VEEVA SYSTEMS INC

Previous wording

Any or all of these circumstances or issues, or the perception that any of them have occurred or are present (including any actual or perceived cyberattacks or other security breaches or incidents), could adversely affect our ability to attract new customers, cause existing customers to elect not to renew their subscriptions, result in reputational damage and harm to our market position, or subject us to third-party claims, demands, and lawsuits, regulatory investigations, proceedings, fines, and penalties, mandatory notifications and disclosures, or other action or liability, which could adversely affect our operating results and financial condition. Our insurance may not be

Current wording

Any or all of these circumstances or issues, or the perception that any of them have occurred or are present (including any actual or perceived cyberattacks or other security breaches or incidents), could adversely affect our ability to attract new customers, cause existing customers to elect not to renew their subscriptions, result in reputational damage and harm to our market position, or subject us to third-party claims, demands, and lawsuits, regulatory investigations, proceedings, fines, and penalties, mandatory notifications and disclosures, or other action or liability, which could adversely affect our operating results and financial condition. Our insurance may not be adequate to cover losses associated with such events, and such insurance may not cover all of the types of costs, expenses, and losses we could incur to respond to and remediate a security breach or incident.

Previous wording

The markets for our solutions are highly competitive. In new sales cycles within our largest product categories, we generally compete with other cloud-based solutions from providers that make applications geared toward the life sciences industry. Historically, our CRM solutions competed with IQVIA’s CRM solution. However, IQVIA has announced that it will market and support its CRM solution only through 2029, that it has licensed its CRM software to Salesforce, Inc., and that it will collaborate with Salesforce to accelerate the development of a CRM solution for life sciences that it will jointly market with Salesforce. Accordingly, our CRM solutions now primarily compete with Salesforce, which has announced it is developing a life sciences industry-specific CRM application. Our Veeva Data Cloud products as well as Veeva Crossix, compete with IQVIA, Ipsos Group S.A., Definitive Health Corp., and smaller data and data analytics providers. IQVIA, Dassault Systèmes, OpenText Corporation, Oracle Corporation, Honeywell International Inc., and other smaller application providers offer applications that compete with certain of our Veeva Development Cloud or Veeva Quality Cloud applications. Our Veeva Commercial Cloud, Veeva Development Cloud, and Veeva Quality Cloud applications also compete to replace client server-based legacy solutions offered by companies such as Oracle, Microsoft Corporation, and other smaller application providers. Our customers may also choose to use cloud-based applications or platforms that are not life sciences specific—such as Salesforce, Box.com, Amazon Web Services, or Microsoft—for certain of the functions our applications provide. Our business consulting and professional services offerings compete with a range of professional services firms, which include, at times, some of our partners. With the introduction of new technologies, we expect competition to intensify in the future, and we may face competition from new market entrants as well.

Current wording

The markets for our solutions are highly competitive. In new sales cycles within our largest product categories, we generally compete with other cloud-based solutions from providers that make applications geared toward the life sciences industry. Our CRM solutions primarily compete with Salesforce, which has developed a life sciences industry-specific CRM application. IQVIA, which historically offered a competitive CRM solution, has licensed its CRM software to Salesforce and intends to jointly market a CRM solution for life sciences with Salesforce. Our Veeva Data Cloud products as well as Veeva Crossix, compete with IQVIA, Ipsos Group S.A., Definitive Health Corp., and smaller data and data analytics providers. IQVIA, Dassault Systèmes, OpenText Corporation, Oracle Corporation, Honeywell International Inc., and other smaller application providers offer applications that compete with certain of our Veeva Development Cloud or Veeva Quality Cloud applications. Our Veeva Commercial Cloud, Veeva Development Cloud, and Veeva Quality Cloud applications also compete to replace client server-based legacy solutions offered by companies such as Oracle, Microsoft Corporation, and other smaller application providers. Our customers may also choose to use cloud-based applications or platforms that are not life sciences specific—such as Salesforce, Box.com, Amazon Web Services, or Microsoft—for certain of the functions our applications provide. Our business consulting and professional services offerings compete with a range of professional services firms, which include, at times, some of our partners. With the introduction of new technologies, we expect competition to intensify in the future, and we may face competition from new market entrants as well.

Previous wording

We currently depend on the Salesforce platform to deliver our Veeva CRM application, but we have begun to migrate our CRM customers to our Vault CRM solutions, which are built on our Veeva Vault platform. We do not intend to renew our agreement with Salesforce, Inc. for use of the Salesforce platform. Veeva CRM will be supported until September 1, 2030. The migration of our Veeva CRM customers will require time and expense, which may be significant. These migration processes are complex and we cannot be certain that we will be successful. Further, certain customers have decided, and other customers may in the future decide, not to migrate to Vault CRM and use a different CRM solution, including a CRM solution provided by Salesforce. Additionally, the migration may lead to outages or performance problems with Vault CRM or other Vault applications if we encounter difficulties supporting the increased volume of users migrating from Veeva CRM. Any disruptions in our services or other migration-related problems, whether or not such incidents are our fault, could subject us to liability or harm our reputation. If we are unsuccessful migrating our Veeva CRM customers to Vault CRM, encounter disruptions or other problems in the migration process, or our customers do not migrate to the Vault CRM in a timely manner, or at all, our business, operating results, and brand could be materially and adversely affected.

Current wording

We currently depend on the Salesforce platform to deliver our Veeva CRM application, but we have begun to migrate our CRM customers to our Vault CRM solutions, which are built on our Veeva Vault platform. Veeva CRM will be supported until September 1, 2030. The migration of our Veeva CRM customers will require time and expense, which may be significant. These migration processes are complex and we cannot be certain that we will be successful. Further, certain customers have decided, and other customers may in the future decide, not to migrate to Vault CRM and use a different CRM solution, including a CRM solution provided by Salesforce. Additionally, the migration may lead to outages or performance problems with Vault CRM or other Vault applications if we encounter difficulties supporting the increased volume of users migrating from Veeva CRM. Any disruptions in our services or other migration-related problems, whether or not such incidents are our fault, could subject us to liability or harm our reputation. If we are unsuccessful migrating our Veeva CRM customers to Vault CRM, encounter disruptions or other problems in the migration process, or our customers do not migrate to the Vault CRM in a timely manner, or at all, our business, operating results, and brand could be materially and adversely affected.

Previous wording

Our sales process entails planning discussions with prospective customers, analyzing their existing solutions, and identifying how these potential customers could use and benefit from our solutions. The sales cycle for a new customer, from the time of prospect qualification to the completion of the first sale, may span 12 months or longer. Sales cycles for our newer applications or in newer markets or industries are also lengthy and difficult to predict. We spend substantial time, effort, and expense in our sales efforts without any assurance that our efforts will result in the sale of our solutions. In addition, our sales cycle can vary substantially from customer to customer because of various factors, including the discretionary nature of potential customers’ purchasing and budget decisions, the macroeconomic and regulatory environments, the availability of funding in the life sciences industry, the announcement or planned introduction of new solutions by us or our competitors, and the purchasing approval processes of potential customers. For example, we have recently experienced increased scrutiny for certain potential projects, particularly for our professional services offerings, which may continue for the foreseeable future. If our sales cycle lengthens or we invest substantial resources pursuing unsuccessful sales opportunities, our operating results and growth would be harmed.

Current wording

Our sales process entails planning discussions with prospective customers, analyzing their existing solutions, and identifying how these potential customers could use and benefit from our solutions. The sales cycle for a new customer, from the time of prospect qualification to the completion of the first sale, may span 12 months or longer. Sales cycles for our newer applications or in newer markets or industries are also lengthy and difficult to predict. We spend substantial time, effort, and expense in our sales efforts without any assurance that our efforts will result in the sale of our solutions. In addition, our sales cycle can vary substantially from customer to customer because of various factors, including the discretionary nature of potential customers’ purchasing and budget decisions, the macroeconomic and regulatory environments, the availability of funding in the life sciences industry, the announcement or planned introduction of new solutions by us or our competitors, and the purchasing approval

Previous wording

In our fiscal year ended January 31, 2025, customers outside North America accounted for approximately 41% of our total revenues. A key element of our growth strategy is to further expand our international operations and worldwide customer base. Operating in international markets requires significant resources and management attention and subjects us to regulatory, economic, and political risks that are different from those in the United States. We have limited operating experience in some international markets, and we cannot assure you that our expansion efforts into additional international markets will be successful. Our experience in the United States and other international markets in which we already have a presence may not be relevant to our ability to expand in other markets. Our international expansion efforts may not be successful in creating further demand for our solutions outside of the United States or in effectively selling our solutions in the international markets we enter.

Current wording

In our fiscal year ended January 31, 2025, customers outside North America accounted for approximately 41% of our total revenues. A key element of our growth strategy is to further expand our international operations and worldwide customer base. Operating in international markets requires significant resources and management attention and subjects us to regulatory, economic, and political risks that are different from those in the United States. We have limited operating experience in some international markets, and we cannot assure you that our expansion efforts into additional international markets will be successful. Our experience in the United States and other international markets in which we already have a presence may not be relevant to our ability to expand in other markets. Our efforts may not be successful in creating further demand for our solutions outside of the United States or in effectively selling our solutions in the international markets we enter.

Previous wording

Our corporate headquarters are located in Pleasanton, California and our primary third-party hosted computing infrastructure is located in the United States, the European Union, Japan, and South Korea. The west coast of the United States, Japan, and South Korea each contain active earthquake zones. Additionally, we rely on our network and third-party infrastructure and enterprise applications, internal technology systems, and our website, for our development, marketing, operational support, hosted services, and sales activities. In the event of a major earthquake, hurricane, or other natural disaster, or catastrophic event such as an actual or threatened public health emergency (e.g., a global pandemic), fire, extreme weather event, power loss, telecommunications failure, cyberattack, armed conflicts (including the Russian invasion of Ukraine and the regional conflict in the Middle East), or terrorist attack, we may be unable to continue our operations at full capacity or at all and may experience system interruptions, reputational harm, delays in our solution development, lengthy interruptions in our services, breaches of data security, loss of key employees, and loss of critical data, all of which could have an adverse effect on our future operating results.

Current wording

Our corporate headquarters are located in Pleasanton, California and our primary third-party hosted computing infrastructure is located in the United States, the European Union, Japan, and South Korea. The west coast of the United States, Japan, and South Korea each contain active earthquake zones. Additionally, we rely on our network and third-party infrastructure and enterprise applications, internal technology systems, and our website, for our development, marketing, operational support, hosted services, and sales activities. In the event of a major earthquake, hurricane, or other natural disaster, or catastrophic event such as an actual or threatened public health emergency (e.g., a global pandemic), fire, extreme weather event, power loss, telecommunications failure, cyberattack, armed conflicts (including the Russian invasion of Ukraine and the regional conflict in the Middle East), or terrorist attack, we may be unable to continue our operations at full capacity or at all and may experience system interruptions, reputational harm, delays in our solution development, lengthy interruptions in our services, breaches

Previous wording

which could, among other things, delay or prevent us from completing a transaction, subject the transaction to divestiture after the fact, or otherwise restrict our ability to realize the expected financial or strategic goals of the acquisition.

Current wording

•the possibility of investigation by, or the failure to obtain required approvals from, governmental authorities on a timely basis, if at all, under various regulatory schemes, including competition laws, which could, among other things, delay or prevent us from completing a transaction, subject the transaction to divestiture after the fact, or otherwise restrict our ability to realize the expected financial or strategic goals of the acquisition.

Previous wording

Moreover, a significant portion of the purchase price of companies we acquire may be allocated to acquired intangible assets and goodwill, which we must assess for impairment at least annually. In the future, if our acquisitions do not yield expected returns, we may be required to take charges to our operating results based on this impairment assessment process, which could adversely affect our results of operations. Acquisitions may also result in purchase accounting adjustments, write-offs or restructuring charges, which may negatively affect our results.

Current wording

acquisitions do not yield expected returns, we may be required to take charges to our operating results based on this impairment assessment process, which could adversely affect our results of operations. Acquisitions may also result in purchase accounting adjustments, write-offs or restructuring charges, which may negatively affect our results.

Previous wording

Our business depends on our ability to satisfy our customers, both with respect to our solutions and the professional services that are performed in connection with the implementation of our solutions, including training our customers’ employees on our solutions. Professional services may be performed by us, by a third party, or by a combination of the two. If a customer is not satisfied with the quality of work performed by us or a third party or with the solutions delivered, we could incur additional costs to address the situation, we may be required to issue credits or refunds for pre-paid amounts related to unused services, the profitability of that work might be impaired, and the customer’s dissatisfaction with our services could damage our ability to expand the number of solutions subscribed to by that customer. Moreover, negative publicity related to our customer relationships, regardless of its accuracy, may further damage our business by affecting our ability to compete for new business with current and prospective customers.

Current wording

Our business depends on our ability to satisfy our customers, both with respect to our solutions and the professional services that are performed in connection with the implementation of our solutions, including training our customers’ employees on our solutions. Professional services may be performed by us, by a third party, or by a combination of the two. If a customer is not satisfied with the quality of work performed by us or a third party or with the solutions delivered, we could incur additional costs to address the situation, we may be required to issue credits or refunds for pre-paid amounts related to unused services, the profitability of that work might be impaired, and the customer’s dissatisfaction with our services could damage our ability to expand the number of solutions subscribed to by that customer. Customers may have requirements, including certain data access restrictions, that our support organizations need to meet. Negative publicity related to our customer relationships or satisfaction with our services, regardless of its accuracy, may further damage our business by affecting our ability to compete for new business with current and prospective customers.

Previous wording

Once our solutions are deployed, our customers depend on our support organization to resolve technical issues relating to our solutions. We may be unable to sufficiently accommodate short-term increases in customer demand for technical support services to our customers’ satisfaction. Increased customer demand for our technical support services, without corresponding revenues, could increase costs and adversely affect our operating results. In addition, our sales process is highly dependent on the reputation of our solutions and business and on positive recommendations from our existing customers. Any failure to maintain high-quality technical support, or a market perception that we do not maintain high-quality support, could adversely affect our reputation, our ability to sell our solutions to existing and prospective customers, and our business and operating results.

Current wording

Once our solutions are deployed, our customers depend on our support organization to resolve technical issues relating to our solutions. We may be unable to sufficiently accommodate short-term increases in customer demand for technical support services to our customers’ satisfaction. Increased customer demand for our technical support services, without corresponding revenues, could increase costs and adversely affect our operating results. In addition, our sales process is highly dependent on the reputation of our solutions and business and on positive recommendations from our existing customers. Any failure to maintain high-quality technical support, or amarket perception that we do not maintain high-quality support, could adversely affect our reputation, our ability to sell our solutions to existing and prospective customers, and our business and operating results.

Previous wording

Our estimate of the market size for our solutions that we have provided publicly, sometimes referred to as total addressable market (TAM), is subject to significant uncertainty and is based on assumptions and estimates, including our internal analysis and industry experience, which may not prove to be accurate. These estimates are, in part, based upon the size of the general application areas we target. Our ability to serve a significant portion of this estimated market is subject to many factors, including our success in implementing our business strategy, which is

Current wording

Our estimate of the market size for our solutions that we have provided publicly, sometimes referred to as total addressable market (“TAM”), is subject to significant uncertainty and is based on assumptions and estimates, including our internal analysis and industry experience, which may not prove to be accurate. These estimates are, in part, based upon the size of the general application areas we target. Our ability to serve a significant portion of this estimated market is subject to many factors, including our success in implementing our business strategy, which is subject to many risks and uncertainties. For example, in order to address the entire TAM we have identified, we must continue to enhance and add functionality to our existing solutions and introduce new solutions. Accordingly, even if our estimate of the market size is accurate, we cannot assure you that our business will serve a significant portion of this estimated market for our solutions.

Previous wording

•Regulatory changes, government policies, and government funding decisions related to the life sciences industry—Changes in regulations could negatively impact the business environment for our life sciences customers and for us. Healthcare laws and regulations are rapidly evolving and may change significantly in the future. For example, regulatory changes with respect to life sciences advertising, such as limitations on or the elimination of the ability of pharmaceutical companies to engage in direct-to-consumer advertising, could negatively impact certain of our product offerings, including our Crossix business. Further, in recent years, there have been legislative and regulatory changes regarding the pricing of drugs and other healthcare treatments sold by life sciences companies, such as the drug pricing reforms in the Inflation Reduction Act, which went into effect in August 2022, and drug pricing reforms proposed by the recent Executive Order signed on May 12, 2025, which would impose certain limits on drug prices in the U.S. relative to the prices paid in other countries. Other drug pricing reforms have been discussed and may be proposed in the future. Significant changes in drug pricing policy or regulation could result in lower revenues and profits for life sciences companies and reduced demand for our products. In addition, reductions in funding and staffing of government agencies and changes in the funding and eligibility for healthcare programs relevant to the life sciences industry—such as the Food and Drug Administration, the National Institutes of Health, and Medicaid—or changes in funding priorities relevant to the life sciences industry could adversely affect the life sciences industry.

Current wording

•Regulatory changes, government policies, and government funding decisions related to the life sciences industry—Changes in regulations could negatively impact the business environment for our life sciences customers and for us. Healthcare laws and regulations are rapidly evolving and may change significantly in the future. For example, regulatory changes with respect to life sciences advertising, such as limitations on or the elimination of the ability of pharmaceutical companies to engage in direct-to-consumer advertising, could negatively impact certain of our product offerings, including our Crossix business. Further, in recent years, there have been legislative and regulatory changes regarding the pricing of drugs and other healthcare treatments sold by life sciences companies, such as the drug pricing reforms in the Inflation Reduction Act, which went into effect in August 2022, drug pricing reforms proposed by the current administration, which would impose certain limits on drug prices in the U.S. relative to the prices paid in other countries, and drug price negotiations with the current administration and certain drug manufacturers. Other drug pricing reforms have been discussed and may be proposed in the future. Significant changes in drug pricing policy or regulation could result in lower revenues and profits for life sciences companies and reduced demand for our products. In addition, reductions in funding and staffing of government agencies and changes in the funding and eligibility for healthcare programs relevant to the life sciences industry—such as the Food and Drug Administration, the National Institutes of Health, and Medicaid—or changes in funding priorities relevant to the life sciences industry could adversely affect the life sciences industry.

Previous wording

•Changes in market conditions and practices within the life sciences industry—The expiration of key patents, the implications of precision medicine treatments, changes in the practices of prescribing physicians and patients, changes with respect to payer relationships, and the policies and preferences of healthcare professionals and healthcare organizations with respect to the sales and marketing efforts of life sciences companies could negatively impact demand for our solutions. Changes in public perception regarding the practices of the life sciences industry may result in political pressure to increase the regulation of life sciences companies in one or more of the areas described above, which may negatively impact demand for our solutions. Other factors could lead to a significant reduction in sales representatives that use our solutions or otherwise change the demand for our solutions. For example, in recent years, certain life sciences companies have reduced the number of sales representatives they employ due to an increased preference for digitally-enabled sales channels, which negatively impacted sales of our solutions, including Veeva CRM and certain of our other Commercial Solutions.

Current wording

perception regarding the practices of the life sciences industry may result in political pressure to increase the regulation of life sciences companies in one or more of the areas described above, which may negatively impact demand for our solutions. Other factors could lead to a significant reduction in sales representatives that use our solutions or otherwise change the demand for our solutions. For example, in recent years, certain life sciences companies have reduced the number of sales representatives they employ due to an increased preference for digitally-enabled sales channels, which negatively impacted sales of our solutions, including Veeva CRM and certain of our other Commercial Solutions.

Previous wording

As we increase the number of products we offer, increase the number of countries in which we operate, and incorporate new technologies and capabilities into our products (including the use of AI and machine learning technologies), the complexity of adjusting our solutions to comply with legal and regulatory changes will increase. If we are unable to effectively manage this increased complexity or if we are not able to provide solutions that can be used in compliance with applicable laws and regulations, customers may be unwilling to use our solutions, and any such non-compliance could result in the termination of our customer agreements or claims arising from such agreements with our customers. Furthermore, we have in the past and may in the future be subject to inspections or audits by government agencies or other regulatory bodies to verify our customers’ compliance with applicable laws, regulations, or GxP principles.

Current wording

As we increase the number of products we offer, increase the number of countries in which we operate, and incorporate new technologies and capabilities into our products (including the use of AI and machine learning technologies), the complexity of adjusting our solutions to comply with legal and regulatory changes will increase. If we are unable to effectively manage this increased complexity or if we are not able to provide solutions that can be used in compliance with applicable laws and regulations, customers may be unwilling to use our solutions, and any such non-compliance could result in the termination of our customer agreements or claims arising from such

Previous wording

Under the European General Data Protection Regulation (EU GDPR) and the United Kingdom’s General Data Protection Regulation (UK GDPR), as amended by the Data (Use and Access) Act 2025, we act as a data controller for our data products and a data processor with respect to our software products. Each of the GDPR and UK GDPR impose significant data protection obligations and provide for substantial penalties and other remedies for noncompliance. We maintain active self-certifications under the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework as set forth by the U.S. Department of Commerce. We also rely on EU, Swiss, and UK Standard Contractual Clauses, as well as our technical, contractual, and security measures, to help ensure that our European customers have the appropriate legal mechanisms in place for their personal data to be accessed from within the United States. We are required to take steps to legitimize any personal data transfers impacted by these developments, and to engage in contract negotiations with third parties that aid in processing personal data on our behalf. We may be subject to increased costs of compliance and limitations on our service providers and us. In addition, these laws are complex, with the application and interpretation of them, at times, unclear and inconsistent, and significant penalties may be imposed for non-compliance. For example, in May 2023, the Irish Data Protection Commission imposed a significant fine on a large internet technology corporation for its failure to sufficiently address risks to EU data subjects when transferring data to the U.S.

Current wording

Under the European General Data Protection Regulation (“EU GDPR”) and the United Kingdom’s General Data Protection Regulation (“UK GDPR”), as amended by the Data (Use and Access) Act 2025, we act as a data controller for our data products and a data processor with respect to our software products. Each of the GDPR and UK GDPR impose significant data protection obligations and provide for substantial penalties and other remedies for noncompliance. We maintain active self-certifications under the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework as set forth by the U.S. Department of Commerce. We also rely on EU, Swiss, and UK Standard Contractual Clauses, as well as our technical, contractual, and security measures, to help ensure that our European customers have the appropriate legal mechanisms in place for their personal data to be accessed from within the United States. We are required to take steps to legitimize any personal data transfers impacted by these developments and similar developments in other jurisdictions, and to engage in contract negotiations with third parties that aid in processing personal data on our behalf. We may be subject to increased costs of compliance and limitations on our service providers and us. In addition, these laws are complex, with the application and interpretation of them, at times, unclear and inconsistent, and significant penalties may be imposed for non-compliance. For example, in May 2023, the Irish Data Protection Commission imposed a significant fine on a large internet technology corporation for its failure to sufficiently address risks to EU data subjects when transferring data to the U.S.

Previous wording

Other countries have imposed or may in the future impose data localization obligations, cross-border data transfer restrictions, and other country specific privacy and security requirements which could be problematic to cloud software and data providers. For example, in 2021, China adopted the Personal Information Protection Law, which, together with the Cybersecurity Law and the Data Security Law, require companies that process personal data of China residents above certain thresholds to seek approval from the Cyberspace Administration of China (CAC) to transfer such data outside of China. In 2023, certain of our Veeva CRM customers in China were required to request such approval from the CAC and had their requests denied. Customers required to request approval may need to implement a CRM solution that does not require data to be transferred outside of China and customers not subject to the requirement may nonetheless choose to do so. While we offer the China CRM Suite, a CRM solution that does not require data to be transferred outside of China, some customers have chosen, and other customers may choose, other CRM providers, which may negatively impact our CRM business in China. Currently, approximately 2% of our total revenue is attributable to China. Additionally, as we expand our data product offerings into new jurisdictions, we are required to assess, monitor, and comply with additional laws and regulations related to our collection and processing of data, which may include new registration, consent, and notification obligations.

Current wording

Other countries have imposed or may in the future impose data localization obligations, cross-border data transfer restrictions, and other country specific privacy and security requirements which could be problematic to cloud software and data providers. For example, in 2021, China adopted the Personal Information Protection Law, which, together with the Cybersecurity Law and the Data Security Law, require companies that process personal data of China residents above certain thresholds to seek approval from the Cyberspace Administration of China (“CAC”) to transfer such data outside of China. In 2023, certain of our Veeva CRM customers in China were required to request such approval from the CAC and had their requests denied. Customers required to request approval may need to implement a CRM solution that does not require data to be transferred outside of China and customers not subject to the requirement may nonetheless choose to do so. While we offer the China CRM Suite, a CRM solution that does not require data to be transferred outside of China, some customers have chosen, and other customers may choose, other CRM providers, which may negatively impact our CRM business in China. Currently, approximately 2% of our total revenue is attributable to China. Additionally, the French governmental agency for health mandates a certification requiring that personal health data collected during healthcare activities be stored exclusively within the European Economic Area.

Previous wording

We also expect laws, regulations, industry standards and other obligations relating to privacy, data protection, and cybersecurity to continue to evolve, and that there will continue to be new, modified, and re-interpreted laws, regulations, standards, and other obligations in these areas. For example, the Network and Information Security Directive II (NIS2), adopted in 2023, aims to enhance cybersecurity across critical infrastructure and essential

Current wording

We also expect laws, regulations, industry standards and other obligations relating to privacy, data protection, and cybersecurity to continue to evolve, and that there will continue to be new, modified, and re-interpreted laws, regulations, standards, and other obligations in these areas. For example, the Network and Information Security Directive II (“NIS2”), adopted in 2023, aims to enhance cybersecurity across critical infrastructure and essential services in the EU. NIS2 provides for all 27 EU member states to have issued implementing legislation by October

Previous wording

U.S. federal and state data privacy laws are rapidly evolving. These laws impose new and modify existing obligations on businesses that collect personal information, create new privacy rights for individuals, and contain enhanced requirements for and restrictions on data brokers. For example, under the California Consumer Privacy Act (CCPA), as amended, we are generally considered a “service provider” for our software solutions and a “business” for our data products. Some of these laws and regulations also target certain types of marketing and advertising based on the use of personal information. The State of Washington, for example, passed the My Health My Data Act, which became effective on March 21, 2024, establishing significant new restrictions on how businesses can collect, use, and disclose consumer health data. Veeva Crossix’s data platform combines large-scale data sets, inclusive of de-identified health and consumer data, to provide insights, analytics, and audience segmentation for our life sciences customers in the U.S. In response to the Washington law, we made modifications to our audience segments that may reduce demand for our Crossix products, which, in turn, could adversely impact the business. Other states have considered, and in certain cases enacted, similar laws. Additionally, the U.S. Department of Justice recently issued a final rule that places limitations, and in some cases prohibitions, on certain transfers of and access to certain personal data of U.S. persons by persons and entities located in China (and other designated countries) or controlled by a person or entity located in China (and other designated countries). These various laws, regulations, and legislative developments have potentially far-reaching consequences and have and may continue to require us to modify our solutions and data management practices and incur substantial expense in order to comply.

Current wording

U.S. federal and state data privacy laws are rapidly evolving. These laws impose new and modify existing obligations on businesses that collect personal information, create new privacy rights for individuals, and contain enhanced requirements for and restrictions on data brokers. For example, under the California Consumer Privacy Act (“CCPA”), as amended, we are generally considered a “service provider” for our software solutions and a “business” for our data products. Some of these laws and regulations also target certain types of marketing and advertising based on the use of personal information. The State of Washington, for example, passed the My Health My Data Act, which became effective on March 21, 2024, establishing significant new restrictions on how businesses can collect, use, and disclose consumer health data. Veeva Crossix’s data platform combines large-scale data sets, inclusive of de-identified health and consumer data, to provide insights, analytics, and audience segmentation for our life sciences customers in the U.S. In response to the Washington law, we made modifications to our audience segments that may reduce demand for our Crossix products, which, in turn, could adversely impact the business. Other states have considered, and in certain cases enacted, similar laws. Additionally, the U.S. Department of Justice recently issued a final rule that places limitations, and in some cases prohibitions, on certain transfers of and access to certain personal data of U.S. persons by persons and entities located in China (and other designated countries) or controlled by a person or entity located in China (and other designated countries). These various laws, regulations, and legislative developments have potentially far-reaching consequences and have and may continue to require us to modify our solutions, our global support business, and our data management practices and incur substantial expense in order to comply.

Previous wording

Veeva AI, an initiative that will add AI to our applications across all major areas, including clinical, regulatory, safety, quality, medical, and commercial, presents new risks and challenges that could affect the adoption of our solutions and our business. If our AI offerings draw controversy due to their perceived or actual impact on privacy, security or confidentiality, inefficacy or inaccuracy, or contribution to bias, discrimination, other ethical harms, or other matters, we may experience new or enhanced governmental or regulatory scrutiny, brand or reputational harm, competitive harm, or legal liability. If our users lose confidence in the decisions, predictions, analyses, or other content that our

Current wording

Veeva AI, an initiative that will add AI to our applications across all major areas, including clinical, regulatory, safety, quality, medical, and commercial, presents new risks and challenges that could affect the adoption of our solutions and our business. If our AI offerings draw controversy due to their perceived or actual impact on privacy, security or confidentiality, inefficacy or inaccuracy, or contribution to bias, discrimination, other ethical harms, or other matters,

Previous wording

AI offerings produce, the adoption of our offerings could be adversely affected, which may harm our operating results and financial condition. We may also use AI for research and development and other internal operational use cases. The legal, regulatory, and policy environments around AI are evolving rapidly, and we may become subject to new and evolving legal and other obligations. These and other developments may require us to make significant changes to our use of AI, including by limiting or restricting our use of AI, and which may require us to make significant changes to our policies and practices, which may necessitate expenditure of significant time, expense, and other resources. Uncertainty around new and emerging AI applications and regulations may require us to make significant changes to our use of AI, including by limiting or restricting such use, and may cause us to incur increased research and development costs or compliance costs, or divert resources from other development efforts to address issues related to AI governance. If we are unable to mitigate these risks, or if we incur excessive expenses in our efforts to do so, our reputation, business, operating results, and financial condition may be harmed.

Current wording

we may experience new or enhanced governmental or regulatory scrutiny, brand or reputational harm, competitive harm, or legal liability. If our users lose confidence in the decisions, predictions, analyses, or other content that our AI offerings produce, the adoption of our offerings could be adversely affected, which may harm our operating results and financial condition. We may also use AI for research and development and other internal operational use cases. The legal, regulatory, and policy environments around AI are evolving rapidly, and we may become subject to new and evolving legal and other obligations. These and other developments may require us to make significant changes to our use of AI, including by limiting or restricting our use of AI, and which may require us to make significant changes to our policies and practices, which may necessitate expenditure of significant time, expense, and other resources. Uncertainty around new and emerging AI applications and regulations may require us to make significant changes to our use of AI, including by limiting or restricting such use, and may cause us to incur increased research and development costs or compliance costs, or divert resources from other development efforts to address issues related to AI governance. If we are unable to mitigate these risks, or if we incur excessive expenses in our efforts to do so, our reputation, business, operating results, and financial condition may be harmed.

Previous wording

We rely on third-party providers—including Salesforce and Amazon Web Services—for computing infrastructure, secure network connectivity, and other technology-related services needed to deliver our cloud solutions. Any disruption in the services provided by such third-party providers could adversely affect our business and subject us to liability.

Current wording

We rely on third-party providers—including Amazon Web Services and Salesforce—for computing infrastructure, secure network connectivity, and other technology-related services needed to deliver our cloud solutions. Any disruption in the services provided by such third-party providers could adversely affect our business and subject us to liability.

Previous wording

However, we have begun to migrate our Veeva CRM customers to Vault CRM, which is built on our Veeva Vault platform, and we do not intend to renew our agreement with Salesforce when the current term expires on September 1, 2025. Pursuant to the terms of our agreement, during the wind-down period from September 1, 2025 to September 1, 2030, we may not sell applications that utilize the Salesforce platform to new customers and our sales of applications that utilize the Salesforce platform to a customer existing at September 1, 2025 may not exceed 150% of the seats in use by each such customer as of September 1, 2025. After September 1, 2030, we will not be able to sell applications that utilize the Salesforce platform to any customers.

Current wording

We are currently dependent upon the Salesforce platform to deliver Veeva CRM. However, we have begun to migrate our Veeva CRM customers to Vault CRM, which is built on our Veeva Vault platform. Our agreement with Salesforce expired on September 1, 2025, and pursuant to the terms of our agreement, during the wind-down period from September 1, 2025 to September 1, 2030, we may not sell applications that utilize the Salesforce platform tonew customers and our sales of applications that utilize the Salesforce platform to a customer existing at September 1, 2025 may not exceed 150% of the seats in use by each such customer as of September 1, 2025.

Previous wording

Salesforce also has the right to terminate the agreement early in certain circumstances, including in the event of a material breach of the agreement by us, or if Salesforce is subjected to third-party intellectual property infringement claims based on our solutions (except to the extent based on the Salesforce platform) or our trademarks and we do not remedy such infringement in accordance with the agreement. Also, if we are acquired by specified companies, Salesforce may terminate the agreement upon notice of not less than 12 months. If the Salesforce platform for Veeva CRM becomes unavailable earlier than we anticipate, our business and operations would be adversely affected.

Current wording

Salesforce also has the right, in certain circumstances, to terminate the wind-down period early, including in the event of a material breach of the agreement by us, or if Salesforce is subjected to third-party intellectual property infringement claims based on our solutions (except to the extent based on the Salesforce platform) or our trademarks and we do not remedy such infringement in accordance with the agreement. Also, if we are acquired by specified companies, Salesforce may terminate the agreement upon notice of not less than 12 months. If the Salesforce platform for Veeva CRM becomes unavailable earlier than we anticipate, our business and operations would be adversely affected.

Previous wording

For example, certain of our contracting terms include an annual inflation adjustment that raises the price to each customer upon renewal by the lower of 4% or the Consumer Price Index (All Urban Consumer, U.S. City Average, All Items Index) published by the U.S. Bureau of Labor Statistics for the month of August of the prior calendar year. If this increase results in reduced renewal rates, our business and results of operations will be adversely affected. Further, our customers may negotiate terms less advantageous to us upon renewal, which could reduce our revenues from these customers. As a customer’s total spend on Veeva solutions increases, we expect purchasing scrutiny at renewal to increase as well, which may result in reductions in user subscriptions or increased pricing pressure. Other factors that are not within our control may contribute to a reduction in our subscription services revenues. For instance, our customers may reduce their number of sales representatives, which would result in a corresponding reduction in the number of user subscriptions needed for some of our solutions and thus a lower aggregate renewal fee, or our customers may discontinue clinical trials for which our solutions are being used. In addition, our master subscription agreements governing multi-year orders generally include a right to terminate for convenience. Certain customers have exercised that right prior to the contracted end date, and other customers may also choose to do so in the future.

Current wording

For example, certain of our contracting terms include an annual inflation adjustment that raises the price to each customer upon renewal by the lower of 4% or the Consumer Price Index (All Urban Consumer, U.S. City Average, All Items Index) published by the U.S. Bureau of Labor Statistics for the month of August of the prior calendar year. If this increase results in reduced renewal rates, our business and results of operations will be adversely affected. Further, our customers may negotiate terms less advantageous to us upon renewal, which could reduce our revenues from these customers. As a customer’s total spend on Veeva solutions increases, we expect purchasing scrutiny at renewal to increase as well, which may result in reductions in user subscriptions or increased pricing pressure. Other factors that are not within our control may contribute to a reduction in our subscription services revenues. For instance, our customers may reduce their number of sales representatives, which would result in a corresponding reduction in the number of user subscriptions needed for some of our solutions and thus a lower aggregate renewal fee, or our customers may discontinue clinical trials for which our solutions are being used. In addition, certain customers have in the past exercised their right to reduce usage or exercise termination rights, and other customers may also choose to do so in the future. Our master subscription agreements governing multi-year orders generally include a right to terminate for convenience. In addition, pursuant to the EU Data Act, which came

Previous wording

Our income tax provision could also be impacted by changes in accounting principles and changes in U.S. federal and state or international tax laws applicable to multinational corporations. For example, the One Big Beautiful Bill Act includes significant tax provisions such as the permanent extension of certain expiring provisions of the Tax Cuts and Jobs Act of 2017 (TCJA), modifications to the international tax framework and restoration of immediate expensing for domestic research and development expenditures, which were previously required to be capitalized and amortized over five years under TCJA. Changes in the interpretation or implementation of this new law may impact the calculation of our tax payments and our financial results.

Current wording

Our income tax provision could also be impacted by changes in accounting principles and changes in U.S. federal and state or international tax laws applicable to multinational corporations. For example, the One Big Beautiful Bill Act includes significant tax provisions such as the permanent extension of certain expiring provisions of the Tax Cuts and Jobs Act of 2017 (“TCJA”), modifications to the international tax framework and restoration of immediate expensing for domestic research and development expenditures, which were previously required to be capitalized and amortized over five years under TCJA. Changes in the interpretation or implementation of this new law have impacted in the past and may impact in the future the calculation of our tax payments and our financial results.

Previous wording

As a public company, we are required to maintain internal controls over financial reporting and to report any material weaknesses in such internal controls. Section 404 of the Sarbanes-Oxley Act of 2002 (Sarbanes-Oxley Act) requires that we evaluate and determine the effectiveness of our internal controls over financial reporting and provide a

Current wording

As a public company, we are required to maintain internal controls over financial reporting and to report any material weaknesses in such internal controls. Section 404 of the Sarbanes-Oxley Act of 2002 (“Sarbanes-Oxley Act”) requires that we evaluate and determine the effectiveness of our internal controls over financial reporting and

Previous wording

management report on internal controls over financial reporting. The Sarbanes-Oxley Act also requires that our management report on internal controls over financial reporting be attested to by our independent registered public accounting firm.

Current wording

provide a management report on internal controls over financial reporting. The Sarbanes-Oxley Act also requires that our management report on internal controls over financial reporting be attested to by our independent registered public accounting firm.

Previous wording

There is considerable patent and other intellectual property development activity in our industry. Our competitors, as well as a number of other entities and individuals, including so-called non-practicing entities, may own or claim to own intellectual property relating to our solutions. From time to time, third parties have claimed, and may in the future claim, that we are infringing upon their intellectual property rights or that we have misappropriated their intellectual property. For example, our competitors have asserted trade secret misappropriation claims against us in the past. We are also in discussions with a non-practicing entity relating to alleged infringement of its patents. As competition in our market grows and as we develop new technology products, the possibility of patent infringement and other intellectual property claims against us increases. In the future, we expect others to claim that our solutions and underlying technology infringe or violate their intellectual property rights. We may be unaware of the intellectual property rights that others may claim cover some or all of our technology or services. Such claims and litigation have caused and in the future could cause us to incur significant expenses and, if successfully asserted against us, could require that we pay substantial damages or ongoing royalty payments, prevent us from offering our services, or require that we comply with other unfavorable terms. We may also be obligated to indemnify our customers or business partners or pay substantial settlement costs, including royalty payments, in connection with any such claim or litigation and to obtain licenses, modify applications, or refund fees, which could be costly. Any litigation regarding our intellectual property could be costly and time-consuming and divert the attention of our management and key personnel from our business operations even if we were to ultimately prevail in such litigation.

Current wording

There is considerable patent and other intellectual property development activity in our industry. Our competitors, as well as a number of other entities and individuals, including so-called non-practicing entities, may own or claim to own intellectual property relating to our solutions. From time to time, third parties have claimed, and may in the future claim, that we are infringing upon their intellectual property rights or that we have misappropriated their intellectual property. For example, our competitors have asserted trade secret misappropriation claims against us in the past. We are also aware of a non-practicing entity alleging that we infringed its patents. As competition in our market grows and as we develop new technology products, the possibility of patent infringement and other intellectual property claims against us increases. In the future, we expect others to claim that our solutions and underlying technology infringe or violate their intellectual property rights. We may be unaware of the intellectual property rights that others may claim cover some or all of our technology or services. Such claims and litigation have caused and in the future could cause us to incur significant expenses and, if successfully asserted against us, could require that we pay substantial damages or ongoing royalty payments, prevent us from offering our services, or require that we comply with other unfavorable terms. We may also be obligated to indemnify our customers or business partners or pay substantial settlement costs, including royalty payments, in connection with any such claim or litigation and to obtain licenses, modify applications, or refund fees, which could be costly. Any litigation regarding our intellectual property could be costly and time-consuming and divert the attention of our management and key personnel from our business operations even if we were to ultimately prevail in such litigation.

Previous wording

Our success and ability to compete depend in part upon our intellectual property. As of July 31, 2025, we have filed numerous domestic and foreign patent applications and have been issued 98 U.S. patents and 11 international patents. We also rely on copyright, trade secret and trademark laws, trade secret protection and confidentiality or license agreements with our employees, customers, partners, consultants and others to protect our intellectual property rights. However, the steps we take to protect our intellectual property rights may be inadequate and we may not be able to prevent the unauthorized disclosure or use of our technical knowledge, trade secrets or other confidential information. Further, if there is a breach or violation of the terms of our confidentiality agreements, we may not have adequate remedies.

Current wording

Our success and ability to compete depend in part upon our intellectual property. As of October 31, 2025, we have filed numerous domestic and foreign patent applications and have been issued 105 U.S. patents and 11 international patents. We also rely on copyright, trade secret and trademark laws, trade secret protection and confidentiality or license agreements with our employees, customers, partners, consultants and others to protect our intellectual property rights. However, the steps we take to protect our intellectual property rights may be inadequate and we may not be able to prevent the unauthorized disclosure or use of our technical knowledge, trade secrets or other confidential information. Further, if there is a breach or violation of the terms of our confidentiality agreements, we may not have adequate remedies.