliance and if we lose our certification, it could inhibit or preclude our ability to contract with certain U.S. federal government customers. In addition, some customers may rely on our authorization under FedRAMP to help satisfy their own legal and regulatory compliance requirements and our failure to maintain FedRAMP authorization would result in a breach under public sector contracts obtained on the basis of such authorization. This could subject us to liability, result in reputational harm, and adversely impact our financial condition or operating results.

Current wording

Additionally, we have obtained authorization under FedRAMP, which allows us to enter into the U.S. federal government market. Such authorization is subject to rigorous compliance and if we were to lose our authorization, it could inhibit or preclude our ability to contract with certain U.S. federal government customers. In addition, some customers may rely on our authorization under FedRAMP to help satisfy their own legal and regulatory compliance requirements and our failure to maintain FedRAMP authorization may result in a breach under public sector contracts obtained on the basis of such authorization. This could subject us to liability, result in reputational harm, and adversely impact our financial condition or operating results.

Previous wording

We may be subject to audits and investigations relating to our government contracts, and any violations could result in various civil and criminal penalties and administrative sanctions, including termination of contracts, refunding or suspending of payments, forfeiture of profits, payment of fines, and suspension or debarment from future government business. In addition, such contracts may provide for delays, interruptions, or termination by the government at any time, with or without cause, which may adversely affect our business and operating results and impact other existing or prospective government contracts.

Current wording

We may be subject to additional audits and investigations relating to our government contracts, and any violations could result in various civil and criminal penalties and administrative sanctions, including termination of contracts, refunding or suspending of payments, forfeiture of profits, payment of fines, and suspension or debarment from future government business.

Previous wording

Our typical sales cycles for new customers are six to twelve months but can extend for eighteen months or more, and we expect that this lengthy sales cycle may continue or expand as customers increasingly adopt applications across our platform. We have seen and may continue to see instances of increased scrutiny from existing and prospective customers and the lengthening of certain sales cycles. Longer sales cycles could cause our operating and financial results to suffer in a given period. Accordingly, the effect of significant downturns in sales and market acceptance of new applications, as well as potential changes in our pricing policies or rate of renewals, may not be fully reflected in our operating results until future periods. Additionally, we may be unable to adjust our cost structure to reflect any such changes in revenues. As a result, increased growth in the number of our customers could result in our recognition of more costs than revenues in the earlier periods of the terms of our agreements. Our subscription model also makes it difficult for us to rapidly increase our revenues through additional sales in any period, as subscription services revenues from new customers generally are recognized over the applicable subscription term. Furthermore, our subscription-based model is largely based on the size of our customers’ employee headcount. Therefore, the addition or loss of employees by our customers, including any significant reductions in force by our customers, or customer insolvencies resulting from severe economic hardship, could have an impact on our subscription services revenues in any given period. Should there be any prolonged decrease in our customers’ headcounts, we could experience reduced subscription services revenues upon renewal or potentially outside of the renewal period, which could materially impact our business and operating results in any given period.

Current wording

Our typical sales cycles for many new customers are six to twelve months but can extend for eighteen months or more, and we expect that this lengthy sales cycle may continue or expand as customers increasingly adopt applications across our platform. We have seen and may continue to see instances of increased scrutiny from existing and prospective customers and the lengthening of certain sales cycles. Longer sales cycles could cause our operating and financial results to suffer in a given period. Accordingly, the effect of significant downturns in sales and market acceptance of new applications, as well as potential changes in our pricing policies or rate of renewals, may not be fully reflected in our operating results until future periods. Additionally, we may be unable to adjust our cost structure to reflect any such changes in revenues. As a result, increased growth in the number of our customers could result in our recognition of more costs than revenues in the earlier periods of the terms of our agreements. Our subscription model also makes it difficult for us to rapidly increase our revenues through additional sales in any period, as subscription services revenues from new customers generally are recognized over the applicable subscription term. Furthermore, our subscription-based model is largely based on the size of our customers’ employee headcount. Therefore, the addition or loss of employees by our customers, including any significant reductions in force by our customers, or customer insolvencies resulting from severe economic hardship, could have an impact on our subscription services revenues in any given period. Should there be any prolonged decrease in our customers’ headcounts, we could experience reduced subscription services revenues upon renewal or potentially outside of the renewal period, which could materially impact our business and operating results in any given period.

Previous wording

As of April 30, 2024, our Co-Founder and CEO Emeritus David Duffield, together with his affiliates, held voting rights with respect to approximately 44 million shares of Class B common stock and 1 million shares of Class A common stock. As of April 30, 2024, our Co-Founder and Executive Chair, Aneel Bhusri, together with his affiliates, held voting rights with respect to approximately 8 million shares of Class B common stock and 0.4 million shares of Class A common stock. In addition, Mr. Bhusri holds 0.2 million RSUs, which will be settled in an equivalent number of shares of Class A common stock. Further, Messrs. Duffield and Bhusri have entered into a voting agreement under which each has granted a voting proxy with respect to certain Class B common stock beneficially owned by him effective upon his death or incapacity as described in our registration statement on Form S-1 filed in connection with our IPO. Messrs. Duffield and Bhusri have each initially designated the other as their respective proxies. Accordingly, upon the death or incapacity of either Mr. Duffield or Mr. Bhusri, the other would individually continue to control the voting of shares subject to the voting proxy. Collectively, the shares described above represent a substantial majority of the voting power of our outstanding capital stock. As a result, Messrs. Duffield and Bhusri have the ability to control the outcome of matters submitted to our stockholders for approval, including the election of directors and any merger, consolidation, or sale of all or substantially all of our assets. As stockholders, even as controlling stockholders, they are entitled to vote their shares in their own interests, which may not always be in the interests of our stockholders generally.

Current wording

As of July 31, 2024, our Co-Founder and CEO Emeritus David Duffield, together with his affiliates, held voting rights with respect to approximately 43 million shares of Class B common stock and 1 million shares of Class A common stock. As of July 31, 2024, our Co-Founder and Executive Chair, Aneel Bhusri, together with his affiliates, held voting rights with respect to approximately 8 million shares of Class B common stock and 0.4 million shares of Class A common stock. In addition, Mr. Bhusri holds 0.2 million RSUs, which will be settled in an equivalent number of shares of Class A common stock. Further, Messrs. Duffield and Bhusri have entered into a voting agreement under which each has granted a voting proxy with respect to certain Class B common stock beneficially owned by him effective upon his death or incapacity as described in our registration statement on Form S-1 filed in connection with our IPO. Messrs. Duffield and Bhusri have each initially designated the other as their respective proxies. Accordingly, upon the death or incapacity of either Mr. Duffield or Mr. Bhusri, the other would individually continue to control the voting of shares subject to the voting proxy. Collectively, the shares described above represent a substantial majority of the voting power of our outstanding capital stock. As a result, Messrs. Duffield and Bhusri have the ability to control the outcome of matters submitted to our stockholders for approval, including the election of directors and any merger, consolidation, or sale of all or substantially all of our assets. As stockholders, even as controlling stockholders, they are entitled to vote their shares in their own interests, which may not always be in the interests of our stockholders generally.

Previous wording

In November 2022, our Board of Directors authorized a program under which we were authorized to repurchase up to $500 million of our outstanding shares of Class A common stock. As of April 30, 2024, we had completed the repurchase authorization under this program. In February 2024, the Board of Directors authorized the 2024 Share Repurchase Program under which we may repurchase up to an additional $500 million of our Class A common stock. The 2024 Share Repurchase Program has a term of 18 months, but the program may be modified, suspended, or terminated at any time. Such repurchases may be made through open market transactions, including through the use of trading plans intended to qualify under Rule 10b5-1, through privately negotiated transactions, or by other means, in accordance with applicable securities laws and other restrictions.

Current wording

In February 2024, the Board of Directors authorized the February 2024 Share Repurchase Program under which we may repurchase up to $500 million of our Class A common stock, and in August 2024, the Board of Directors authorized the August 2024 Share Repurchase Program under which we may repurchase up to an additional $1.0 billion of our Class A common stock. The February 2024 Share Repurchase Program has a term of 18 months and the August 2024 Share Repurchase Program has no expiration date, but the programs may be modified, suspended, or terminated at any time. Such repurchases may be made through open market transactions, including through the use of trading plans intended to qualify under Rule 10b5-1, through privately negotiated transactions, or by other means, in accordance with applicable securities laws and other restrictions.

Previous wording

(1)In November 2022, our Board of Directors authorized the 2022 Share Repurchase Program under which we were authorized to repurchase up to $500 million of our outstanding shares of Class A common stock. As of April 30, 2024, we had completed the purchase authorization under this program. In February 2024, our Board of Directors authorized the 2024 Share Repurchase Program, under which we may repurchase up to an additional $500 million of our outstanding shares of Class A common stock. For further information, see Note 14, Stockholders’ Equity, of the Notes to Condensed Consolidated Financial Statements included in Part I, Item 1 of this report.

Current wording

(1)In November 2022, our Board of Directors authorized the 2022 Share Repurchase Program under which we were authorized to repurchase up to $500 million of our outstanding shares of Class A common stock. We completed the purchase authorization under this program during the first quarter of fiscal 2025. In February 2024, our Board of Directors authorized the February 2024 Share Repurchase Program, under which we may repurchase up to an additional $500 million of our outstanding shares of Class A common stock. In August 2024, our Board of Directors authorized the August 2024 Share Repurchase Program, under which we may repurchase up to an additional $1.0 billion of our outstanding shares of Class A common stock. For further information, see Note 14, Stockholders’ Equity and Note 20, Subsequent Events, of the Notes to Condensed Consolidated Financial Statements included in Part I, Item 1 of this report.