ServiceNow, Inc.

Previous wording

•A failure to innovate in response to rapidly evolving technological changes and in the midst of an intensely competitive market may harm our competitive position and business prospects.

Current wording

•A failure to innovate and adapt how we offer our products in response to rapidly evolving technological changes and in the midst of an intensely competitive market may harm our competitive position and business prospects.

Previous wording

•Our customer deals are becoming more complex, which tend to involve longer and more expensive sales cycles, increased pricing pressure and implementation and configuration challenges.

Current wording

•Our customer deals are becoming more complex, which tend to involve longer, more expensive sales cycles, increased pricing pressure, and implementation and configuration challenges.

Previous wording

•Delays in improving our information systems and processes could interfere with our ability to support our existing and growing customer and employee base as we scale.

Current wording

•Delays in improving our information systems and processes could interfere with our ability to support our existing and growing base of customers and employees as we scale.

Previous wording

•We may not be able to protect or enforce our intellectual property rights.

Current wording

•We may not be able to protect or enforce our IP rights.

Previous wording

•Our failure or perceived failure to achieve our ESG goals or maintain ESG practices that meet evolving stakeholder expectations could adversely affect us.

Current wording

•Our failure or perceived failure to achieve our corporate sustainability goals or maintain corporate sustainability practices that meet evolving stakeholder expectations could adversely affect us.

Previous wording

•Because we generally recognize revenues from our subscription service over the subscription term, a decrease in new subscriptions or renewals may not be immediately reflected in our operating results.

Current wording

•Because we generally recognize revenues from our subscription services over the subscription term, a decrease in new subscriptions or renewals may not be immediately reflected in our operating results.

Previous wording

Governments have adopted, and likely will continue to adopt, laws and regulations affecting the use, storage and movement of data, including laws related to data privacy and security, the use of machine learning and artificial intelligence (“AI”), and data sovereignty or residency requirements. Changing laws, regulations and standards applying to the collection, storage, use, sharing, portability, transfer or other control or processing of data, including personal data, could affect our ability to efficiently and cost-effectively offer our services and to develop our products and services for maximum utility, as well as our customers’ ability to use data or share data. Such changes may restrict our ability to use, store or otherwise process customer data in connection with providing services and could alter or increase our compliance requirements. In some cases, this could impact our ability to offer our services in certain locations or our customers’ ability to deploy our services globally. For example, the EU Data Act has significant requirements regarding data portability, interoperability and accessibility and unclear data transfer restrictions, any of which could impact our operations. In addition, the relatively new Trans-Atlantic Data Privacy Framework, which facilitates the transfer of data between the United States (“U.S.”) and European Union (“EU”), may be subject to legal challenges and regulatory interpretations that could create uncertainties and impact our operations and compliance obligations.

Current wording

to use, store or otherwise process customer data in connection with providing services and could alter or increase our compliance requirements. In some cases, this could impact our ability to offer our services in certain locations or our customers’ ability to deploy our services globally. For example, the EU Data Act has data portability, interoperability and accessibility requirements, as well as unclear data transfer restrictions that could impact our operations. In addition, the Trans-Atlantic Data Privacy Framework, which facilitates the transfer of data between the United States (“U.S.”) and European Union (“EU”), may be subject to legal challenges and regulatory interpretations that could create uncertainties and impact our operations and compliance obligations.

Previous wording

We offer region-specific services, by which customer data is hosted locally and customers may elect to receive support from locally-based ServiceNow teams. Setting up and maintaining these region-specific services require significant investment, including to comply with applicable laws and regulations. Actual or perceived non-compliance with those laws and regulations could result in proceedings or investigations against us by regulatory authorities or others, lead to significant fines, damages, orders, litigation or reputational harm and may otherwise adversely impact our business.

Current wording

We offer some region-specific services where customer data is hosted locally and customers may elect to receive support from locally-based ServiceNow teams. Setting up and maintaining these region-specific services require significant investment, including to comply with applicable laws and regulations. Actual or perceived non-compliance with those laws, regulations, or the terms of our region-specific service offerings may result in investigations or proceedings against us by regulatory authorities or others, significant fines or damages, orders, litigation, reputational harm and other adverse impacts on our business.

Previous wording

We will also need to continually adapt to customer privacy and security requirements as they change over time. For example, as customers increasingly adopt a hybrid (on-premises and off-premises/hyperscale cloud) approach for their IT workloads, our cloud services may fail to address evolving customer requirements, including data localization. Further, due to heightened concerns relating to privacy and security regulatory matters, our customers may request certain certifications and failure to obtain, or consistently maintain, those certifications may adversely impact our reputation and business.

Current wording

We will also need to continually adapt to customer privacy and security requirements as they change over time. For example, as customers increasingly adopt a hybrid (on-premises and off-premises/hyperscale cloud) approach for their IT workloads, our cloud services may fail to address evolving customer requirements, including data localization. Further, due to heightened concerns relating to privacy and security regulatory matters, our customers from time to time request certain certifications, and a failure to obtain or consistently maintain those certifications may adversely impact our reputation and business.

Previous wording

A failure to innovate in response to rapidly evolving technological changes and in the midst of an intensely competitive market may harm our competitive position and business prospects.

Current wording

A failure to innovate and adapt how we offer our products in response to rapidly evolving technological changes and in the midst of an intensely competitive market may harm our competitive position and business prospects.

Previous wording

We compete in markets that evolve rapidly. The pace of innovation will continue to accelerate as customers recognize the advantages of acquiring leading digital technologies and adopting modern cloud-based infrastructure. Cutting-edge capabilities such as AI, machine learning, hyper automation, low-code/no-code application development, system observability and predictive insights become increasingly relevant to the customer’s evolving needs. With this rapid evolution, we are increasingly competing with alternative solutions and approaches to solve customer needs, and we expect additional competition as we shift our products and services to compete with providers in new and adjacent markets.

Current wording

We compete in markets that evolve rapidly. The pace of innovation will continue to accelerate as customers recognize the advantages of acquiring leading digital technologies and adopting AI native solutions and modern cloud-based infrastructure. Cutting-edge capabilities such as AI, machine learning, hyper automation, low-code/no-code application development, system observability and predictive insights become increasingly relevant to the customer’s evolving needs. With this rapid evolution, we are increasingly competing with alternative solutions and approaches to solve customer needs, and we expect additional competition as we shift our products and services to compete with providers in new and adjacent markets.

Previous wording

Competitors, regardless of their size, may be able to respond more quickly and effectively to new or changing opportunities, technologies, standards, customer requirements and buying practices. They may introduce new technology, solve similar problems in different ways or more effectively utilize existing technology that reduces demand for our services. They may utilize acquisitions, integrations or consolidations to offer integrated or bundled products, enhanced functionality or other advantages. Some of our existing competitors and potential competitors are larger and have greater name recognition, the ability to more efficiently scale their business, more established operations and customer relationships, and greater financial and technical resources than we do. “Systems of record” operators may attempt to create technology solutions or other mechanisms that would prevent our systems from integrating with theirs. They may create pricing pressures by reducing the price of competing products, services or subscriptions or bundling their offerings causing our offerings to appear relatively more expensive. Competition from cloud-based vendors may increase as they build business applications or AI powered automation solutions that compete with our products and services. We may also encounter customer reluctance or unwillingness to migrate away from their current solutions.

Current wording

Competitors, regardless of their size, may be able to respond more quickly and effectively to new or changing opportunities, technologies, standards, customer requirements and buying practices. They may introduce new technology, solve similar problems in different ways or more effectively utilize existing technology that reduces demand for our services. They may utilize acquisitions, integrations or consolidations to offer integrated or bundled products, enhanced functionality or other advantages. Some of our existing competitors and potential competitors are larger and have greater name recognition, the ability to more efficiently scale their business, more established operations and customer relationships and greater financial and technical resources than we do. “Systems of record” operators may attempt to create technology solutions or other mechanisms that would prevent our systems from integrating with theirs. They may create pricing pressures by reducing the price of competing products, services or subscriptions or bundling their offerings, causing our offerings to appear relatively more expensive. Companies whose products are integrated with our Platform could also seek to compete with us by blocking, limiting or imposing fees on particular integrations or data access. Cloud-based and AI native vendors may build more business applications or AI powered automation solutions that compete with our products and services. We may also encounter customer reluctance or unwillingness to migrate away from their current solutions.

Previous wording

•invest in and continually optimize our own technology platform so that we continue to meet the very high-performance expectations of our customers;

Current wording

•invest in and continually optimize our own technology platform so that we continue to meet the high-performance expectations of our customers;

Previous wording

•successfully deliver and promote new, scalable technologies and products to meet customer needs and priorities;

Current wording

•successfully deliver and promote new, scalable technologies and products, such as AI, to meet customer needs and priorities;

Previous wording

Sales outside of North America represented 37% and 36% of our total revenues for the years ended December 31, 2024 and 2023, respectively. The growth of our business depends on our ability to increase our sales outside of the U.S. as a percentage of our total revenues. Additionally, operating in international markets requires significant investment and management attention and subjects us to varying regulatory, political and economic risks. We have made, and will continue to make, substantial investments in data centers, geographic-specific service delivery models, advisory councils, cloud computing infrastructure, sales, marketing, partnership arrangements, personnel and facilities in new geographic markets. When we make these investments, it is typically unclear when we will see a return on our investment, and we may significantly underestimate the level of investment and time required to be successful. Our rate of acquisition of new large enterprise customers, a factor affecting our growth, has been generally lower in territories where we are less established and where there may be heightened or evolving regulations and operational and IP risks. We have experienced, and may continue to experience, difficulties in new geographic markets, including hiring qualified sales management personnel, penetrating the target market, and managing local operations. Risks associated with making our products and services available in international markets include, for example:

Current wording

Sales outside of North America represented 37% of our total revenues for each of the years ended December 31, 2025 and 2024. The growth of our business depends on our ability to increase our sales outside of the U.S. as a percentage of our total revenues. Additionally, operating in international markets requires significant investment and management attention and subjects us to varying regulatory, political and economic risks. We have made, and will continue to make, substantial investments in data centers, geographic-specific service delivery models, advisory councils, cloud computing infrastructure, sales, marketing, partnership arrangements, personnel and facilities in new geographic markets. When we make these investments, it is typically unclear when we will see a return on our investment, and we may significantly underestimate the level of investment and time required to be successful. Our rate of acquisition of new large enterprise customers, a factor affecting our growth, has been generally lower in territories where we are less established and where there may be heightened or evolving regulations and operational and IP risks. We have experienced and may continue to experience difficulties in new geographic markets, including hiring qualified sales management personnel, penetrating the target market and

Previous wording

•compliance with multiple, conflicting and changing governmental laws and regulations;

Current wording

•compliance with multiple, conflicting and changing governmental laws and regulations, including antitrust and competition regulations;

Previous wording

•potential changes in international trade policies, tariffs, agreements and practices, including the adoption and expansion of formal or informal trade restrictions or regulatory frameworks that may favor local competitors;

Current wording

•potential changes in international trade policies, tariffs, agreements and practices, including the adoption and expansion of formal or informal trade restrictions or regulatory frameworks that may favor local companies;

Previous wording

•governmental direction, business practices and/or cultural norms that may favor local competitors;

Current wording

•governmental direction, business practices and/or cultural norms that may favor local companies;

Previous wording

•more prevalent cybersecurity, intellectual property and AI risks; and

Current wording

•more prevalent cybersecurity, IP and AI risks; and

Previous wording

We are increasingly innovating and expanding offerings on our platform by integrating AI technology. We expect AI to be an increasingly important driver of future growth, although, like many innovations, it presents risks and uncertainties that may impact our ability to realize its desired or anticipated benefits for our business.

Current wording

We are increasingly innovating and expanding offerings on our platform by integrating AI technology into our customer-facing products and internal operations. We consider AI to be an important driver of future growth, although, like many innovations, it presents risks and uncertainties that may impact our ability to realize its desired or anticipated benefits for our business.

Previous wording

AI technology is rapidly evolving and to remain competitive, we will need to make significant investments to continue to successfully develop and incorporate the technology into our products. Our ability to incorporate AI technology into our products depends on the availability and pricing of third-party hardware and software equipment and technical infrastructure. Our competitors or other third parties may develop or incorporate AI into their products more quickly or successfully than us. Other companies may also have or in the future may obtain intellectual proprietary rights that would prevent, limit, or interfere with our ability to make, use, or sell our AI products. For these reasons, among others, we may not be able to compete effectively in the evolving AI market.

Current wording

AI technology is evolving quickly. To remain competitive, we must make significant investments to continue to successfully develop and incorporate this technology into our products. Our ability to incorporate AI technology into our products depends on the availability, performance and pricing of third-party hardware and software equipment and technical infrastructure. Our competitors or other third parties may develop or incorporate AI into their products more quickly or successfully than us. They may also have or in the future obtain IP rights that would prevent, limit or interfere with our ability to make, use or sell our AI products. For these reasons, among others, we may not be able to compete effectively in the evolving AI market.

Previous wording

Our business model may be affected by global trends and laws that govern the use of AI and machine learning. For example, the EU AI Act places new requirements on providers of AI technologies that will need to be addressed in alignment with various deadlines in the coming years. These and other laws or regulations may cause us to modify our data handling and compliance practices, which could be costly or disruptive to our operations, and may also impact our ability to use certain data to support our products or our product development efforts or hinder our customers’ ability to adopt or continue to use our products.

Current wording

Our business model may be affected by global trends and laws that govern the use of AI. For example, the EU AI Act places new requirements on providers of AI technologies that will need to be addressed in alignment with various deadlines. These and other laws or regulations or enforcement practices may cause us to modify our data handling and compliance practices, which could be costly or disruptive to our operations, and may also impact our ability to use certain data to support our products or our product development efforts or hinder our customers’ ability to adopt or continue to use our products.

Previous wording

We may face new or heightened legal, ethical and other challenges arising out of the perceived or actual impact of AI on human rights, intellectual property, privacy and employment, among other areas. For example, our use of AI could lead to copyright infringement or other intellectual property claims, potentially requiring us to pay compensation or licensing fees to third parties. Additionally, social and ethical concerns surrounding the use of AI in our offerings could harm our brand and may cause us to incur additional costs. Failure by us or others in our industry to adequately address these concerns could erode public confidence in AI and slow adoption of AI in our products.

Current wording

We may face new or heightened legal, ethical and other challenges arising out of the perceived or actual impact of AI on human rights, IP, privacy, security, employment and the environment, among other areas. For example, our use of AI, both internally and in our customer-facing products, could lead to copyright infringement claims or other IP claims, potentially requiring us to pay compensation or licensing fees to third parties. Additionally, social and ethical concerns surrounding the use of AI in our offerings could harm our brand and may cause us to incur additional costs. AI systems may not perform as intended or may produce outcomes, such as unreliable or biased results, that could negatively affect customer trust, result in limited adoption of our AI enabled products, expose us to reputational harm or create potential liability. Failure by us or others in our industry to adequately address these concerns could erode public confidence in AI and slow adoption of AI in our products.

Previous wording

An increasing portion of our revenues is generated by sales through our network of partners, including resellers, distributors and managed service providers. Increasingly, we and our customers rely on our partners to provide professional services, including custom implementations, and there may be insufficient qualified implementation partners available to meet customer demand. While we provide our partners with training and programs, including accreditations and certifications, these programs may not be effective or utilized consistently by partners. In addition, new partners may require extensive training and/or significant time and resources to become productive. Additionally, our relationships with partners may require us, along with our partners, to comply with complex regulations, contractual requirements and government procurement rules. Failure to adhere to these requirements could result in the loss of business opportunities, potential liabilities or penalties. For example, our partners could misrepresent to our customers the functionality of our platform or products, fail to perform services to our customers’ expectations, or violate laws or our corporate policies. Further, changes to our direct go-to-market models may cause friction with our partners. Our partners may also use our platform to develop products and services that compete with our products and services, which could raise IP ownership concerns and strain these partnerships. If we fail to effectively manage and grow our network of partners, our ability to sell our products and efficiently provide our services may be impacted and our business may be harmed.

Current wording

An increasing portion of our revenues is generated by sales through our network of partners, including resellers, distributors and managed service providers. Increasingly, we and our customers rely on our partners to provide professional services, including custom implementations, and there may be insufficient qualified implementation partners available to meet customer demand. While we provide our partners with training and programs, including accreditations and certifications, these programs may not be effective or utilized consistently by partners. New partners may also require extensive training and/or significant time and resources to become productive. Separately, our relationships with partners may require us, along with our partners, to comply with complex regulations, contractual requirements and government procurement rules. Failure to adhere to these requirements could result in the loss of business opportunities, potential liabilities or penalties. For example, our partners could misrepresent to our customers the functionality of our platform or products, fail to perform services that meet our customers’ expectations, or violate laws or our corporate policies. Further, changes to our direct go-to-market models may cause friction with our partners. Our partners may also use our platform to develop products and services that compete with our products and services, which could raise IP ownership concerns and strain these partnerships. If we fail to effectively manage and grow our network of partners, our ability to sell our products and efficiently provide our services may be impacted and our business may be harmed.

Previous wording

Our customers also include non-U.S. governments, to which government procurement risks similar to those present in U.S. government contracting and regulatory compliance also apply, particularly in certain emerging markets where our customer base is less established. Across the globe, we have seen political volatility increase, with rapid changes in governments and increased partisanship affecting many aspects of government, including the ability to approve budgets and make commitments. This can significantly delay or impair a government’s ability to contract for software and services such as ours. We have also seen challenges to successful awards through bid protest procedures in jurisdictions outside the U.S. As our non-U.S. government business grows, we may see an increase in bid protests as part of the standard government procurement legal procedures that exist in many jurisdictions. In addition, compliance with complex regulations and contracting provisions in a variety of jurisdictions can be expensive and consume significant management resources. In certain jurisdictions, our ability to win business may be constrained by political and other factors unrelated to our competitive position in the market.

Current wording

Our customers also include non-U.S. governments, to which government procurement risks similar to those present in U.S. government contracting and regulatory compliance also apply, particularly in certain emerging markets where our customer base is less established. Across the globe, we have seen political volatility increase, with rapid changes in governments and increased partisanship affecting many aspects of government, including the ability to approve budgets and make commitments. This can significantly delay or impair a government’s ability to contract for software and services such as ours. We have also seen challenges to successful awards through bid protest procedures in jurisdictions outside the U.S. As our non-U.S. government business grows, we may see an increase in bid protests as part of the standard government procurement legal procedures that exist in many jurisdictions. In addition, compliance with complex regulations and contracting provisions in a variety of jurisdictions can be expensive and consume significant management resources. In certain jurisdictions, our ability to win business may be constrained by political and other factors unrelated to our market offerings.

Previous wording

Our public sector customers may have contractual, statutory or regulatory rights to terminate current contracts with us or our third-party distributors or resellers for convenience or due to a default, though such risk may be assumed by such third-party distributor or reseller. If a contract is terminated for convenience, we may only be able to collect fees for products or services delivered prior to termination and settlement expenses. If a contract is terminated due to a default, we may be liable for excess costs incurred by the customer for procuring alternative products or services or be precluded from doing further business with governmental entities. Further, we are required to comply with a variety of complex laws, regulations, and contractual provisions relating to the formation, administration, or performance of government contracts that give public sector customers substantial rights and remedies, many of which are not typically found in commercial contracts. These may also include rights with respect to price protection, refund and setoff, performance of services in languages other than English, the accuracy of information provided to the government, contractor compliance with supplier diversity policies, constraints on sales practices and other obligations that are particular to government contracts. These obligations may apply to us and/or our third-party resellers or distributors whose practices we may not control. Such parties’ non-compliance could create legal, contractual and customer satisfaction issues.

Current wording

assumed by such third-party distributor or reseller. If a contract is terminated for convenience, we may only be able to collect fees for products or services delivered prior to termination and settlement expenses. If a contract is terminated due to a default, we may be liable for excess costs incurred by the customer for procuring alternative products or services. In addition, we could be precluded from doing further business with governmental entities. Further, we are required to comply with a variety of complex laws, regulations and contractual provisions relating to the formation, administration or performance of government contracts that give public sector customers substantial rights and remedies, many of which are not typically found in commercial contracts. These laws, regulations and contractual provisions may encompass rights with respect to price protection, refund and setoff, the provision of services in languages other than English, the accuracy of information provided to the government, contractor compliance with supplier diversity policies, constraints on certain business and sales practices, and other obligations that are particular to government contracts. These obligations may apply to us and/or our third-party resellers or distributors whose practices we may not control. Such parties’ non-compliance could create legal, contractual and customer satisfaction issues.

Previous wording

We and governments routinely investigate and audit compliance with contractual and regulatory requirements. For example, as disclosed in Note 17 in the notes to our consolidated financial statements, the Company informed certain U.S. government agencies of an internal investigation and preliminary findings and is cooperating with, among others, the Department of Justice, which commenced its own investigation into the matters. If it is determined that we or our third-party distributors, resellers or service providers have failed to comply with applicable contractual or regulatory requirements, we may be subject to civil and criminal penalties and administrative sanctions, including termination of contracts, forfeiture of profits, cost associated with the triggering of price reduction clauses, fines, and suspensions or debarment from future government business, among others, all of which may adversely affect our business. In the United States, our federal business has been concentrated with a small number of third-party distributors, resellers or service providers. If one of those third parties is limited in its ability to do business with the government due to a regulatory or legal issue arising from their own conduct and we are not able to move our business to another third party, our business could be negatively impacted.

Current wording

We and governments routinely investigate and audit compliance with contractual and regulatory requirements. For example, as disclosed in Note 18 “Commitments and Contingencies” in the notes to our consolidated financial statements, the Company informed certain U.S. government agencies of an internal investigation and preliminary findings and is cooperating with, among others, the Department of Justice, which commenced its own investigation into the matters. If it is determined that we or our third-party distributors, resellers or service providers have failed to comply with applicable contractual or regulatory requirements, we may be subject to civil and criminal penalties and administrative sanctions, including termination of contracts, forfeiture of profits, cost associated with the triggering of price reduction clauses, fines and suspensions or debarment from future government business, among others, all of which may adversely affect our business. In the United States, our federal business has been concentrated with a small number of third-party distributors, resellers or service providers. If one of those third parties is limited in its ability to do business with the government due to a regulatory or legal issue arising from their own conduct and we are not able to move our business to another third party, our business could be negatively impacted.

Previous wording

As we continue to expand our business internationally, we will inevitably do more business with large private enterprises and the public sector in countries outside of the U.S. Increased business in countries with heightened levels of corruption subjects us and our officers and directors to increased scrutiny and potential liability from our business operations. We have an established compliance program, but there is a risk that our employees, partners, vendors, customers and agents, as well as those companies to which we outsource certain of our business operations, could violate our policies and applicable law, exposing us to additional scrutiny and potential liability. We have experienced this in the past and may experience it again in the future. In addition, we are subject to customs laws that may impose tariffs on us, directly or indirectly. Higher tariffs on imports related to our operations could increase our operating costs. We are also subject to global trade laws that apply to our worldwide operations, including prohibitions or restrictions on conducting business in certain geographies or involving certain counterparties, end-users or end-use cases. As a result of the Russia-Ukraine conflict, for example, the U.S. and other jurisdictions have imposed economic and trade sanctions and export control restrictions against Russia and Belarus, as well as certain persons, assets and interests associated with those countries. If this conflict continues or if serious conflict arises elsewhere, the U.S. and other jurisdictions could impose wider economic and trade sanctions as well as export restrictions, which could impact our business opportunities and operations. Any violation of the U.S. Foreign Corrupt Practices Act of 1977, as amended, the UK Bribery Act, other applicable anti-corruption and anti-bribery laws, or applicable export control or economic and trade sanctions laws by our employees or third-party intermediaries could subject us to significant risks such as adverse media coverage and/or severe criminal or civil sanctions, which could materially adversely affect our reputation and business.

Current wording

As we continue to expand our business internationally, we will inevitably do more business with large private enterprises and the public sector in countries outside of the U.S. Increased business in countries with heightened trade controls and levels of corruption subjects us and our officers and directors to increased scrutiny and potential liability. We have an established compliance program, but there is a risk that our employees, partners, vendors, customers and agents, as well as those companies to which we outsource certain of our business operations, could violate our policies and applicable law, exposing us to additional scrutiny and potential liability. We have experienced this in the past and may experience it again in the future. In addition, we are subject to customs laws that may impose tariffs on us, either directly or indirectly. This includes tariffs imposed by the U.S. government and other countries on imports, which we are responsible to pay in certain circumstances. Higher tariffs on imports related to our operations could increase our operating costs. We are also subject to global trade laws that apply to our worldwide operations, including prohibitions or restrictions on conducting business in certain geographies or involving certain counterparties, end-users or end-use cases. As a result of the Russia-Ukraine conflict, for example, the U.S. and other jurisdictions have imposed economic and trade sanctions and export control restrictions against Russia and Belarus, as well as certain persons, assets and interests associated with

Previous wording

Our customer deals are becoming more complex, which tend to involve longer and more expensive sales cycles, increased pricing pressure and implementation and configuration challenges.

Current wording

Our customer deals are becoming more complex, which tend to involve longer, more expensive sales cycles, increased pricing pressure, and implementation and configuration challenges.

Previous wording

•potential financial, credit or regulatory risks associated with acquired customers, suppliers and partners of the acquired business;

Current wording

•potential financial, credit or regulatory risks associated with acquiring a business or a part thereof, including risks of delayed, conditioned or denied regulatory clearances and risks relating to customers, suppliers and partners of the acquired business;

Previous wording

•in the case of foreign acquisitions, the challenges associated with integrating operations across different cultures, languages, and legal regimes and any currency and regulatory risks associated with specific countries;

Current wording

•in the case of foreign acquisitions, the challenges associated with integrating operations across different cultures, languages, legal regimes and any currency, tax and regulatory risks associated with specific countries;

Previous wording

In the ordinary course of our business, we store, transmit, generate, and process our and our customers’ confidential, proprietary and sensitive data. As our business expands across the globe, the number of employees, contractors, vendors and other third parties remotely accessing our systems continues to grow. Our growing business operations increase our exposure to cyberattacks by a range of actors, who have used and will continue to use assorted tactics, techniques, and procedures, including malicious code, ransomware, social engineering, business email compromises, supply chain attacks, denial of service attacks and similar internet-enabled, fraudulent activity, and the frequency of those attacks have become more common. Further, during times of war and other major conflicts, we and our third-party providers may be vulnerable to a heightened risk of geopolitically motivated attacks, including cyberattacks, that could materially disrupt our systems and operations, supply chain and ability to provide our services.

Current wording

In the ordinary course of our business, we store, transmit, generate, and process our and our customers’ confidential, proprietary and sensitive data. As our business expands across the globe, the number of employees, contractors, vendors and other third parties remotely accessing our systems continues to grow. Our growing business operations increase our exposure to cyberattacks by a range of actors, who have used and will continue to use assorted tactics, techniques, and procedures, including malicious code, ransomware, social engineering, business email compromises, supply chain attacks, denial of service attacks and similar internet-enabled, fraudulent activity, and the frequency of those attacks have become more common. Additionally, as AI technologies continue to advance, threat actors can leverage these technologies to develop more sophisticated attack methods that are increasingly automated, targeted, coordinated and more difficult to defend against. The proliferation of these technologies could enable less skilled threat actors to initiate attacks and increase the frequency, scale and impact of security incidents. Further, during times of war and other major conflicts, we and our third-party providers may be vulnerable to a heightened risk of geopolitically motivated attacks, including cyberattacks, that could materially disrupt our systems and operations, supply chain and ability to provide our services.

Previous wording

We have identified vulnerabilities in our products and services in the past and expect to continue to do so in the future. We cannot be certain that we will be able to identify all vulnerabilities or address the vulnerabilities of which we become aware. There have been delays and may continue to be delays in developing patches that can be effectively deployed to address vulnerabilities. Further, security researchers and other individuals have in the past actively searched for, published and/or exploited actual and potential vulnerabilities in our products or services and will likely continue to do so in the future. Also, certain persons, including researchers, have in the past not abided by, and may in the future not abide by, our responsible disclosure program, which has resulted in, and could in the future result in the compromise of our systems or our or our customers’ data. Moreover, the incorporation of third-party or open-source software code into our or our customers’ systems increases the risk of exploitation of vulnerabilities. We also have inherited and may in the future inherit additional security risks from acquiring or partnering with other companies.

Current wording

We have identified vulnerabilities in our products and services in the past and expect to continue to do so in the future. Consistent with our vulnerability management program, we prioritize security risks and consider their severity and potential impact in determining whether and when to remediate or mitigate them. In addition, we cannot be certain that we will be able to prevent, detect or remediate all vulnerabilities, and there have been delays and may continue to be delays in developing patches that can be effectively deployed to address vulnerabilities. Further, security researchers and other entities and individuals have actively searched for, published and/or exploited actual and potential vulnerabilities in our products or services and will likely continue to do so in the future. Also, certain persons, including researchers, have in the past not abided by, and may in the future not abide by, our responsible disclosure program, which has resulted in, and could in the future result in the compromise of our systems or our or our customers’ data. Moreover, the incorporation of third-party, AI-generated or open-source software code into our or our customers’ systems increases the risk of exploitation of

Previous wording

In most instances, our customers are responsible for administering access to the data held in their particular instance for their employees and service providers. While our software is delivered with certain preset configurations, we understand that our customers require flexibility to configure the Now Platform to their specific business needs. We work closely with our customers to help them evaluate their security configurations, including providing guidance to align configuration settings with their business needs. Yet, in configuring our platform, both our employees and customers have made errors in the past and may do so again in the future. We are aware that, on occasion, both our customers and ServiceNow have configured certain settings on our platform, or retained preset configurations, in ways that may not align with preferred or recommended security levels, which can result in, and has resulted in, information being made more widely accessible than intended. Such misconfigurations can be, and have been, identified publicly, increasing the risk of data being exposed unintentionally. In certain cases, customers may misconfigure their systems and claim that they were not properly informed of the risks to their configuration.

Current wording

In most instances, our customers are responsible for configuring and determining access levels to the data held in their particular instance for their employees and service providers. While our software is delivered with certain preset configurations, we understand that our customers require flexibility to configure the ServiceNow AI Platform to their specific business needs. We work closely with our customers to help them evaluate their security configurations, including providing guidance to align configuration settings with their business needs. Yet, in configuring our platform, both our employees and customers have made errors in the past and may do so again in the future. We are aware that, on occasion, both our customers and ServiceNow have configured certain settings on our platform, or retained preset configurations, in ways that may not align with preferred or recommended security levels, which can result in, and has resulted in, information being made more widely accessible than intended. Such misconfigurations can be, and have been, identified publicly, increasing the risk of data being exposed unintentionally. In certain cases, customers may misconfigure their systems and claim that they were not properly informed of the risks to their configuration.

Previous wording

Our data security system and data governance framework, designed to protect our and our customers’ information and prevent data loss, may not be effective at preventing material breaches caused by intentional or unintentional actions or inactions by employees, contractors or third parties. Techniques used to sabotage or to obtain unauthorized access to systems are constantly evolving and may go undetected until a successful attack occurs. Moreover, we have experienced security incidents, which may reoccur in the future, that resulted in unauthorized access to, loss, or inadvertent disclosure of confidential, proprietary and sensitive information. We have observed attempts by third parties to induce or deceive our employees, contractors or users to fraudulently obtain access to our or our customers’ data or assets. In addition, our employees have fallen victim to phishing attacks in the past and are likely to again in the future. Further, despite our security measures, employees, contractors and other individuals (some of whom are supported by nation states) have gained, and in the future may gain, access to our systems to search for and exploit actual or potential vulnerabilities in our products or services or inflict other harms, such as deploying malware or stealing data.

Current wording

Our data security system and data governance framework, designed to protect our and our customers’ information and prevent data loss, may not be effective at preventing, detecting, responding to or remediating material breaches caused by intentional or unintentional actions or inactions by employees, contractors or third parties. Techniques used to sabotage or to obtain unauthorized access to systems are constantly evolving and may go undetected until we become aware of a successful attack. Moreover, we have experienced security incidents, which may reoccur in the future, that resulted in unauthorized access to, loss or inadvertent disclosure of confidential, proprietary and sensitive information. We have observed attempts by third parties to induce or deceive our employees, contractors or users to fraudulently obtain access to our or our customers’ data or assets. In addition, our employees have fallen victim to phishing attacks in the past and are likely to again in the future. Further, despite our security measures, employees, contractors and other individuals (some of whom are supported by nation states) have gained, and in the future may gain, access to our systems to search for and exploit actual or potential vulnerabilities in our products or services or inflict other harms, such as deploying malware or stealing data.

Previous wording

An actual or perceived security breach or compromise can have a material effect on ServiceNow’s operations, finances and reputation. The adverse consequences can include accidental or unlawful destruction, loss, alteration, unauthorized disclosure of or access to data; disruptions to our services; diversion of funds; litigation; indemnification and other contractual obligations; regulatory investigations; government fines and penalties; reputational damage; negative publicity; business and operational interruptions; loss of sales, customers, and partners; mitigation and remediation expenses; and other material costs and liabilities. In addition, the assessment and response to security incidents, as well as implementation of appropriate safeguards to protect against future incidents, can lead to material economic and operational consequences. These consequences can result regardless of whether the incident is suffered by us, affects our third-party service providers or stems from customers’ action or inaction. Moreover, even if a breach is unrelated to our security programs or practices, it could still cause us reputational harm and require us to undertake significant efforts to assess and respond to the breach, including further protecting our customers from their own vulnerabilities. There can be no assurance that any limitations of liability provisions in our subscription agreements, terms of use or other agreements would be enforceable or adequate or would otherwise protect us from any such liabilities or damages with respect to any particular claim. In addition, while we maintain insurance coverage to cover potential financial losses, we cannot be certain that such coverage will continue to be available on acceptable terms or in sufficient amounts to cover potential financial losses from a security incident or that an insurer will not deny coverage as to any future claim.

Current wording

An actual or perceived security breach or compromise can have a material effect on ServiceNow’s operations, finances and reputation. The adverse consequences can include accidental or unlawful destruction, loss, alteration, unauthorized disclosure of or access to data; disruptions to our services; diversion of funds; litigation; indemnification and other contractual obligations; regulatory investigations; government fines and penalties; reputational damage; negative publicity; business and operational interruptions; loss of sales, customers and partners; mitigation and remediation expenses; and other material costs and liabilities. In addition, the assessment and response to security incidents, as well as implementation of appropriate safeguards to protect against future incidents, can lead to material economic and operational consequences. These consequences can result regardless of whether the incident is suffered by us, affects our third-party service providers or stems from customers’ action or inaction. Moreover, even if a breach is unrelated to our security programs or practices, it could still cause us reputational harm and require us to undertake significant efforts to assess and respond to the breach, including further protecting our customers from their own security risks. There can be no assurance that any limitations of liability provisions in our subscription agreements, terms of use or other agreements would be enforceable or adequate or would otherwise protect us from any such liabilities or damages with respect to any particular claim. In addition, while we maintain insurance coverage to cover potential financial losses, we cannot be certain that such coverage will continue to be available on acceptable terms or in sufficient amounts to cover potential financial losses from a security incident or that an insurer will not deny coverage as to any future claim.

Previous wording

There is increasingly intense competition for talent in the technology industry. Our success depends substantially upon the continued services of our management team, particularly our chief executive officer, chief operating officer and the other members of our executive staff. From time to time in the ordinary course of business, there have been and may continue to be changes in our management team. While we seek to manage these transitions carefully, such changes may result in a loss of institutional knowledge and negatively affect our business.

Current wording

There is increasingly intense competition for talent in the technology industry. Our success depends substantially upon the continued services of our management team, particularly our chief executive officer and the other members of our executive staff. From time to time in the ordinary course of business, there have been and may

Previous wording

In the highly competitive technology industry, we face ongoing challenges in attracting and retaining top talent across various roles, such as product development and engineering (particularly with AI and machine learning backgrounds), sales, operations and cybersecurity. These key individual contributors are critical to our success, can command very significant compensation in the market and are actively recruited by our key competitors. Our ability to achieve significant revenue growth may depend on our success in recruiting, training and retaining sufficient qualified personnel to support our growth. We have faced and may continue to face difficulties attracting, hiring and retaining highly-skilled, qualified personnel and may not be able to fill positions in desired geographic areas or at all. Further, as we continue to grow and expand our workforce globally, we may face operational and workplace culture challenges that could negatively impact our ability to maintain the effectiveness of our business execution and the beneficial aspects of our corporate culture. While our work model, where a substantial portion of our employees work partially or fully remote, increased our access to talent, we may not be able to take advantage of a broader talent pool if our competitors offer the same work model or if we continue to rely on our primary operating locations for talent. We are continually evaluating and, as appropriate, enhancing the attractiveness of our compensation packages and benefit programs. As a result, we have experienced and may continue to experience increased costs that may not be offset by either improved productivity or higher sales, potentially resulting in a reduction in our profitability. In addition, we grant equity awards to our employees and sustained declines in our stock price or lower stock price performance relative to our competitors reduces the retention value of such awards, which can impact the competitiveness of our compensation. Many of our employees, including all of our executive officers, are employed “at-will” and may terminate their employment with us at any time. If we fail to attract qualified, new personnel or fail to retain and motivate our current personnel, our business and future growth prospects could be adversely affected.

Current wording

In the highly competitive technology industry, we face ongoing challenges in attracting and retaining top talent across various roles, such as product development and engineering (particularly with AI and machine learning backgrounds), sales, operations and cybersecurity. These key individual contributors are critical to our success, can command very significant compensation in the market and are actively recruited by our key competitors. Our ability to achieve significant revenue growth may depend on our success in recruiting, training and retaining sufficient qualified personnel to support our growth. We have faced and may continue to face difficulties attracting, hiring and retaining highly-skilled, qualified personnel and may not be able to fill positions in desired geographic areas or at all. Further, as we continue to grow and expand our workforce globally, we may face operational and workplace culture challenges that could negatively impact our ability to maintain the effectiveness of our business execution and the beneficial aspects of our corporate culture. While our work model, where a substantial portion of our employees work partially or fully remote, increased our access to talent, we may not be able to take advantage of a broader talent pool if our competitors offer the same work model or if we continue to rely on our primary operating locations for talent. We are continually evaluating and, as appropriate, enhancing the attractiveness of our compensation packages and benefit programs. As a result, we have experienced and may continue to experience increased costs that may not be offset by either improved productivity or higher sales, potentially resulting in a reduction in our profitability. In addition, we grant equity awards to our employees and sustained declines in our stock price or lower stock price performance relative to our competitors reduces the retention value of such awards, which can impact the attractiveness of our compensation. Many of our employees, including all of our executive officers, are employed “at-will” and may terminate their employment with us at any time. If we fail to attract qualified, new personnel or fail to retain and motivate our current personnel, our business and future growth prospects could be adversely affected.

Previous wording

We must successfully continue to release new products and updates to existing products. The success of any release depends on a number of factors, including our ability to manage the risks associated with actual or perceived quality or other defects or deficiencies, delays in the timing of releases or the adoption of releases by customers, and other complications that may arise during the early stages of introducing our products. If releases are delayed or if customers perceive that our releases contain bugs or other defects or are difficult to implement, customer adoption of our new products or updates may be adversely impacted, customer satisfaction may decrease, our ability to efficiently provide our services may be reduced, and our growth prospects may be harmed.

Current wording

We must successfully continue to release new products and updates and features to existing products. The success of any release depends on a number of factors, including our ability to manage the risks associated with actual or perceived quality or other defects or deficiencies, delays in the timing of releases or the adoption of releases by customers, and other complications that may arise during the early stages of introducing our products. If releases are delayed or if customers perceive that our releases contain bugs or other defects or are difficult to implement, customer adoption of our new products or updates may be adversely impacted, customer satisfaction may decrease, our ability to efficiently provide our services may be reduced, and our growth prospects may be harmed.

Previous wording

Our business depends on our platform to be available without disruption. From time to time, we have experienced and expect to continue to experience defects, disruptions, outages and other performance and quality problems with our platform. New defects may be detected in the future and may arise from our increasing use of the public cloud. For example, we provide regular updates to our services, which can contain undetected defects. Defects may also be introduced by our use of third-party software, including open-source software. Disruptions may result from errors we make in developing, delivering, configuring or hosting our services, or designing, installing, expanding or maintaining our cloud infrastructure. Disruptions in service can also result from incidents outside of our control, including third-party incidents or denial of service or ransomware attacks, among others. We currently serve our customers primarily using equipment managed by us and co-located in third-party data centers operated by several different providers located around the world, and we serve certain of our customers using data center facilities operated by public cloud service providers. These data centers are vulnerable to damage or interruption from earthquakes, hurricanes, floods, fires, power failures and similar events. They may also be subject to break-ins, sabotage, intentional acts of vandalism and similar misconduct, equipment failure and adverse events caused by operator error or negligence. In addition, an increased use of the public cloud increases our vulnerability to cyberattacks. Despite precautions taken at these centers, problems at these centers have occurred, resulting in interruptions in our services. Such problems could occur again and result in similar or lengthier service interruptions and the loss of customer data. In addition, our customers may use our services in ways that cause disruptions in service for other customers. In addition to data center providers, we also have a large ecosystem of vendors and service providers that we use for our products. If there is a compromise to data, supply chain issue or other incident with our critical service providers, it may impact our ability to provide our services and reduce our productivity. Our customers use our services to manage important aspects of their businesses, and our reputation and business will be adversely affected if our customers and potential customers believe our services are unreliable. Disruptions or defects in our services may reduce our revenues, cause us to issue credits or pay penalties, subject us to claims and litigation, cause our customers to delay payment or terminate or fail to renew their subscriptions, and adversely affect our ability to attract new customers. Similarly, customers may have unique requirements for system resiliency and performance depending on their business models and customers in highly regulated markets may have more demanding requirements that we may no…

Excerpt shortened here; the source contains the full paragraph.

Current wording

Our business depends on our platform to be available without disruption. From time to time, we have experienced and expect to continue to experience defects, disruptions, data loss, outages and other performance and quality problems with our platform. New defects may be detected in the future and may arise from our increasing use of public cloud service providers. For example, we provide regular updates to our services, which can contain undetected defects. Defects may also be introduced by our use of third-party software, including open-source software. Disruptions, data loss and service degradation may result from errors we make in developing, delivering, configuring or hosting our services, or designing, installing, expanding or maintaining our cloud infrastructure. They may also arise from incidents outside of our control, including third-party incidents, denial of service or ransomware attacks, as well as from our efforts to address vulnerabilities and security incidents. Although we currently serve our customers primarily using equipment managed by us and co-located in third-party data centers operated by several different providers worldwide, we expect to increasingly serve our customers using data center facilities operated by public cloud service providers. As our reliance on public cloud service providers increases, we face heightened risks of outages or performance degradation beyond our direct control. Similarly, supply chain issues or other incidents involving critical service providers could disrupt our operations or