Workday, Inc.

Previous wording

We have experienced, and may in the future experience, defects, system disruptions, outages, and other performance problems, including the failure of our applications to perform properly. These problems may be caused by a variety of factors, including infrastructure and software or code changes, vendor issues, software and system defects, human error, viruses, worms, security attacks (internal and external), fraud, spikes in customer usage, and denial of service issues. All of these issues may result in increased operational costs, delays in new feature rollouts, customer loss, reputational damage, and legal or regulatory liability, including liability under customer contracts.

Current wording

We have experienced, and may in the future experience, defects, system disruptions, outages, and other performance problems, including the failure of our applications to perform properly. These problems may be caused by a variety of factors, including infrastructure and software or code changes, vendor issues, software and system defects, human error, viruses, worms, security attacks (internal and external), fraud, spikes in customer usage, and denial of service issues. For example, in July 2025, we identified an issue impacting reporting from high-volume data sources in the tenants of certain customers that may have yielded incomplete queries without displaying an error message. We have notified impacted customers and remediated the issue. All of these issues may result in increased operational costs, delays in new feature rollouts, customer loss, reputational damage, and legal or regulatory liability, including liability under customer contracts.

Previous wording

We operate on a global scale, and as a result, our business and revenues are impacted by global economic and geopolitical conditions. Global economic developments, including increased tariffs, geopolitical volatilities, downturns or recessions, political instability, and global health crises may negatively affect us or our ability to accurately forecast and plan our future business activity. In addition, volatile economic and geopolitical situations have led and could lead to further economic disruption. Any sustained adverse impacts from these and other recent macroeconomic events could materially and adversely affect our business, financial condition, operating results, and earnings guidance that we may issue from time to time, which could have a material effect on the value of our Class A common stock.

Current wording

We operate on a global scale, and as a result, our business and revenues are impacted by global economic and geopolitical conditions. Global economic developments, including new or increased tariffs, geopolitical volatilities, downturns or recessions, political instability, and global health crises may negatively affect us or our ability to accurately forecast and plan our future business activity. In addition, volatile economic and geopolitical situations have led and could lead to further economic disruption. Any sustained adverse impacts from these and other recent macroeconomic events could materially and adversely affect our business, financial condition, operating results, and earnings guidance that we may issue from time to time, which could have a material effect on the value of our Class A common stock.

Previous wording

Our future revenues rely on continued demand by existing customers and the acquisition of new customers who may be subject to economic hardship due to recent macroeconomic events, including concerns about the impact of tariffs, inflation or the interest rate environment, and may delay or reduce their enterprise software spending to preserve capital and liquidity. In connection with recent macroeconomic events, we have experienced and may continue to experience delays in purchasing decisions from existing and prospective customers, increased demand for price concessions and delayed payment terms, and a reduction in customer demand. Our business, financial condition, and operating results may be negatively impacted in future periods due to the prolonged impacts of recent macroeconomic events, which may not be fully reflected in our operating results and overall financial performance until future periods.

Current wording

Our future revenues rely on continued demand by existing customers and the acquisition of new customers who may be subject to economic hardship due to recent macroeconomic events, including concerns about the impact of potential or imposed tariffs, inflation or the interest rate environment, and may delay or reduce their enterprise software spending to preserve capital and liquidity. In connection with recent macroeconomic events, we have experienced and may continue to experience delays in purchasing decisions from existing and prospective customers, increased demand for price concessions and delayed payment terms, and a reduction in customer demand. Our business, financial condition, and operating results may be negatively impacted in future periods due to the prolonged impacts of recent macroeconomic events, which may not be fully reflected in our operating results and overall financial performance until future periods.

Previous wording

In February 2025, we announced the Fiscal 2026 Restructuring Plan, which is intended to prioritize our investments and continue advancing our ongoing focus on durable growth, and has resulted in the reduction of approximately 7.5% of our workforce. We expect this plan to be substantially complete by the second quarter of fiscal 2026, subject to local law and consultation requirements. The Fiscal 2026 Restructuring Plan could negatively impact our ability to attract, retain, and motivate employees.

Current wording

In February 2025, we announced the Fiscal 2026 Restructuring Plan, which was intended to prioritize our investments and continue advancing our ongoing focus on durable growth. The plan resulted in the reduction of approximately 7.5% of our workforce and could negatively impact our ability to attract, retain, and motivate employees.

Previous wording

We must also continue to retain, develop, and motivate existing employees through our compensation practices, company culture, and career development opportunities. Further, our current and future office environments and our current hybrid work policy may not meet the expectations of our employees or prospective employees, and may amplify challenges in recruiting and retention. We believe that a critical component of our success has been our corporate culture and our core values. As we continue to grow and change, we may find it difficult to maintain our corporate culture among a larger number of employees who are dispersed throughout various geographic regions, including managing the complexities of communicating with all employees. Efforts to restructure our workforce, such as the Fiscal 2026 Restructuring Plan, may be disruptive and adversely impact employee morale or our corporate culture. Failure to maintain or adapt our culture could negatively affect our ability to attract new employees or to retain our current employees and our business and future growth prospects could be adversely affected.

Current wording

We must also continue to retain, develop, and motivate existing employees through our compensation practices, company culture, and career development opportunities. Further, our current and future office environments and our current hybrid work policy may not meet the expectations of our employees or prospective employees, and may amplify challenges in recruiting and retention. We believe that a critical component of our success has been our corporate culture and our core values. As we continue to grow and change, we may find it difficult to maintain our corporate culture among a larger number of employees who are dispersed throughout various geographic regions, including difficulties due to managing the complexities of communicating with all employees. Efforts to restructure our workforce, such as the Fiscal 2026 Restructuring Plan, may be disruptive and adversely impact employee morale or our corporate culture. Failure to maintain or adapt our culture could negatively affect our ability to attract new employees or to retain our current employees and our business and future growth prospects could be adversely affected.

Previous wording

Our primary competitors are Oracle and SAP, well-established providers of financial management and HCM applications, which have long-standing relationships with customers and partners. Some customers may be hesitant to switch vendors or to adopt cloud applications such as ours and may prefer to maintain their existing relationships with competitors. We also face competition from other enterprise software vendors, from regional competitors that only operate in certain geographic markets, and from vendors of specific applications that address only one or a portion of our applications, some of which offer cloud-based or AI-powered solutions. These vendors include, without limitation: Anaplan, Inc., ADP, Coupa Software Inc., Dayforce, Inc., Infor, Inc., Microsoft Corporation, ServiceNow, and UKG Inc. In order to take advantage of customer demand for cloud and AI-powered applications, legacy vendors are expanding their cloud or AI-powered applications through acquisitions, strategic alliances, and organic development. In addition, other cloud or AI platform companies that provide services in different target markets or industries may develop applications or acquire companies that operate in our target markets or industries, and some potential customers may elect to develop their own internal applications. As the market matures and as existing and new market participants introduce new types of technologies, such as generative and agentic AI, and different approaches that enable organizations to address their HCM and financial needs, we expect this competition to intensify in the future.

Current wording

Our primary competitors are Oracle and SAP, well-established providers of financial management and HCM applications, which have long-standing relationships with customers and partners. Some customers may be hesitant to switch vendors or to adopt cloud applications such as ours and may prefer to maintain their existing relationships with competitors. We also face competition from other enterprise software vendors, from regional competitors that only operate in certain geographic markets, and from vendors of specific applications that address only one or a portion of our applications, some of which offer cloud-based or AI-powered solutions. These vendors include, without limitation: Anaplan, Inc., Automatic Data Processing, Inc., Coupa Software Inc., Dayforce, Inc., Infor, Inc., Microsoft Corporation, ServiceNow, Inc., and UKG Inc. In order to take advantage of customer demand for cloud and AI-powered applications, legacy vendors are expanding their cloud or AI-powered applications through acquisitions, strategic alliances, and organic development. In addition, other cloud or AI platform companies that provide services in different target markets or industries may develop applications or acquire companies that operate in our target markets or industries, and some potential customers may elect to develop their own internal applications. As the market evolves and as existing and new market participants introduce new types of technologies, such as generative and agentic AI, and different approaches that enable organizations to address their HCM and financial needs, we expect this competition to intensify in the future.

Previous wording

•restrictive governmental actions focused on cross-border trade, such as import and export restrictions, duties, quotas, tariffs, trade disputes, and barriers or sanctions, that may prevent us from offering certain portions of our products or services to a particular market, may increase our operating costs or may subject us to monetary fines or penalties;

Current wording

•restrictive governmental actions focused on cross-border trade, such as import and export restrictions, duties, quotas, potential or imposed tariffs, trade disputes, and barriers or sanctions, as well as any retaliatory actions, that may prevent us from offering certain portions of our products or services to a particular market, may increase our operating costs, or may subject us to monetary fines or penalties;

Previous wording

•increased compliance costs related to government regulatory reviews or audits, including those related to international cybersecurity and environmental, social, and governance (“ESG”) requirements;

Current wording

•increased compliance costs related to government regulatory reviews or audits, including those related to international cybersecurity and sustainability requirements;

Previous wording

Our customers have no obligation to renew their subscriptions for our applications after the expiration of either the initial or renewed subscription period. Our customers’ renewal rates fluctuate as a result of a number of factors, including their level of satisfaction with our applications and pricing, their awareness and adoption of the benefits and features of our applications, their ability to continue their operations and spending levels, reductions in their headcount, and the evolution of their business. If our customers do not renew their subscriptions for our applications on similar pricing terms or renew for fewer elements of our applications or for a lower headcount, our revenues may decline, and we may not be able to meet our revenue projections, which could negatively impact our business and the market price of our Class A common stock.

Current wording

Our customers have no obligation to renew their subscriptions for our applications after the expiration of either the initial or renewed subscription period. Our customers’ renewal rates fluctuate as a result of a number of factors, including their level of satisfaction with our applications and pricing, their awareness and adoption of the benefits and features of our applications, their ability to continue their operations and spending levels, reductions in their headcount, the evolution of their business, and the macroeconomic environment. If our customers do not renew their subscriptions for our applications on similar pricing terms or renew for fewer elements of our applications or for a lower headcount, our revenues may decline, and we may not be able to meet our revenue projections, which could negatively impact our business and the market price of our Class A common stock.

Previous wording

We are increasingly building AI into the Workday product suite and have recently made announcements about our plans to embrace agentic AI. As with many cutting-edge innovations, these technologies can present new risks and challenges. A quickly evolving technical, legal, and regulatory environment may cause us to incur increased research and development costs, or divert resources from other development efforts, to address ethical, legal, operational, or compliance requirements or other issues related to AI. For example, the European Union’s (“EU”) AI Act (“EU AI Act”) puts new requirements on providers of AI technologies and we are currently analyzing the EU AI Act to ensure compliance in alignment with corresponding deadlines. Additionally, existing laws and regulations may apply to us in new ways, the nature and extent of which are difficult to predict and subject to change over time. The risks and challenges presented by these technologies could undermine public confidence in AI, which could slow its adoption and affect our business. Many of our products are powered by AI, some of which include the use of large language models and generative and agentic AI, for use cases that could potentially impact human, civil, privacy, or employment rights and dignities. To the extent that our products and technologies rely on the use of large language models or agentic capabilities provided by third parties, we may face additional uncertainties and liabilities. Any failure to accurately identify and address our responsibilities and liabilities in this uncertain environment, and adequately address relevant ethical and social issues that may arise with such technologies and use cases, as well as failure by others in our industry, or actions taken by our customers, employees, or end users (including misuse of these technologies), could negatively affect the adoption of our offerings and subject us to reputational harm, regulatory action, or litigation, which may harm our financial condition and operating results. We are currently defending against a lawsuit alleging that our products and services enable discrimination, and although we believe that such claims lack merit, and the majority of the claims have been dismissed, legal proceedings can be lengthy, expensive, and disruptive to our operations and customers (particularly where, as in the present litigation, the plaintiff may seek to also litigate against certain of Workday’s customers). We may be subject to other litigation and regulatory actions that may cause financial, competitive, and developmental impacts, and could lead to legal liability. In addition, regardless of outcome, these types of claims could cause reputational harm to our brand, including our ability to sell newly acquired products that use AI. Our employees, customers, or customers’ employees who are dissatisfied with our public statements, policies, practices, or solutions related to the development and use of AI may express opinions …

Excerpt shortened here; the source contains the full paragraph.

Current wording

We are increasingly building AI into the Workday product suite, including generative and agentic AI, and we are increasingly using AI products and technologies in the course of running our business at Workday. As with many cutting-edge innovations, these technologies can present new risks and challenges. A quickly evolving technical, legal, and regulatory environment may cause us to incur increased research and development costs, or divert resources from other development efforts, to address ethical, legal, operational, or compliance requirements or other issues related to AI. For example, the European Union’s (“EU”) AI Act (“EU AI Act”) puts new requirements on providers and deployers of AI technologies and we are currently working to ensure compliance with corresponding deadlines. Additionally, existing laws and regulations may apply to us in new ways, the nature and extent of which are difficult to predict and subject to change over time. The risks and challenges presented by these technologies could undermine public confidence in AI, which could slow its adoption and affect our business. Many of our products are powered by AI, some of which include the use of large language models and generative and agentic AI, for use cases that could potentially impact human, civil, privacy, or employment rights and dignities. To the extent that the products and technologies we develop and utilize rely on the use of large language models or agentic capabilities provided by third parties, we face additional uncertainties and liabilities. Any failure to accurately identify and address our responsibilities and liabilities in this uncertain environment, and to adequately address relevant ethical and social issues that may arise with such technologies and use cases, as well as failure by others in our industry or actions taken by our customers, employees, or end users (including misuse of these technologies), could negatively affect the adoption of our offerings and subject us to reputational harm, regulatory action, or litigation, which may harm our financial condition and operating results. We are currently defending against a lawsuit alleging that our products and services enable discrimination, and although we believe that such claims lack merit, and the majority of the claims have been dismissed, legal proceedings can be lengthy, expensive, and disruptive to our operations and customers (particularly where, as in the present litigation, the plaintiff may seek to also litigate against certain of Workday’s customers). We may be subject to other litigation and regulatory actions that may cause financial, competitive, and developmental impacts, and could lead to legal liability. Regardless of outcome, these types of claims have and could continue to cause reputational harm to our brand, including our ability to sell newly acquired products that use AI. Our employees, customers, or customers’ employees who are dissatisfied with our public statements, policies, p…

Excerpt shortened here; the source contains the full paragraph.

Previous wording

If we are not able to realize a return on our current development efforts or offer new features, enhancements, and modifications to our services that are desired by current or potential customers, our business and operating results could be adversely affected.

Current wording

If we are not able to realize a return on our current development efforts or offer new features, enhancements, and modifications to our products and services that are desired by current or potential customers, our business and operating results could be adversely affected.

Previous wording

Developing software applications and related enhancements, features, and modifications, including those involving AI or other emerging technologies, is expensive, and the investment in product development often involves a long return on investment cycle. We believe that we must continue to dedicate a significant amount of resources to our development efforts to maintain our competitive position. Accelerated application introductions and short application life cycles require high levels of expenditures that could adversely affect our operating results if not offset by revenue increases. However, we may not receive significant revenues from these investments for several years, if at all. If we are unable to provide new features, enhancements to user experience, and modifications in a timely and cost-effective manner that achieve market acceptance, align with customer expectations, and that keep pace with rapid technological developments and changing regulatory landscapes, it may negatively impact our customer renewal rates, limit the market for our solutions, or impair our ability to attract new customers and our business and operating results could be adversely affected. For example, AI is propelling advancements in technology, but if we fail to innovate and keep up with advancements in AI technology, if Workday’s AI-powered solutions, including our current and planned agentic AI solutions, fail to be delivered as planned or at all, fail to operate as expected or to meet customer expectations, or if we do not have sufficient access to development resources and the technologies required to build and improve our applications, our business and reputation may be harmed.

Current wording

Developing software applications and related enhancements, features, and modifications, including those involving AI, including generative and agentic AI or other emerging technologies, is expensive, and the investment in product development often involves a long return on investment cycle. We believe that we must continue to dedicate a significant amount of resources to our development efforts to maintain our competitive position. Accelerated application introductions and short application life cycles require high levels of expenditures that could adversely affect our operating results if not offset by revenue increases. However, we may not receive significant revenues from these investments for several years, if at all. If we are unable to provide new features, enhancements to user experience, and modifications in a timely and cost-effective manner that achieve market acceptance, align with customer expectations, and that keep pace with rapid technological developments and changing regulatory landscapes, it may negatively impact our customer renewal rates, limit the market for our solutions, or impair our ability to attract new customers and our business and operating results could be adversely affected. For example, AI is propelling advancements in technology, but if we fail to innovate and keep up with advancements in AI technology, if Workday’s AI-powered solutions, including our current and planned agentic AI solutions, fail to be delivered as planned or at all, fail to operate as expected or to meet customer expectations, if we fail to successfully monetize our AI-powered solutions, or if we do not have sufficient access to development resources and the technologies required to build and improve our applications, our business and reputation may be harmed.

Previous wording

We depend on relationships with third-party technology and content providers and other key suppliers, and are also dependent on third parties for the license of certain software and development tools that are incorporated into or used with our applications or used to help improve our own internal systems, processes, or controls. For example, we leverage software and services for development tools and to deliver applications from many third-party suppliers including Amazon Web Services (“AWS”) and Google Cloud. If the operations of these third parties are disrupted, our own operations may suffer, which could adversely impact our operating results. Additionally, if we are unsuccessful in establishing or maintaining our relationships with these third parties, or if the quality of their products or performance is inadequate, our ability to compete in the marketplace or to grow our revenues could be impaired and our operating results may suffer.

Current wording

We depend on relationships with third-party technology and content providers and other key suppliers, and are also dependent on third parties for the license of certain software and development tools that are incorporated into or used with our applications or used to help improve our own internal systems, processes, or controls. For example, we leverage software and services for development tools and to deliver applications from many third-party suppliers including Amazon Web Services and Google Cloud. If the operations of these third parties are disrupted, our own operations may suffer, which could adversely impact our operating results. Additionally, if we are unsuccessful in establishing or maintaining our relationships with these third parties, or if the quality of their products or performance is inadequate, our ability to compete in the marketplace or to grow our revenues could be impaired and our operating results may suffer.

Previous wording

These impacts may continue through integration activities. Moreover, we may be unable to complete proposed transactions timely or at all due to a failure to obtain any necessary funding to complete an acquisition in a timely manner or on favorable terms, the failure to obtain required regulatory or other approvals, litigation, or other disputes, which may obligate us to pay a termination fee. We also may not achieve the anticipated benefits from an acquisition due to a number of factors, including:

Current wording

These impacts may continue through integration activities. Moreover, we may be unable to complete proposed transactions timely or at all for a variety of reasons, such as our failure to obtain any necessary funding, the failure to obtain required regulatory or other approvals, or the impact of litigation or other disputes. We also may not achieve the anticipated benefits from an acquisition due to a number of factors, including:

Previous wording

Our aspirations and disclosures related to ESG matters expose us to risks that could adversely affect our reputation and performance.

Current wording

Our disclosures related to corporate responsibility and sustainability-related matters expose us to risks that could adversely affect our reputation and performance.

Previous wording

The positions we take on ESG matters, human capital management initiatives, and ethical issues from time to time may impact our brand, reputation, or ability to attract or retain customers. In particular, our brand and reputation are associated with our public commitments to environmental sustainability (including our science-based targets), strong corporate governance practices, equality, inclusivity, and ethical use, and any perceived changes in our dedication to these commitments could impact our relationships with potential and current customers, employees, stockholders, and other stakeholders. These commitments reflect our current plans and aspirations and are not guarantees that we will be able to achieve them. Our failure to accomplish or accurately track and report on these goals on a timely basis, or at all, could adversely affect our reputation, financial performance, and growth, and expose us to increased scrutiny from the investment community as well as enforcement authorities.

Current wording

The positions we take on corporate responsibility and sustainability-related matters, human capital management initiatives, and ethical issues from time to time may impact our brand, reputation, or ability to attract or retain customers. In particular, our brand and reputation are associated with our public commitments to environmental sustainability (including our science-based targets), strong corporate governance practices, equality, inclusivity, and ethical use, and any perceived changes in our dedication to these commitments could impact our relationships with potential and current customers, employees, stockholders, and other stakeholders. These commitments reflect our current plans and aspirations and are not guarantees that we will be able to achieve them. Our failure to accomplish or accurately track and report on these goals on a timely basis, or at all, could adversely affect our reputation, financial performance, and growth, and expose us to increased scrutiny from the investment community as well as enforcement authorities.

Previous wording

Our ability to achieve any ESG objective is subject to numerous risks, many of which are outside of our control. Examples of such risks include:

Current wording

Our ability to achieve any sustainability-related objective is subject to numerous risks, many of which are outside of our control. Examples of such risks include:

Previous wording

•the evolving regulatory requirements affecting ESG standards or disclosures;

Current wording

•the evolving regulatory requirements affecting sustainability standards or disclosures;

Previous wording

•the ability of suppliers to meet our sustainability and other ESG standards;

Current wording

•the ability of suppliers to meet our sustainability and other related standards;

Previous wording

Standards for tracking and reporting ESG matters continue to evolve. In addition, our processes and controls may not always comply with evolving standards for identifying, measuring, and reporting ESG metrics, including ESG-related disclosures that may be required by the SEC or other regulatory bodies, and such standards have and may continue to change over time, which could result in significant revisions to our current goals, reported progress in achieving such goals, or ability to achieve such goals in the future. It is likely that increasing regulatory requirements and regulatory scrutiny related to ESG matters will continue to expand globally and result in higher associated compliance costs. Further, we may rely on data and calculations provided by third parties to measure and report our ESG metrics and if the data input or calculations are incorrect or incomplete, our brand, reputation, and financial performance may be adversely affected.

Current wording

Standards for tracking and reporting sustainability matters continue to evolve. In addition, our processes and controls may not always comply with evolving standards for identifying, measuring, and reporting sustainability metrics, including sustainability-related disclosures that may be required by various regulatory bodies, and such standards have and may continue to change over time, which could result in significant revisions to our current goals, reported progress in achieving such goals, or ability to achieve such goals in the future. It is likely that increasing regulatory requirements and regulatory scrutiny related to sustainability-related matters will continue to expand globally and result in higher associated compliance costs. Further, we may rely on data and calculations provided by third parties to measure and report our sustainability metrics and if the data input or calculations are incorrect or incomplete, our brand, reputation, and financial performance may be adversely affected.

Previous wording

If our ESG practices do not align with or meet evolving investor or other stakeholder expectations and standards, then our reputation, our ability to attract or retain employees, and our attractiveness as an investment, business partner, acquirer, or service provider could be negatively impacted. For example, an increasing number of stakeholders, regulators, and lawmakers have expressed or pursued contrary views towards ESG initiatives, including the proposal or enactment of “anti-ESG” policies, legislation, executive orders, or initiatives or the issuance of related legal opinions. Conflicting laws, regulations, and executive orders and a lack of harmonization of ESG legal and regulatory environments across the jurisdictions in which we operate may create enhanced compliance risks and costs. We may also face increasing scrutiny from our investors, customers, employees, and other stakeholders relating to the appropriate role of ESG practices and disclosure. Further, our failure or perceived failure to pursue or fulfill our goals and objectives or to satisfy various reporting standards on a timely basis, or at all, could have similar negative impacts or expose us to government enforcement actions and private litigation.

Current wording

If our sustainability or other corporate responsibility practices do not align with or meet evolving investor or other stakeholder expectations and standards, then our reputation, our ability to attract or retain employees, and our attractiveness as an investment, business partner, acquirer, or service provider could be negatively impacted. For example, an increasing number of stakeholders, regulators, and lawmakers have expressed or pursued contrary views towards sustainability initiatives, including the proposal or enactment of anti-environmental, social, and governance policies, legislation, executive orders, or initiatives or the issuance of related legal opinions. Conflicting laws, regulations, and executive orders and a lack of harmonization of legal and regulatory environments and stakeholder expectations across the jurisdictions in which we operate may create enhanced compliance risks and costs. We may also face increasing scrutiny from our investors, customers, employees, and other stakeholders relating to the appropriate role of sustainability and corporate responsibility practices and disclosure. Further, our failure or perceived failure to pursue or fulfill our goals and objectives or to satisfy various reporting standards on a timely basis, or at all, could have similar negative impacts or expose us to government enforcement actions and private litigation.

Previous wording

Cybersecurity threats and attacks are often targeted at companies such as ours and may take a variety of forms ranging from individuals or groups of security researchers, including those who appear to offer a solution to a vulnerability in exchange for some compensation, and insiders, to sophisticated hacker organizations, including state-sponsored actors who may launch coordinated attacks, such as retaliatory cyber-attacks stemming from the Russia-Ukraine conflict or attacks motivated by the type of data that is processed by our customers, including our public sector customers, on our platform. In the normal course of business, we are and have been the target of malicious cyber-attack attempts and have experienced other security events. As our market presence grows, we face increased risks of cybersecurity attack or other security threats. Additionally, as AI technologies, including generative AI models, develop rapidly, threat actors are using these technologies to create sophisticated new attack methods that are increasingly automated, targeted, and coordinated and more difficult to defend against. Key cybersecurity risks range from viruses, worms, ransomware, and other malicious software programs, to phishing attacks, to fraud, to credential theft or abuse, to exploitation of software bugs or other defects, to targeted attacks against cloud services and other hosted software, to exploitation of unmanaged software or systems, any of which can result in a compromise of our applications or systems and the data we store or process, disclosure of Workday confidential information and intellectual property, production downtimes, reputational harm, and an increase in costs to the business. As the techniques used to obtain unauthorized access or sabotage systems change frequently, are becoming increasingly sophisticated and complex, and often are not identified until they are launched against a target, and because evidence of unauthorized activity may not have been captured or retained, or may be proactively destroyed by unauthorized actors, we may be unable to anticipate these attacks, assess the true impact they may have on our business and operations, or to implement adequate preventative measures. Future cyber-attacks and other security events may have a significant or material impact on our business and operating results.

Current wording

Cybersecurity threats and attacks are often targeted at companies such as ours and may take a variety of forms ranging from individuals or groups of security researchers, including those who appear to offer a solution to a vulnerability in exchange for some compensation, and insiders, to sophisticated hacker organizations, including state-sponsored actors who may launch coordinated attacks, such as retaliatory cyber-attacks stemming from the Russia-Ukraine conflict or attacks motivated by the type of data that is processed by our customers, including our public sector customers, on our platform. In the normal course of business, we are and have been the target of malicious cyber-attack attempts and have experienced other security events. As our market presence grows, we face increased risks of cybersecurity attack or other security threats. Additionally, as AI technologies, including generative AI models, develop rapidly, threat actors are using these technologies to create sophisticated new attack methods that are increasingly automated, targeted, and coordinated and more difficult to defend against. Key cybersecurity risks range from viruses, worms, ransomware, and other malicious software programs, to social engineering attacks, to fraud, to credential theft or abuse, to exploitation of software bugs or other defects, to targeted attacks against cloud services and other hosted software, to exploitation of unmanaged software or systems, any of which can result in a compromise of our applications or systems and the data we store or process, and can result in disclosure of Workday confidential information and intellectual property, production downtimes, reputational harm, and an increase in costs to the business. For example, we recently were targeted as part of a social engineering campaign against many large organizations, resulting in unauthorized access to some commonly available business contact information in our third-party customer relationship management platform. As the techniques used to obtain unauthorized access or sabotage systems change frequently, are becoming increasingly sophisticated and complex, and often are not identified until they are launched against a target, and because evidence of unauthorized activity may not have been captured or retained, or may be proactively destroyed by unauthorized actors, we may be unable to anticipate these attacks, assess the true impact they may have on our business and operations, or to implement adequate preventative measures. Any cyber-attacks and other security events may have a significant or material impact on our business and operating results.

Previous wording

Privacy concerns, evolving regulation of cloud computing, cross-border data transfer, and other domestic or foreign laws and regulations may reduce the adoption of our applications, result in significant costs and compliance challenges, and adversely affect our business and operating results.

Current wording

Privacy concerns, evolving regulation of cloud computing, cross-border data transfer, and other domestic or foreign laws and regulations, including those that seek to regulate access to data, may reduce the adoption of our applications, result in significant costs and compliance challenges, and adversely affect our business and operating results.

Previous wording

Following the EU’s passage of the General Data Protection Regulation (“GDPR”), which became effective in May 2018, the global data privacy compliance landscape has grown increasingly complex, fragmented, and financially relevant to business operations. As a result, our data processing creates current and prospective risks related to increased regulatory compliance costs, government enforcement actions and/or financial penalties for non-compliance, and reputational harm. For example, the EU-U.S. Data Privacy Framework (“DPF”) is in place under which EU data can legally be transferred to the United States. However, it is facing legal challenges. Until challenges to the DPF make their way through the court system, uncertainty may continue about the legal requirements for transferring customer personal data to and from Europe, an integral process of our business that remains governed by, and subject to, GDPR requirements. Failure to comply with the GDPR data processing requirements by either ourselves or our subcontractors could lead to regulatory enforcement actions, which can result in monetary penalties of up to 4% of worldwide revenue, private lawsuits, reputational damage, and loss of customers. Other countries such as Russia, China, and India have also passed laws imposing varying degrees of restrictive data residency requirements. Regulatory developments in the United States present additional risks. For example, the California Consumer Privacy Act (“CCPA”) took effect on January 1, 2020, and the California Privacy Rights Act (“CPRA”), which expands upon the CCPA, came into effect on January 1, 2023. The CCPA and CPRA give California consumers, including employees, certain rights similar to those provided by the GDPR, and also provide for statutory damages or fines on a per violation basis that could be very large depending on the severity of the violation. Numerous states have enacted, or are considering, privacy laws as well, creating a patchwork of state laws that may create compliance challenges. Furthermore, the U.S. Congress is considering numerous privacy bills, and the U.S. Federal Trade Commission continues to fine companies for unfair or deceptive data protection practices and may undertake its own privacy rulemaking exercise. In addition, the U.S. Department of Justice issued its final rule on the Bulk Transfer of Sensitive U.S. Personal and Government Data to Countries and Persons of Concern. In addition to government activity, privacy advocacy and other industry groups have established or may establish various new, additional, or different self-regulatory standards that customers may require us to adhere to and which may place additional burdens on us. Increasing sensitivity of individuals to unauthorized processing of personal data, whether real or perceived, and an increasingly uncertain trust climate has and may continue to create a negative public reaction to technologies, products, and services such as ours or otherwise expos…

Excerpt shortened here; the source contains the full paragraph.

Current wording

Following the EU’s passage of the General Data Protection Regulation (“GDPR”), which became effective in May 2018, the global data privacy compliance landscape has grown increasingly complex, fragmented, and financially relevant to business operations. As a result, our data processing creates current and prospective risks related to increased regulatory compliance costs, government enforcement actions and/or financial penalties for non-compliance, and reputational harm. For example, the EU-U.S. Data Privacy Framework (“DPF”) is in place under which EU data can legally be transferred to the United States. However, it is facing legal challenges. Until challenges to the DPF make their way through the court system, uncertainty may continue about the legal requirements for transferring customer personal data to and from Europe, an integral process of our business that remains governed by, and subject to, GDPR requirements. Failure to comply with the GDPR data processing requirements by either ourselves or our subcontractors could lead to regulatory enforcement actions, which can result in monetary penalties of up to 4% of worldwide revenue, private lawsuits, reputational damage, and loss of customers. Other countries such as Russia, China, and India have also passed laws imposing varying degrees of restrictive data residency requirements. Regulatory developments in the United States present additional risks. For example, the California Consumer Privacy Act (“CCPA”) took effect on January 1, 2020, and the California Privacy Rights Act (“CPRA”), which expands upon the CCPA, came into effect on January 1, 2023. The CCPA and CPRA give California consumers, including employees, certain rights similar to those provided by the GDPR, and also provide for statutory damages or fines on a per violation basis that could be very large depending on the severity of the violation. Numerous states have enacted, or are considering, privacy laws as well, creating a patchwork of state laws that may create compliance challenges.

Previous wording

For example, the technologies underlying AI and its uses are subject to a variety of laws and regulations, including those governing intellectual property, privacy, data protection, cybersecurity, consumer protection, competition, and equal opportunity, and are expected to be subject to new laws and regulations or new applications of existing laws and regulations. AI is the subject of ongoing review by various U.S. governmental and regulatory agencies, and various U.S. states and other foreign jurisdictions are applying, or are considering applying, their cybersecurity, data protection, and product safety laws to AI and its uses or are considering general legal frameworks for AI and its uses, such as the EU AI Act.

Current wording

For example, the technologies underlying AI and its uses are subject to a variety of laws and regulations, including those governing intellectual property, privacy, data protection, cybersecurity, consumer protection, competition, and equal opportunity, and are expected to be subject to new laws and regulations or new applications of existing laws and regulations. AI is the subject of ongoing review by various U.S. and international governmental and regulatory agencies, and various U.S. states and other foreign jurisdictions are applying, or are considering applying, their cybersecurity, data protection, and product safety laws to AI and its uses or are considering general legal frameworks for AI and its uses, such as the EU AI Act.

Previous wording

We are regularly involved with claims, suits, purported class or representative actions, and may be involved in regulatory and government investigations and other proceedings, involving competition, intellectual property, data security and privacy, bankruptcy, tax and related compliance, labor and employment, commercial disputes, and other matters. Such claims, suits, actions, regulatory and government investigations, and other proceedings can impose a significant burden on management and employees, could prevent us from offering one or more of our applications, services, or features to others, could require us to change our technology or business practices, or could result in monetary damages, fines, civil or criminal penalties, reputational harm, or other adverse consequences. Adverse outcomes in some or all of these claims may result in significant monetary damages or injunctive relief that could adversely affect our ability to conduct our business. The litigation and other claims are subject to inherent uncertainties and management’s view of these matters may change in the future. A material adverse impact in our consolidated financial statements could occur for the period in which the effect of an unfavorable outcome becomes probable and reasonably estimable.

Current wording

We are regularly involved with claims, suits, purported class or representative actions, and may be involved in regulatory and government investigations and other proceedings, involving competition, intellectual property, data security and privacy, bankruptcy, tax and related compliance, labor and employment, commercial disputes, and other matters. Such claims, suits, actions, regulatory and government investigations, and other proceedings can impose a significant burden on management and employees, could prevent us from offering one or more of our applications, services, or features to others, could require us to change our technology or business practices, or could result in monetary damages, fines, civil or criminal penalties, and have and could continue to cause reputational harm or other adverse consequences. Adverse outcomes in some or all of these claims may result in significant monetary damages or injunctive relief that could adversely affect our ability to conduct our business. The litigation and other claims are subject to inherent uncertainties and management’s view of these matters may change in the future. A material adverse impact in our consolidated financial statements could occur for the period in which the effect of an unfavorable outcome becomes probable and reasonably estimable.

Previous wording

Our contracts with federal, state, local, and foreign government entities are subject to various procurement regulations and other requirements relating to their formation, administration, and performance, which present certain risks and challenges not present in private commercial agreements, including varying governmental budgeting processes, changes in governmental administrations and policies, fluctuations due to government spending cuts and shutdowns, highly competitive and lengthy bidding process, and adherence to complex regulatory requirements and executive orders, and could adversely impact our business and operating results. Further, we have experienced and may in the future experience challenges by third parties to previously awarded contracts with government entities. Government certification requirements applicable to our platform may change and, in doing so, restrict our ability to sell into the governmental sector until we have attained the authorization to use or received a certification. These laws and regulations provide public sector customers with various rights, many of which are not typically found in commercial contracts. For example, some federal contracts provide for delays, interruptions, or termination by the government at any time, with or without cause, which can adversely affect our business and operating results and impact other existing or prospective government contracts.

Current wording

Our contracts with federal, state, local, and foreign government entities are subject to various procurement regulations and other requirements relating to their formation, administration, and performance, which present certain risks and challenges not present in private commercial agreements, including varying governmental budgeting processes, contracting policies and requirements, changes in governmental administrations and policies, fluctuations due to government spending cuts and shutdowns, highly competitive and lengthy bidding process, and adherence to complex regulatory requirements and executive orders, and could adversely impact our business and operating results. Further, we have experienced and may in the future experience challenges by third parties to contracts awarded with government entities. Government certification requirements applicable to our platform may change and, in doing so, restrict our ability to sell into the governmental sector until we have attained the authorization to use or received a certification. These laws and regulations provide public sector customers with various rights, many of which are not typically found in commercial contracts. For example, some federal contracts provide for delays, interruptions, or termination by the government at any time, with or without cause, which can adversely affect our business and operating results and impact other existing or prospective government contracts.

Previous wording

We operate and are subject to taxes in the United States and numerous other jurisdictions throughout the world. Changes to federal, state, local, or international tax laws on income, sales, use, indirect, or other tax laws, statutes, rules, regulations, or ordinances on multinational corporations are currently being considered by the United States and other countries where we do business. These contemplated legislative initiatives include, but are not limited to, changes to transfer pricing policies and definitional changes to permanent establishment that could be applied solely or disproportionately to services provided over the internet. These contemplated tax initiatives, if finalized and adopted by countries, may ultimately impact our effective tax rate and could adversely affect our sales activity resulting in a negative impact on our operating results and cash flows.

Current wording

We operate and are subject to taxes in the United States and numerous other jurisdictions throughout the world. Changes to federal, state, local, or international tax laws on income, sales, use, indirect, or other tax laws, statutes, rules, regulations, or ordinances on multinational corporations have recently been enacted or are currently being considered by the United States and other countries where we do business. Contemplated legislative initiatives include, but are not limited to, changes to transfer pricing policies and definitional changes to permanent establishment that could be applied solely or disproportionately to services provided over the internet. These contemplated tax initiatives, if finalized and adopted by countries, may ultimately impact our effective tax rate and could adversely affect our sales activity resulting in a negative impact on our operating results and cash flows.

Previous wording

(1)In August 2024, our Board of Directors authorized the August 2024 Share Repurchase Program, under which we may repurchase up to $1.0 billion of our outstanding shares of Class A common stock. For further information, see Note 13, Stockholders’ Equity, of the Notes to Condensed Consolidated Financial Statements included in Part I, Item 1 of this report.

Current wording

(1)In August 2024, our Board of Directors authorized the August 2024 Share Repurchase Program, under which we may repurchase up to $1.0 billion of our outstanding shares of Class A common stock, and in May 2025, our Board of Directors authorized the May 2025 Share Repurchase Program, under which we may repurchase up to an additional $1.0 billion of our outstanding shares of Class A common stock. For further information, see Note 13, Stockholders’ Equity, of the Notes to Condensed Consolidated Financial Statements included in Part I, Item 1 of this report.