Workday Inc

Previous wording

We have experienced, and may in the future experience, defects, system disruptions, outages, and other performance problems, including the failure of our applications to perform properly. These problems may be caused by a variety of factors, including infrastructure and software or code changes, vendor issues, software and system defects, human error, viruses, worms, security attacks (internal and external), fraud, spikes in customer usage, and denial of service issues. All of these issues may result in increased operational costs, delays in new feature rollouts, customer loss, reputational damage, and legal or regulatory liability, including liability under customer contracts or for losses suffered by our customers.

Current wording

We have experienced, and may in the future experience, defects, system disruptions, outages, and other performance problems, including the failure of our applications to perform properly. These problems may be caused by a variety of factors, including infrastructure and software or code changes, vendor issues, software and system defects, human error, viruses, worms, security attacks (internal and external), fraud, spikes in customer usage, and denial of service issues. All of these issues may result in increased operational costs, delays in new feature rollouts, customer loss, reputational damage, and legal or regulatory liability, including liability under customer contracts.

Previous wording

Such issues have, and may in the future, result in certain parties having unauthorized access to data. For example, in November 2023, we discovered that an issue in our product affecting certain customers resulted in document notifications and PDF documents being sent to unintended recipients within the same organization. Because of the large amount of data that we collect and process in our systems, and the sensitive nature of such data, it is possible that these issues could result in significant disruption, data loss or corruption, or cause the data to be incomplete or contain inaccuracies that our customers and other users regard as significant.

Current wording

Such issues have, and may in the future, result in certain parties having unauthorized access to data, which could increase the scope of our liability. Because of the large amount of data that we collect and process in our systems, and the sensitive nature of such data, it is possible that these issues could result in significant disruption, data loss or corruption, or cause the data to be incomplete or contain inaccuracies that our customers and other users regard as significant.

Previous wording

Furthermore, our financial management application is essential to our and our customers’ financial planning, reporting, and compliance programs. Any interruption in our service may affect the availability, accuracy, or timeliness of such programs and as a result could damage our reputation, cause our customers to terminate their use of our applications, require us to issue refunds for prepaid and unused subscription services, require us to compensate our customers for certain losses, and prevent us from gaining additional business from current or future customers. In addition, because we use Workday’s financial management application, any problems that we experience with financial reporting and compliance could be negatively perceived by prospective or current customers and negatively impact demand for our applications.

Current wording

Furthermore, our applications are essential to many of the business processes for our customers. For example, our financial management application is essential to our and our customers’ financial planning, reporting, and compliance programs. Any interruption in our service may affect the availability, accuracy, or timeliness of such programs and as a result could damage our reputation, cause our customers to terminate their use of our applications, require us to issue refunds for prepaid and unused subscription services, require us to compensate our customers for certain losses, and prevent us from gaining additional business from current or future customers. In addition, because we use Workday’s financial management application, any problems that we experience with financial reporting and compliance could be negatively perceived by prospective or current customers and negatively impact demand for our applications.

Previous wording

Our insurance policies, including our errors and omissions insurance, may be inadequate or may not be available in the future on acceptable terms, or at all, to protect against claims and other legal actions arising from breaches of our contracts, disruptions in our service, including those caused by cybersecurity incidents, failures or disruptions to our infrastructure, catastrophic events and disasters, or otherwise. In addition, our policy may not cover all claims made against us and defending a suit, regardless of its merit, could be costly and divert management’s attention.

Current wording

Our insurance policies, including our errors and omissions insurance, may be inadequate or may not be available in the future on acceptable terms, or at all, to protect against claims and other legal actions arising from breaches of our contracts, disruptions in our service, including those caused by cybersecurity incidents, failures or disruptions to our infrastructure, catastrophic events and disasters, or otherwise. In addition, our policy may not cover all claims made against us and defending a suit, regardless of its merit, could be costly.

Previous wording

We host our applications and serve our customers and users globally from data centers operated by third parties and rely upon third-party hosted infrastructure partners to operate certain aspects of our services. We control our applications and data but we do not control the facilities, operations, and physical security of these locations. Disruption of or interference at our data centers or hosted infrastructure partners has and could in the future impact our operations and our business could be adversely impacted. For example, we have experienced disruptions at certain of our data centers in the U.S. due to high temperatures and power outages that resulted in a brief temporary outage of our services for a subset of our customers. Our data center and hosted infrastructure partner facilities may also be subject to cybersecurity breaches, capacity constraints, financial difficulties, break-ins, sabotage, intentional acts of vandalism and similar misconduct, natural catastrophic events, as well as local administrative actions, changes to legal or permitting requirements, and litigation to stop, limit, or delay operations.

Current wording

We host our applications and serve our customers and users globally from data centers operated by third parties and rely upon third-party partners to operate certain aspects of our services. We control our applications and data, but we do not control the facilities, operations, and physical security of these locations. Disruption of or interference at these locations has and could in the future impact our operations and our business could be adversely impacted. For example, we have experienced disruptions at certain of our data centers in the U.S. due to high temperatures and power outages that resulted in a brief temporary outage of our services for a subset of our customers. These facilities may also be subject to cybersecurity breaches, capacity constraints, financial difficulties, break-ins, sabotage, intentional acts of vandalism and similar misconduct, natural catastrophic events, as well as local administrative actions, changes to legal or permitting requirements, and litigation to stop, limit, or delay operations, and our disaster recovery planning may not account for all eventualities.

Previous wording

Any changes in third-party service levels at data centers or at our hosted infrastructure partners, or any errors, defects, disruptions, or other performance problems with our applications or the infrastructure on which they run, including internet infrastructure, could adversely affect our reputation and may damage our customers’ or other users’ stored files or result in lengthy interruptions in our services. Interruptions in our services might adversely affect our reputation and operating results, cause us to issue refunds or service credits to customers, subject us to potential liabilities, result in contract terminations, or adversely affect our renewal rates.

Current wording

Any changes in third-party service levels at our hosted infrastructure providers, or any errors, defects, disruptions, or other performance problems with our applications or the infrastructure on which they run, including internet infrastructure, could adversely affect our reputation and may damage our customers’ or other users’ stored files or result in lengthy interruptions in our services. Interruptions in our services might adversely affect our reputation and operating results, cause us to issue refunds or service credits to customers, subject us to potential liabilities, result in contract terminations, or adversely affect our renewal rates.

Previous wording

We operate on a global scale, and as a result, our business and revenues are impacted by global economic and geopolitical conditions. Global economic developments, geopolitical volatilities, downturns or recessions, and global health crises may negatively affect us or our ability to accurately forecast and plan our future business activity. In addition, geopolitical volatilities, including the Russia-Ukraine and Israel-Hamas conflicts, have led and could lead to further economic disruption. Any sustained adverse impacts from these and other recent macroeconomic events could materially and adversely affect our business, financial condition, operating results, and earnings guidance that we may issue from time to time, which could have a material effect on the value of our Class A common stock.

Current wording

We operate on a global scale, and as a result, our business and revenues are impacted by global economic and geopolitical conditions. Global economic developments, including increased tariffs, geopolitical volatilities, downturns or recessions, political instability, and global health crises may negatively affect us or our ability to accurately forecast and plan our future business activity. In addition, volatile geopolitical situations have led and could lead to further economic disruption. Any sustained adverse impacts from these and other recent macroeconomic events could materially and adversely affect our business, financial condition, operating results, and earnings guidance that we may issue from time to time, which could have a material effect on the value of our Class A common stock.

Previous wording

We may lose key employees or be unable to attract, train, and retain highly skilled employees.

Current wording

We may lose key employees or be unable to attract, enable, and retain highly skilled employees.

Previous wording

Our success and future growth depend largely upon the continued services of our executive officers, other members of senior management, and other key employees. Effective February 1, 2024, the start of our fiscal 2025, in accordance with an established succession plan, Aneel Bhusri stepped down from his role as Co-CEO and assumed the role of Executive Chair, and Carl Eschenbach, formerly Co-CEO alongside Mr. Bhusri, assumed the role of sole CEO. We do not have employment agreements with our executive officers or other key personnel that require them to continue to work for us for any specified period, and they could terminate their employment with us at any time. Key employee changes have the potential to disrupt our business, impact our ability to preserve our culture, negatively affect our ability to attract and retain talent, or otherwise have a serious adverse effect on our business and operating results.

Current wording

Our success and future growth depend largely upon the continued services of our executive officers, other members of senior management, and other key employees. Effective February 1, 2024, the start of our fiscal 2025, in accordance with an established succession plan, Aneel Bhusri stepped down from his role as Co-CEO and assumed the role of Executive Chair, and Carl Eschenbach, formerly Co-CEO alongside Mr. Bhusri, assumed the role of sole CEO. We do not have employment agreements with our executive officers or other key employees that require them to continue to work for us for any specified period, and they could terminate their employment with us at any time. Key employee changes have the potential to disrupt our business, impact our ability to preserve our culture, negatively affect our ability to attract and retain talent, or otherwise have a serious adverse effect on our business and operating results.

Previous wording

To execute our growth plan, we must attract, enable, and develop highly qualified talent. Our ability to compete and succeed in a highly competitive environment is directly correlated to our ability to recruit and retain highly skilled employees, especially in the areas of product development, cybersecurity, senior sales executives, and engineers with significant experience in designing and developing software and internet-related services, including in the areas of AI. The expansion of our sales infrastructure, both domestically and internationally, is necessary to grow our customer base and business. Our business may be adversely affected if our efforts to attract and enable new members of our direct sales force do not generate a corresponding increase in revenues. We have experienced, and we expect to continue to experience, significant competition in hiring and retaining employees with appropriate qualifications.

Current wording

To execute our growth plan, we must attract, enable, develop, and retain highly qualified talent. Our ability to compete and succeed in a highly competitive environment is directly correlated to our ability to recruit and retain highly skilled employees, especially in the areas of product development, cybersecurity, senior sales executives, and engineers with significant experience in designing and developing software and internet-related services, including in AI. The expansion of our sales infrastructure, both domestically and internationally, is necessary to grow our customer base and business. Our business may be adversely affected if our efforts to attract and enable new members of our direct sales force do not generate a corresponding increase in revenues. We have experienced, and we expect to continue to experience, significant competition in hiring and retaining employees with appropriate qualifications.

Previous wording

We must also continue to retain and motivate existing employees through our compensation practices, company culture, and career development opportunities. Further, our current and future office environments, such as our current hybrid work policies, may not meet the expectations of our employees or prospective employees, and may amplify challenges in recruiting. We believe that a critical component of our success has been our corporate culture and our core values. As we continue to grow and change, we may find it difficult to maintain our corporate culture among a larger number of employees who are dispersed throughout various geographic regions. Additionally, we and many of our stakeholders expect to have a corporate culture that embraces diversity and inclusion, and any inability to attract and retain diverse and qualified personnel may harm our corporate culture and our ability to innovate. Failure to maintain or adapt our culture could negatively affect our ability to attract new personnel or to retain our current personnel and our business and future growth prospects could be adversely affected.

Current wording

We must also continue to retain, develop, and motivate existing employees through our compensation practices, company culture, and career development opportunities. Further, our current and future office environments and our current hybrid work policy may not meet the expectations of our employees or prospective employees, and may amplify challenges in recruiting and retention. We believe that a critical component of our success has been our corporate culture and our core values. As we continue to grow and change, we may find it difficult to maintain our corporate culture among a larger number of employees who are dispersed throughout various geographic regions, including managing the complexities of communicating with all employees. Efforts to restructure our workforce, such as the Fiscal 2026 Restructuring Plan, may be disruptive and adversely impact employee morale or our corporate culture. Failure to maintain or adapt our culture could negatively affect our ability to attract new employees or to retain our current employees and our business and future growth prospects could be adversely affected.

Previous wording

The markets for enterprise cloud applications are highly competitive, with relatively low barriers to entry for some applications or services. Some of our competitors are larger and have greater name recognition, significantly longer operating histories, access to larger customer bases, larger marketing budgets, and significantly greater resources to devote to the development, promotion, and sale of their products and services than we do. This may allow our competitors to respond more effectively than us to new or emerging technologies and changes in market conditions.

Current wording

The markets for enterprise cloud applications, including AI-powered solutions, are highly competitive, with relatively low barriers to entry for some applications or services. Some of our competitors are larger and have greater name recognition, significantly longer operating histories, access to larger customer bases, larger marketing budgets, and significantly greater resources to devote to the development, promotion, and sale of their products and services than we do. This may allow our competitors to respond more effectively than us to new or emerging technologies and changes in market conditions.

Previous wording

Our primary competitors are Oracle and SAP, well-established providers of financial management and HCM applications, which have long-standing relationships with customers and partners. Some customers may be hesitant to switch vendors or to adopt cloud applications such as ours and may prefer to maintain their existing relationships with competitors. We also face competition from other enterprise software vendors, from regional competitors that only operate in certain geographic markets, and from vendors of specific applications that address only one or a portion of our applications, some of which offer cloud-based solutions. These vendors include, without limitation: Anaplan, Inc., ADP, Coupa Software Inc., Dayforce, Inc., Infor, Inc., Microsoft Corporation, and UKG Inc. In order to take advantage of customer demand for cloud applications, legacy vendors are expanding their cloud applications through acquisitions, strategic alliances, and organic development. In addition, other cloud companies that provide services in different target markets or industries may develop applications or acquire companies that operate in our target markets or industries, and some potential customers may elect to develop their own internal applications. As the market matures and as existing and new market participants introduce new types of technologies and different approaches that enable organizations to address their HCM and financial needs, we expect this competition to intensify in the future.

Current wording

Our primary competitors are Oracle and SAP, well-established providers of financial management and HCM applications, which have long-standing relationships with customers and partners. Some customers may be hesitant to switch vendors or to adopt cloud applications such as ours and may prefer to maintain their existing relationships with competitors. We also face competition from other enterprise software vendors, from regional competitors that only operate in certain geographic markets, and from vendors of specific applications that address only one or a portion of our applications, some of which offer cloud-based or AI-powered solutions. These vendors include, without limitation: Anaplan, Inc., ADP, Coupa Software Inc., Dayforce, Inc., Infor, Inc., Microsoft Corporation, and UKG Inc. In order to take advantage of customer demand for cloud and AI-powered applications, legacy vendors are expanding their cloud or AI-powered applications through acquisitions, strategic alliances, and organic development. In addition, other cloud or AI platform companies that provide services in different target markets or industries may develop applications or acquire companies that operate in our target markets or industries, and some potential customers may elect to develop their own internal applications. As the market matures and as existing and new market participants introduce new types of technologies, such as generative and agentic AI, and different approaches that enable organizations to address their HCM and financial needs, we expect this competition to intensify in the future.

Previous wording

•compliance challenges related to the complexity of multiple, conflicting, and changing governmental laws and regulations, including employment, tax, privacy, intellectual property, and data protection laws and regulations;

Current wording

•compliance challenges related to the complexity of multiple, conflicting, and changing governmental laws and regulations, including employment, tax, privacy, intellectual property, financial services, AI, and data protection laws and regulations;

Previous wording

Any of the above factors may negatively impact our ability to sell our applications and offer services globally, reduce our competitive position in foreign markets, increase our costs of global operations, reduce demand for our applications and services from global customers, or subject us to legal or regulatory liability. Additionally, the majority of our international costs are denominated in local currencies and we anticipate that over time an increasing portion of our sales contracts may be outside the U.S. and will therefore be denominated in local currencies. Fluctuations in the value of foreign currencies, which may be amplified by macroeconomic events, may impact our operating results when translated into U.S. dollars. Such fluctuations may also impact our ability to predict our future results accurately. If we are not able to successfully hedge against the risks associated with foreign currency fluctuations, our financial condition and operating results could be adversely affected.

Current wording

Certain of the above factors have and may continue to negatively impact our ability to sell our applications and offer services globally, reduce our competitive position in foreign markets, increase our costs of global operations, reduce demand for our applications and services from global customers, or subject us to legal or regulatory liability. Additionally, the majority of our international costs are denominated in local currencies and we anticipate that over time an increasing portion of our sales contracts may be outside the U.S. and will therefore be denominated in local currencies. Fluctuations in the value of foreign currencies, which may be amplified by macroeconomic events, may impact our operating results when translated into U.S. dollars. Such fluctuations may also impact our ability to predict our future results accurately. If we are not able to successfully hedge against the risks associated with foreign currency fluctuations, our financial condition and operating results could be adversely affected.

Previous wording

Our customers have no obligation to renew their subscriptions for our applications after the expiration of either the initial or renewed subscription period. Our customers’ renewal rates may decline or fluctuate as a result of a number of factors, including their level of satisfaction with our applications and pricing, their awareness and adoption of the benefits and features of our applications, their ability to continue their operations and spending levels, reductions in their headcount, and the evolution of their business. If our customers do not renew their subscriptions for our applications on similar pricing terms or renew for fewer elements of our applications, our revenues may decline, and we may not be able to meet our revenue projections, which could negatively impact our business and the market price of our Class A common stock.

Current wording

Our customers have no obligation to renew their subscriptions for our applications after the expiration of either the initial or renewed subscription period. Our customers’ renewal rates fluctuate as a result of a number of factors, including their level of satisfaction with our applications and pricing, their awareness and adoption of the benefits and features of our applications, their ability to continue their operations and spending levels, reductions in their headcount, and the evolution of their business. If our customers do not renew their subscriptions for our applications on similar pricing terms or renew for fewer elements of our applications, our revenues may decline, and we may not be able to meet our revenue projections, which could negatively impact our business and the market price of our Class A common stock.

Previous wording

Our future success also depends, in part, on our ability to sell additional products to our current customers, and the success rate of such endeavors is difficult to predict, especially with regard to any new lines of business that we may introduce from time to time. This may require increasingly costly marketing and sales efforts that are targeted at senior management, and if these efforts are not successful, our business and operating results may suffer. Additionally, acquisitions of our customers by other companies have led, and could continue to lead, to cancellation of our contracts with those customers, thereby reducing the number of our existing and potential customers.

Current wording

Our future success also depends, in part, on our ability to sell additional products to our current customers, and the success rate of such endeavors is difficult to predict, especially with regard to any new lines of business that we may introduce from time to time. This has and may continue to require increasingly costly marketing and sales efforts that are targeted at senior management, and if these efforts are not successful, our business and operating results may suffer. Additionally, acquisitions of our customers by other companies have led, and could continue to lead, to cancellation of our contracts with those customers, thereby reducing the number of our existing and potential customers.

Previous wording

The use of new and evolving technologies in our offerings at Workday, including AI, may result in reputational harm and increased litigation.

Current wording

The use of new and evolving technologies in our offerings at Workday, including AI, may result in reputational harm and increased litigation, and adversely affect our operating results.

Previous wording

We are increasingly building AI into Workday’s core and specific offerings. As with many cutting-edge innovations, these technologies can present new risks and challenges. A quickly evolving legal and regulatory environment may cause us to incur increased research and development costs, or divert resources from other development efforts, to address social, ethical, and other issues related to AI. Furthermore, existing laws and regulations may apply to us in new ways, the nature and extent of which are difficult to predict and subject to change over time. The risks and challenges presented by these technologies could undermine public confidence in AI, which could slow its adoption and affect our business. Many of our products are powered by AI, some of which include the use of large language models and generative AI, for use cases that could potentially impact human, civil, privacy, or employment rights and dignities. Our developers are also experimenting with the use of large language models provided by third parties for domain-specific use cases, and at this stage the line between developers and deployers of these technologies, including their respective responsibilities and liabilities, is unclear. Our failure to accurately identify and address our responsibilities and liabilities in this uncertain environment, and adequately address relevant ethical and social issues that may arise with such technologies and use cases, as well as failure by others in our industry, or actions taken by our customers, employees, or end users (including misuse of these technologies), could negatively affect the adoption of our solutions and subject us to reputational harm, regulatory action, or litigation, which may harm our financial condition and operating results. We already are defending against a lawsuit alleging that our products and services enable discrimination, and although we believe that such claims lack merit, and we succeeded in our initial motion to dismiss the claims, legal proceedings can be lengthy, expensive, and disruptive to our operations (particularly where, as in the present litigation, Plaintiff may seek to also litigate against certain of Workday’s customers). We may be subject to other litigation and regulatory actions that may cause financial, competitive, and developmental impacts, and could lead to legal liability. In addition, regardless of outcome, these types of claims could cause reputational harm to our brand. Our employees, customers, or customers’ employees who are dissatisfied with our public statements, policies, practices, or solutions related to the development and use of AI may express opinions that could introduce reputational or business harm, or cease their relationship with us.

Current wording

We are increasingly building AI into the Workday product suite and have recently made announcements about our plans to embrace agentic AI. As with many cutting-edge innovations, these technologies can present new risks and challenges. A quickly evolving technical, legal, and regulatory environment may cause us to incur increased research and development costs, or divert resources from other development efforts, to address ethical, legal, operational, or compliance requirements or other issues related to AI. For example, the European Union’s (“EU”) AI Act (“EU AI Act”) puts new requirements on providers of AI technologies and we are currently analyzing the EU AI Act to ensure compliance in alignment with various deadlines in the coming years. Additionally, existing laws and regulations may apply to us in new ways, the nature and extent of which are difficult to predict and subject to change over time. The risks and challenges presented by these technologies could undermine public confidence in AI, which could slow its adoption and affect our business. Many of our products are powered by AI, some of which include the use of large language models and generative AI, for use cases that could potentially impact human, civil, privacy, or employment rights and dignities. To the extent that our products and technologies rely on the use of large language models provided by third parties, we may face additional uncertainties and liabilities. Any failure to accurately identify and address our responsibilities and liabilities in this uncertain environment, and adequately address relevant ethical and social issues that may arise with such technologies and use cases, as well as failure by others in our industry, or actions taken by our customers, employees, or end users (including misuse of these technologies), could negatively affect the adoption of our offerings and subject us to reputational harm, regulatory action, or litigation, which may harm our financial condition and operating results. We already are defending against a lawsuit alleging that our products and services enable discrimination, and although we believe that such claims lack merit, and the majority of the claims have been dismissed, legal proceedings can be lengthy, expensive, and disruptive to our operations and customers (particularly where, as in the present litigation, the plaintiff may seek to also litigate against certain of Workday’s customers). We may be subject to other litigation and regulatory actions that may cause financial, competitive, and developmental impacts, and could lead to legal liability. In addition, regardless of outcome, these types of claims could cause reputational harm to our brand, including our ability to sell newly acquired products that use AI. Our employees, customers, or customers’ employees who are dissatisfied with our public statements, policies, practices, or solutions related to the development and use of AI may express opinions that could introduce rep…

Excerpt shortened here; the source contains the full paragraph.

Previous wording

Developing software applications and related enhancements, features, and modifications is expensive, and the investment in product development often involves a long return on investment cycle. Accelerated application introductions and short application life cycles require high levels of expenditures that could adversely affect our operating results if not offset by revenue increases, and we believe that we must continue to dedicate a significant amount of resources to our development efforts to maintain our competitive position. However, we may not receive significant revenues from these investments for several years, if at all. If we are unable to provide new features, enhancements to user experience, and modifications in a timely and cost-effective manner that achieve market acceptance, align with customer expectations, and that keep pace with rapid technological developments and changing regulatory landscapes, it may negatively impact our customer renewal rates, limit the market for our solutions, or impair our ability to attract new customers and our business and operating results could be adversely affected. For example, AI is propelling advancements in technology, but if we fail to innovate and keep up with advancements in AI technology, if Workday AI solutions fail to operate as expected or do not meet customer expectations, or if we do not have sufficient access to development resources and the technologies required to build and improve our applications, such as the datasets required to train our AI models, our business and reputation may be harmed.

Current wording

Developing software applications and related enhancements, features, and modifications, including those involving AI, is expensive, and the investment in product development often involves a long return on investment cycle. Accelerated application introductions and short application life cycles require high levels of expenditures that could adversely affect our operating results if not offset by revenue increases, and we believe that we must continue to dedicate a significant amount of resources to our development efforts to maintain our competitive position. However, we may not receive significant revenues from these investments for several years, if at all. If we are unable to provide new features, enhancements to user experience, and modifications in a timely and cost-effective manner that achieve market acceptance, align with customer expectations, and that keep pace with rapid technological developments and changing regulatory landscapes, it may negatively impact our customer renewal rates, limit the market for our solutions, or impair our ability to attract new customers and our business and operating results could be adversely affected. For example, AI is propelling advancements in technology, but if we fail to innovate and keep up with advancements in AI technology, if Workday Illuminate solutions fail to be delivered as planned or at all, fail to operate as expected or to meet customer expectations, or if we do not have sufficient access to development resources and the technologies required to build and improve our applications, our business and reputation may be harmed.

Previous wording

We believe that developing and maintaining widespread positive awareness of our brand is critical to our growth. However, brand promotion activities may not generate the customer awareness or increased revenues we anticipate, and even if they do, any increase in revenues may not offset the significant expenses we incur in building our brand.

Current wording

We believe that developing and maintaining widespread positive awareness of our brand is critical to our growth. However, brand promotion activities may not generate the awareness or increased revenues we anticipate, and even if they do, any increase in revenues may not offset the significant expenses we incur in building our brand.

Previous wording

If we fail to successfully promote and maintain positive awareness of our brand, or we fail to expand positive awareness of our newer solutions or products, we may fail to attract or retain customers necessary to realize a sufficient return on our brand-building efforts, or to achieve the widespread positive brand awareness that is critical for broad customer adoption of our applications and for the end user experience. Any unfavorable publicity or perception of our brand or our applications could negatively impact our ability to attract and retain customers and also make it more difficult to hire and retain employees.

Current wording

If we fail to successfully promote and maintain positive awareness of our brand, or we fail to expand positive awareness of our newer solutions or products, we may fail to attract or retain customers necessary to realize a sufficient return on our brand-building efforts, or to achieve the widespread positive brand awareness that is critical for broad customer adoption of our applications and for the end user experience. We have and may continue to experience reputational harm from, among other things, the introduction of new products, features, or services that do not meet customer expectations; our use of new and evolving technologies, including AI; service outages or disruptions; issues with product quality or performance; backlash from customers, government entities, or other stakeholders that disagree with our product offering decisions or public policy, ethical, or political positions; significant litigation or regulatory actions that negatively reflect on our business practices; and data security breaches or compliance failures. Any unfavorable publicity or perception of our brand or our applications, including any unfavorable candidate or end user experience, could negatively impact our ability to attract and retain customers and also make it more difficult to hire and retain employees.

Previous wording

We depend on relationships with third-party technology and content providers and other key suppliers, and are also dependent on third parties for the license of certain software and development tools that are incorporated into or used with our applications or used to help improve our own internal systems, processes, or controls. For example, we leverage software and services for development tools and to deliver applications from many third-party suppliers including AWS and Google LLC. If the operations of these third parties are disrupted, our own operations may suffer, which could adversely impact our operating results. Additionally, if we are unsuccessful in establishing or maintaining our relationships with these third parties, or if the quality of their products or performance is inadequate, our ability to compete in the marketplace or to grow our revenues could be impaired and our operating results may suffer.

Current wording

We depend on relationships with third-party technology and content providers and other key suppliers, and are also dependent on third parties for the license of certain software and development tools that are incorporated into or used with our applications or used to help improve our own internal systems, processes, or controls. For example, we leverage software and services for development tools and to deliver applications from many third-party suppliers including AWS and Google Cloud. If the operations of these third parties are disrupted, our own operations may suffer, which could adversely impact our operating results. Additionally, if we are unsuccessful in establishing or maintaining our relationships with these third parties, or if the quality of their products or performance is inadequate, our ability to compete in the marketplace or to grow our revenues could be impaired and our operating results may suffer.

Previous wording

Our corporate headquarters are located in Pleasanton, California, and we have data centers located in the United States, Canada, and Europe. The west coast of the United States contains active earthquake zones and the southeast is subject to seasonal hurricanes or other extreme weather conditions. Additionally, we rely on internal technology systems, our website, our network, and third-party infrastructure and enterprise applications, which are located in a wide variety of regions, for our development, marketing, operational support, hosted services, and sales activities. In the event of a major earthquake, hurricane, or other natural disaster, or a catastrophic event such as fire, power loss, telecommunications failure, vandalism, civil unrest, cyber-attack, geopolitical instability, war, terrorist attack, insurrection, pandemics or other public health emergencies, or the effects of climate change (such as drought, flooding, heat waves, wildfires, increased storm severity, and sea level rise), we may be unable to continue our operations and have, and may in the future, endure system interruptions, and may experience delays in our product development, lengthy interruptions in our services, breaches of data security, and loss of critical data, all of which could cause reputational harm or otherwise have an adverse effect on our business and operating results. In addition, the impacts of climate change on the global economy and our industry are rapidly evolving. We may be subject to increased regulations, reporting requirements, standards, or stakeholder expectations regarding climate change that may impact our business, financial condition, and operating results.

Current wording

Our corporate headquarters are located in Pleasanton, California, and we have data centers and partner with public cloud service providers located in the United States and Europe. The west coast of the United States contains active earthquake zones and the southeast is subject to seasonal hurricanes or other extreme weather conditions. Additionally, we rely on internal technology systems, our website, our network, and third-party infrastructure and enterprise applications, which are located in a wide variety of regions, for our development, marketing, operational support, hosted services, and sales activities. In the event of a major earthquake, hurricane, or other natural disaster, or a catastrophic event such as fire, power loss, telecommunications failure, vandalism, civil unrest, cyber-attack, geopolitical instability, war, terrorist attack, insurrection, pandemics or other public health emergencies, or the effects of climate change (such as drought, flooding, heat waves, wildfires, increased storm severity, and sea level rise), we may be unable to continue our operations and have, and may in the future, endure system interruptions, and may experience delays in our product development, lengthy interruptions in our services, breaches of data security, and loss of critical data, all of which could cause reputational harm or otherwise have an adverse effect on our business and operating results. In addition, the impacts of climate change on the global economy and our industry are rapidly evolving. We may be subject to increased regulations, reporting requirements, standards, or stakeholder expectations regarding climate change that may impact our business, financial condition, and operating results.

Previous wording

•the ability of suppliers to meet our sustainability, diversity, and other ESG standards;

Current wording

•the ability of suppliers to meet our sustainability and other ESG standards;

Previous wording

•our ability to recruit, develop, and retain diverse talent in our labor markets;

Current wording

•our ability to recruit, develop, and retain diverse talent in our global labor markets;

Previous wording

If our ESG practices do not align with or meet evolving investor or other stakeholder expectations and standards, then our reputation, our ability to attract or retain employees, and our attractiveness as an investment, business partner, acquirer, or service provider could be negatively impacted. Further, our failure or perceived failure to pursue or fulfill our goals and objectives or to satisfy various reporting standards on a timely basis, or at all, could have similar negative impacts or expose us to government enforcement actions and private litigation.

Current wording

If our ESG practices do not align with or meet evolving investor or other stakeholder expectations and standards, then our reputation, our ability to attract or retain employees, and our attractiveness as an investment, business partner, acquirer, or service provider could be negatively impacted. For example, an increasing number of stakeholders, regulators, and lawmakers have expressed or pursued contrary views towards ESG initiatives, including the proposal or enactment of “anti-ESG” policies, legislation, executive orders, or initiatives or the issuance of related legal opinions. Conflicting regulations and a lack of harmonization of ESG legal and regulatory environments across the jurisdictions in which we operate may create enhanced compliance risks and costs. We may also face increasing scrutiny from our investors, customers, employees, and other stakeholders relating to the appropriate role of ESG practices and disclosure. Further, our failure or perceived failure to pursue or fulfill our goals and objectives or to satisfy various reporting standards on a timely basis, or at all, could have similar negative impacts or expose us to government enforcement actions and private litigation.

Previous wording

Our applications involve the storage and transmission of our customers’ and other users’ sensitive and proprietary information, including personal or identifying information regarding our customers, their employees, job candidates, customers, prospectus, and suppliers, as well as financial, accounting, health, and payroll data. Additionally, our operations and the availability of the services we provide also depend on our information technology systems. As a result, a compromise of our applications or systems, or unauthorized access to, acquisition, use, tampering, release, alteration, theft, loss, or destruction of sensitive data, or unavailability of data or our applications, has and could disrupt our operations or impact the availability or performance of our applications; expose us and our customers to regulatory obligations and enforcement actions, litigation, investigations, remediation and indemnity obligations, or supplemental disclosure obligations; damage our reputation and brand; or result in loss of customer, consumer, and partner confidence in the security of our applications, an increase in our insurance premiums, loss of authorization under the Federal Risk and Authorization Management Program (“FedRAMP”) or other authorizations, impairment to our business, and other potential liabilities or related fees, expenses, or loss of revenues.

Current wording

Our applications involve the storage and transmission of our customers’ and other users’ sensitive and proprietary information, including personal or identifying information regarding our customers, their employees, job candidates, customers, prospects, and suppliers, as well as financial, accounting, health, and payroll data. Additionally, our operations and the availability of the services we provide also depend on our information technology systems. As a result, a compromise of our applications or systems, or unauthorized access to, acquisition, use, tampering, release, alteration, theft, loss, or destruction of sensitive data, or unavailability of data or our applications, has and could disrupt our operations or impact the availability or performance of our applications; expose us and our customers to regulatory obligations and enforcement actions, litigation, investigations, remediation and indemnity obligations, or supplemental disclosure obligations; damage our reputation and brand; or result in loss of customer, consumer, and partner confidence in the security of our applications, an increase in our insurance premiums, suspension or loss of authorization under the Federal Risk and Authorization Management Program (“FedRAMP”) or other authorizations, impairment to our business, and other potential liabilities or related fees, expenses, or loss of revenues.

Previous wording

Cybersecurity threats and attacks are often targeted at companies such as ours and may take a variety of forms ranging from individuals or groups of security researchers, including those who appear to offer a solution to a vulnerability in exchange for some compensation, to sophisticated hacker organizations, including state-sponsored actors who may launch coordinated attacks, such as retaliatory cyber attacks stemming from the Russia-Ukraine conflict. In the normal course of business, we are and have been the target of malicious cyber-attack attempts and have experienced other security events. As our market presence grows, we face increased risks of cybersecurity attack or other security threats. Key cybersecurity risks range from viruses, worms, ransomware, and other malicious software programs, to phishing attacks, to exploitation of software bugs or other defects, to targeted attacks against cloud services and other hosted software, to exploitation of unmanaged software or systems, any of which can result in a compromise of our applications or systems and the data we store or process, disclosure of Workday confidential information and intellectual property, production downtimes, reputational harm, and an increase in costs to the business. As the techniques used to obtain unauthorized access or sabotage systems change frequently, are becoming increasingly sophisticated and complex, and often are not identified until they are launched against a target, and because evidence of unauthorized activity may not have been captured or retained, or may be proactively destroyed by unauthorized actors, we may be unable to anticipate these attacks, assess the true impact they may have on our business and operations, or to implement adequate preventative measures. Future cyber-attacks and other security events may have a significant or material impact on our business and operating results.

Current wording

Cybersecurity threats and attacks are often targeted at companies such as ours and may take a variety of forms ranging from individuals or groups of security researchers, including those who appear to offer a solution to a vulnerability in exchange for some compensation, and insiders, to sophisticated hacker organizations, including state-sponsored actors who may launch coordinated attacks, such as retaliatory cyber-attacks stemming from the Russia-Ukraine conflict or attacks motivated by the type of data that is processed by our customers, including our public sector customers, on our platform. In the normal course of business, we are and have been the target of malicious cyber-attack attempts and have experienced other security events. As our market presence grows, we face increased risks of cybersecurity attack or other security threats. Additionally, as AI technologies, including generative AI models, develop rapidly, threat actors are using these technologies to create sophisticated new attack methods that are increasingly automated, targeted, and coordinated and more difficult to defend against. Key cybersecurity risks range from viruses, worms, ransomware, and other malicious software programs, to phishing attacks, to fraud, to credential theft or abuse, to exploitation of software bugs or other defects, to targeted attacks against cloud services and other hosted software, to exploitation of unmanaged software or systems, any of which can result in a compromise of our applications or systems and the data we store or process, disclosure of Workday confidential information and intellectual property, production downtimes, reputational harm, and an increase in costs to the business. As the techniques used to obtain unauthorized access or sabotage systems change frequently, are becoming increasingly sophisticated and complex, and often are not identified until they are launched against a target, and because evidence of unauthorized activity may not have been captured or retained, or may be proactively destroyed by unauthorized actors, we may be unable to anticipate these attacks, assess the true impact they may have on our business and operations, or to implement adequate preventative measures. Future cyber-attacks and other security events may have a significant or material impact on our business and operating results.

Previous wording

There may also be attacks targeting any vulnerabilities in our applications, internally built infrastructure, enhancements, and updates to our existing offerings, or in the many different underlying networks and services that power the internet that our products depend on, most of which are not under our control or the control of our vendors, partners, or customers. Systems and processes designed to protect our applications, systems, software, and data, as well as customer data and other user data, and to prevent data loss and detect security breaches, may not be effective against all cybersecurity threats or perceived threats. We have been subject to such incidents, including through third-party service providers and in connection with acquisitions we have made. In addition, our software development practices have not and may not identify all potential privacy or security issues, and inadvertent disclosures of data have occurred and may occur.

Current wording

There may also continue to be attacks targeting any vulnerabilities in our applications, internally built infrastructure, enhancements, and updates to our existing offerings, or in the many different underlying networks and services that power the internet that our products depend on, most of which are not under our control or the control of our vendors, partners, or customers. Systems and processes designed to protect our applications, systems, software, and data, as well as customer data and other user data, and to prevent data loss and detect security breaches, may not be effective against all cybersecurity threats or perceived threats. We have been subject to such incidents, including through third-party service providers and in connection with acquisitions we have made. In addition, our software development practices have not and may not identify all potential privacy or security issues, and inadvertent disclosures of data have occurred and may occur again.

Previous wording

We rely on sophisticated information systems and technology, including those provided by third parties, for the secure collection, processing, transmission, storage of confidential, proprietary, and personal information, and to support our business operations and the availability of our applications. In the past several years, supply chain attacks have increased in frequency and severity. As we are both a provider and consumer of information systems and technology, we are at higher risk of being impacted either directly or indirectly by these attacks. The control systems, cybersecurity program, infrastructure, physical facilities of, and personnel associated with third parties that we rely on are beyond our control. The audits we periodically conduct of some of our third-party vendors do not guarantee the security of and may be unable to prevent security events impacting the information technology systems of third parties that are part of our supply chain or that provide valuable services to us, which have resulted and could result in the unauthorized access to data of Workday, our employees, our customers, our third-party partners, or other end users; acquisition, destruction, alteration, use, tampering, release, unavailability, theft or loss of confidential, proprietary, or personal data of Workday, our employees, our customers, our third party partners, or other end users; or the disruption of our operations and our ability to conduct our business or the availability of our applications; or could otherwise adversely affect our business, financial condition, operating results, or reputation.

Current wording

We rely on sophisticated information systems and technology, including those provided by third parties, for the secure collection, processing, transmission, and storage of confidential, proprietary, and personal information, and to support our business operations and the availability of our applications. In the past several years, supply chain attacks have increased in frequency and severity. As we are both a provider and consumer of information systems and technology, we are at higher risk of being impacted either directly or indirectly by these attacks. The control systems, cybersecurity program, infrastructure, physical facilities of, and personnel associated with third parties that we rely on or partner with are beyond our control. Our customers may authorize third-party technology providers to access their customer data and any unauthorized use of the third-party technology may result in unauthorized access to such data. The audits we periodically conduct of some of our third-party vendors do not guarantee the security of and may be unable to prevent security events impacting the information technology systems of third parties that are part of our supply chain or that provide valuable services to us, which have resulted and could result in the unauthorized access to data of Workday, our employees, our customers, our third-party partners, or other end users; acquisition, destruction, alteration, use, tampering, release, unavailability, theft or loss of confidential, proprietary, or personal data of Workday, our employees, our customers, our third party partners, or other end users; or the disruption of our operations and our ability to conduct our business or the availability of our applications; or could otherwise adversely affect our business, financial condition, operating results, or reputation.

Previous wording

Legal requirements related to collecting, storing, handling, and transferring personal data are rapidly evolving at both the national and international level in ways that require our business to adapt to support customer compliance. As the regulatory focus on privacy intensifies worldwide, and jurisdictions increasingly consider and adopt privacy laws, the potential risks related to managing personal data by our business may grow. In addition, possible adverse interpretations of existing privacy-related laws and regulations by governments in countries where our customers operate, as well as the potential implementation of new legislation, could impose significant obligations in areas affecting our business or prevent us from offering certain services in jurisdictions where we operate.

Current wording

Legal requirements related to collecting, storing, handling, retaining, and transferring (collectively, “processing”) personal data are rapidly evolving at both the national and international level in ways that require our business to adapt to support customer compliance. As the complexity of our products grow, the regulatory focus on privacy intensifies worldwide, and jurisdictions increasingly consider and adopt privacy laws, the risks related to processing personal data by our business also grow. In addition, possible adverse interpretations of existing privacy-related laws and regulations by governments in countries where our customers operate, as well as the potential implementation of new legislation, could impose significant obligations in areas affecting our business or prevent us from offering certain services in jurisdictions where we operate.

Previous wording

Following the European Union’s (“EU”) passage of the General Data Protection Regulation (“GDPR”), which became effective in May 2018, the global data privacy compliance landscape has grown increasingly complex, fragmented, and financially relevant to business operations. As a result, our business faces current and prospective risks related to increased regulatory compliance costs, government enforcement actions and/or financial penalties for non-compliance, and reputational harm. For example, a new EU-U.S. Data Privacy Framework (“DPF”) is in place under which EU data can legally be transferred to the United States. However, it is expected to face legal challenges. Until challenges to the DPF make their way through the court system, uncertainty may continue about the legal requirements for transferring customer personal data to and from Europe, an integral process of our business that remains governed by, and subject to, GDPR requirements. Failure to comply with the GDPR data processing requirements by either ourselves or our subcontractors could lead to regulatory enforcement actions, which can result in monetary penalties of up to 4% of worldwide revenue, private lawsuits, reputational damage, and loss of customers. Other countries such as Russia, China, and India have also passed laws imposing varying degrees of restrictive data residency requirements. Regulatory developments in the United States present additional risks. For example, the California Consumer Privacy Act (“CCPA”) took effect on January 1, 2020, and the California Privacy Rights Act (“CPRA”), which expands upon the CCPA, came into effect on January 1, 2023. The CCPA and CPRA give California consumers, including employees, certain rights similar to those provided by the GDPR, and also provide for statutory damages or fines on a per violation basis that could be very large depending on the severity of the violation. Numerous states have enacted, or are considering, privacy laws as well, creating a patchwork of state laws that may create compliance challenges. Furthermore, the U.S. Congress is considering numerous privacy bills, and the U.S. Federal Trade Commission continues to fine companies for unfair or deceptive data protection practices and may undertake its own privacy rulemaking exercise. In addition to government activity, privacy advocacy and other industry groups have established or may establish various new, additional, or different self-regulatory standards that customers may require us to adhere to and which may place additional burdens on us. Increasing sensitivity of individuals to unauthorized processing of personal data, whether real or perceived, and an increasingly uncertain trust climate has and may continue to create a negative public reaction to technologies, products, and services such as ours or otherwise expose us to liability.

Current wording

Following the EU’s passage of the General Data Protection Regulation (“GDPR”), which became effective in May 2018, the global data privacy compliance landscape has grown increasingly complex, fragmented, and financially relevant to business operations. As a result, our data processing creates current and prospective risks related to increased regulatory compliance costs, government enforcement actions and/or financial penalties for non-compliance, and reputational harm. For example, a new EU-U.S. Data Privacy Framework (“DPF”) is in place under which EU data can legally be transferred to the United States. However, it is expected to face legal challenges. Until challenges to the DPF make their way through the court system, uncertainty may continue about the legal requirements for transferring customer personal data to and from Europe, an integral process of our business that remains governed by, and subject to, GDPR requirements. Failure to comply with the GDPR data processing requirements by either ourselves or our subcontractors could lead to regulatory enforcement actions, which can result in monetary penalties of up to 4% of worldwide revenue, private lawsuits, reputational damage, and loss of customers. Other countries such as Russia, China, and India have also passed laws imposing varying degrees of restrictive data residency requirements. Regulatory developments in the United States present additional risks. For example, the California Consumer Privacy Act (“CCPA”) took effect on January 1, 2020, and the California Privacy Rights Act (“CPRA”), which expands upon the CCPA, came into effect on January 1, 2023. The CCPA and CPRA give California consumers, including employees, certain rights similar to those provided by the GDPR, and also provide for statutory damages or fines on a per violation basis that could be very large depending on the severity of the violation. Numerous states have enacted, or are considering, privacy laws as well, creating a patchwork of state laws that may create compliance challenges. Furthermore, the U.S. Congress is considering numerous privacy bills, and the U.S. Federal Trade Commission continues to fine companies for unfair or deceptive data protection practices and may undertake its own privacy rulemaking exercise. In addition to government activity, privacy advocacy and other industry groups have established or may establish various new, additional, or different self-regulatory standards that customers may require us to adhere to and which may place additional burdens on us. Increasing sensitivity of individuals to unauthorized processing of personal data, whether real or perceived, and an increasingly uncertain trust climate has and may continue to create a negative public reaction to technologies, products, and services such as ours or otherwise expose us to liability.

Previous wording

Taken together, the costs of compliance with and other obligations imposed by data protection laws and regulations may require modification of our services, limit use and adoption of our services, reduce overall demand for our services, lead to significant fines, penalties, or liabilities for noncompliance, or slow the pace at which we close sales transactions, or otherwise cause us to modify our operations, any of which could harm our business. The perception of privacy concerns, whether or not valid, may inhibit the adoption, effectiveness, or use of our applications or otherwise impact our business. Compliance with applicable laws and regulations regarding personal data may require changes in services, business practices, or internal systems that result in increased costs, lower revenue, reduced efficiency, or greater difficulty competing with foreign-based firms which could adversely affect our business and operating results.

Current wording

Taken together, the costs of compliance with and other obligations imposed by data protection laws and regulations may require modification of our services, limit use and adoption of our services, reduce overall demand for our services, lead to significant fines, penalties, or liabilities for noncompliance, or slow the pace at which we close sales transactions, or otherwise cause us to modify our operations, any of which could harm our business. The data protection laws set forth requirements impacting how personal data must be stored, accessed, and deleted within the products. The perception of privacy concerns, whether or not valid, may inhibit the adoption, effectiveness, or use of our applications or otherwise impact our business. Compliance with applicable laws and regulations regarding personal data may require changes in services, business practices, or internal systems that result in increased costs, lower revenue, reduced efficiency, or greater difficulty competing with foreign-based firms which could adversely affect our business and operating results.

Previous wording

Some of our applications utilize open source software, and any failure to comply with the terms of one or more of these open source licenses could negatively affect our business.

Current wording

Our applications utilize open source software, and any failure to comply with the terms of one or more of these open source licenses could negatively affect our business.

Previous wording

Some of our applications include software covered by open source licenses, which may include, by way of example, GNU General Public License and the Apache License. The terms of various open source licenses have not been interpreted by United States courts, and there is a risk that such licenses could be construed in a manner that imposes unanticipated conditions or restrictions on our ability to market our applications. We attempt to avoid adverse licensing conditions in our use of open source software in our products and services. By the terms of certain open source licenses, we could be required to release the source code of our proprietary software, and to make our proprietary software available under open source licenses, if we combine our proprietary software with open source software in a certain manner. In the event that portions of our proprietary software are determined to be impacted by an open source license, we could be required to publicly release the affected portions of our source code, re-engineer all or a portion of our technologies, or otherwise be limited in the licensing of our technologies, each of which could reduce or eliminate the value of our technologies and services. In addition, the open source license terms for future versions of open source software that we use might change, requiring us to pay for a commercial license or re-engineer all or a portion of our technologies. In addition to risks related to license requirements, usage of open source software can lead to greater risks than use of third-party commercial software, as open source licensors generally do not provide warranties or controls on the origin of the software. Many of the risks associated with usage of open source software cannot be eliminated and could negatively affect our business.

Current wording

Our applications include software covered by open source licenses, which may include, by way of example, GNU General Public License and the Apache License. Few terms used in open source licenses have been interpreted by United States courts, and there is a risk that such licenses could be construed in a manner that imposes unanticipated conditions or restrictions on our ability to market our applications. We attempt to comply with all open source licensing conditions that apply to our use of open source software. By the terms of certain open source licenses, we could be required to release the source code of our proprietary software, and to make our proprietary software available under open source licenses, if we combine our proprietary software with open source software in a certain manner. In the event that portions of our proprietary software are determined to be impacted by an open source license, we could be required to publicly release portions of our source code, re-engineer all or a portion of our technologies, or otherwise be limited in the use or licensing of our technologies, which could reduce or eliminate the value of our technologies, products, and services. In addition, the license terms for certain previously open source software that we use have changed and the license terms for future versions of open source software that we use might change, requiring us to pay for a commercial license or re-engineer all or a portion of our technologies. In addition to risks related to open source license requirements, usage of open source software can lead to greater risks than use of third-party commercial software, as open source licensors generally do not provide warranties or controls on the origin of the software. Many of the risks associated with usage of open source software cannot be eliminated and could negatively affect our business.

Previous wording

Unfavorable laws, regulations, interpretive positions, or standards governing new and evolving technologies that we incorporate into our products and services could result in significant cost and compliance challenges and adversely affect our business and operating results.

Current wording

Unfavorable laws, regulations, interpretive positions, or standards governing new and evolving technologies that we incorporate into our products and services, including those involving AI uses, could result in significant cost and compliance challenges and adversely affect our business and operating results.

Previous wording

Some of our products and services, such as Workday’s People Experience, Talent Optimization, and Financial product suites, currently utilize or will utilize new and evolving technologies such as AI. The overall regulatory environment governing these types of technologies is likely to evolve as government interest in these technologies increases. Regulation of these technologies, as well as other technologies that we utilize in our products and services, also varies greatly among international, federal, state, and local jurisdictions and is subject to significant uncertainty. Governments and agencies domestic and abroad may in the future change or amend existing laws, or adopt new laws, regulations, or guidance, or take other actions which may severely impact the permitted uses of our technologies. Any failure by us to comply with applicable laws, regulations, guidance, or other rules could result in costly litigation, penalties, or fines. In addition, these regulations and any related enforcement actions could establish and further expand our obligations to customers, individuals, and other third parties with respect to our products and services, limit the countries in which such products and services may be used, restrict the way we structure and operate our business, require us to divert development and other resources, and reduce the types of customers and individuals who can use our products and services. Furthermore, our customers may operate in foreign jurisdictions, including countries in which we don’t operate, and may be subject to additional laws and regulations outside the scope of our products. Increased regulation and oversight of products or services which utilize or rely on these technologies may result in costly compliance burdens or otherwise increase our operating costs, detrimentally affecting our business. These new technologies could subject us to additional litigation brought by private parties, which could be costly, time-consuming, and distracting to management and could result in substantial expenses and losses.

Current wording

Any failure by us to comply with applicable laws, regulations, guidance, or other rules could result in costly litigation, penalties, or fines. In addition, these regulations and any related enforcement actions could establish and further expand our obligations to customers, individuals, and other third parties with respect to our products and services, limit the countries in which such products and services may be used, restrict the way we structure and operate our business, require us to divert development and other resources, and reduce the types of customers and individuals who can use our products and services. Furthermore, our customers may operate in foreign jurisdictions, including countries in which we don’t operate, and may be subject to additional laws and regulations outside the scope of our products. Increased regulation and oversight of products or services which utilize or rely on these technologies may result in costly compliance burdens or otherwise increase our operating costs, detrimentally affecting our business. These new technologies could subject us to additional litigation brought by private parties, which could be costly, time-consuming, and distracting to management and could result in substantial expenses and losses.

Previous wording

Our contracts with federal, state, local, and foreign government entities are subject to various procurement regulations and other requirements relating to their formation, administration, performance, and termination, which could adversely impact our business and operating results. Government certification requirements applicable to our platform, including FedRAMP, may change and, in doing so, restrict our ability to sell into the governmental sector until we have attained the full or revised certification. These laws and regulations provide public sector customers various rights, many of which are not typically found in commercial contracts. For instance, the process of evaluating potential conflicts of interest and developing necessary provisions and contract clauses, where needed, may delay or prevent Workday from being awarded certain U.S. federal government contracts.

Current wording

Our contracts with federal, state, local, and foreign government entities are subject to various procurement regulations and other requirements relating to their formation, administration, and performance, which could adversely impact our business and operating results. Government certification requirements applicable to our platform may change and, in doing so, restrict our ability to sell into the governmental sector until we have attained the authorization to use or certification. These laws and regulations provide public sector customers with various rights, many of which are not typically found in commercial contracts. For example, some federal contracts provide for delays, interruptions, or termination by the government at any time, with or without cause, which can adversely affect our business and operating results and impact other existing or prospective government contracts.

Previous wording

Additionally, we have obtained authorization under FedRAMP, which allows us to enter into the U.S. federal government market. Such certification is subject to rigorous compliance and if we lose our certification, it could inhibit or preclude our ability to contract with certain U.S. federal government customers. In addition, some customers may rely on our authorization under FedRAMP to help satisfy their own legal and regulatory compliance requirements and our failure to maintain FedRAMP authorization would result in a breach under public sector contracts obtained on the basis of such authorization. This could subject us to liability, result in reputational harm, and adversely impact our financial condition or operating results.

Current wording

Additionally, we have obtained authorization under FedRAMP, which allows us to participate in the U.S. federal government market. Such authorization is subject to rigorous compliance and if we were to lose our authorization, it could inhibit or preclude our ability to contract with certain U.S. federal government customers. In addition, some customers may rely on our authorization under FedRAMP to help satisfy their own legal and regulatory compliance requirements. If we fail to maintain FedRAMP authorization, we may fail to retain existing customers or attract new customers that rely on our authorization under FedRAMP, which could subject us to liability, result in reputational harm, and adversely impact our financial condition or operating results.