VEEVA SYSTEMS INC

Previous wording

The markets in which we participate are highly competitive, and if we do not compete effectively, our business and operating results could be adversely affected.

Current wording

•We face intense competition in markets in which we operate—particularly in the CRM market as we transition customers from our legacy CRM application to our Vault CRM application—and if we do not compete effectively, we may lose customers and our business and operating results could be adversely affected.

Previous wording

•Nearly all of our revenues are generated by sales to customers in the life sciences industry, and factors that adversely affect this industry(including government funding and staffing of relevant agencies and research, drug pricing regulation, healthcare funding and eligibility reforms, or other regulatory or policy changes) could also adversely affect us.

Current wording

•Nearly all of our revenues are generated by sales to customers in the life sciences industry, and factors that adversely affect this industry(including government funding and staffing of relevant agencies and research, drug pricing regulation, healthcare funding and eligibility reforms, regulation of pharmaceutical advertising, or other regulatory or policy changes) could also adversely affect us.

Previous wording

•Uncertain macroeconomic and geopolitical factors, including as a result of changes in trade policies and practices (including the imposition of tariffs), worldwide inflationary pressures, currency exchange fluctuations, changes in interest rates or other economic policies, geopolitical conflicts (like the Russian invasion of Ukraine and the regional conflict in the Middle East), and concerns about a possible domestic or global recession, may cause instability in the global economy, and disruptions within the life sciences industry that may negatively impact our business, our financial results, and our stock price.

Current wording

•Uncertain macroeconomic and geopolitical factors, including as a result of changes in trade policies and practices (including the imposition of additional tariffs or threats to impose additional tariffs), worldwide inflationary pressures, currency exchange fluctuations, changes in interest rates or other economic policies, geopolitical conflicts (like the conflict in the Middle East), and concerns about a possible domestic or global recession, may cause instability in the global economy, and disruptions within the life sciences industry that may negatively impact our business, our financial results, and our stock price.

Previous wording

•The migration of our customers to our Vault CRM applications built on our own Veeva Vault platform could cause business disruptions for customers, lead to the loss of our customers to competitors, and adversely affect our operating results.

Current wording

•The migration of our customers to our Vault CRM applications built on our own Veeva Vault platform could cause business disruptions for customers and adversely affect our operating results.

Previous wording

Unauthorized access or other security breaches or incidents, as a result of third-party action (e.g., cyberattacks, or the introduction into our networks or systems of ransomware or other malware), employee or contractor error or malfeasance, product defect, or otherwise, have resulted in and could in the future result in the loss of information or intellectual property, inappropriate access to or use, disclosure, unavailability, modification, destruction, or other processing of information, service interruption, degradation, disruption, and outages, service level credits, claims, demands, litigation, regulatory investigations and other proceedings, indemnity obligations, damage to our reputation, and other liability. It is possible that our risk of cyberattacks and other sources of security breaches and incidents may be elevated as a result of Russia’s invasion of Ukraine, the regional conflict in the Middle East, or other geopolitical tensions or conflicts, due to an increase in cyberattack attempts on us, our customers, our partners, or our technology infrastructure providers.

Current wording

Unauthorized access or other security breaches or incidents, as a result of third-party action (e.g., cyberattacks, or the introduction into our networks or systems of ransomware or other malware), employee or contractor error, omissions, or malfeasance, product defect, or otherwise, have resulted in and could in the future result in the loss of information or intellectual property, inappropriate use, disclosure, unavailability, modification, destruction, or other processing of information, service interruption, degradation, disruption, and outages, service level credits, claims, demands, litigation, regulatory investigations and other proceedings, indemnity obligations, damage to our reputation, and other liability. It is possible that our risk of cyberattacks and other sources of security breaches and incidents may be elevated as a result of the conflict in the Middle East, or other geopolitical tensions or conflicts.

Previous wording

While we maintain and continue to improve our security measures, we may be unable to adequately anticipate security threats or to implement adequate preventative measures, in part, because the techniques used to obtain unauthorized access or sabotage systems change frequently and are becoming increasingly sophisticated and complex, and generally are not identified until they are launched against a target. For instance, as artificial intelligence (“AI”) technologies, including generative AI models, develop rapidly, threat actors are using these technologies to create sophisticated new attack methods that are increasingly automated, targeted, coordinated, and difficult to defend against. Moreover, our efforts to detect, prevent, and remediate known or unknown security vulnerabilities, including those arising from third-party hardware or software in our supply chain, may be insufficient to prevent security breaches or incidents resulting from such vulnerabilities, and may result in additional direct or indirect costs and liabilities and time of management and technical personnel. We may be required to expend significant capital and financial resources to protect against the foregoing threats and to alleviate problems caused by actual or perceived security breaches or incidents. Additionally, we and our service providers may face difficulties or delays in identifying, remediating, and otherwise responding to any cybersecurity attack or other security breach or incident.

Current wording

While we maintain and continue to improve our security measures, we may be unable to adequately anticipate security threats or to implement adequate preventative measures, in part, because the techniques used to obtain unauthorized access or sabotage systems change frequently, are becoming increasingly sophisticated and complex, and generally are not identified until they are launched against a target. For instance, as AI technologies, including generative AI models, develop rapidly, threat actors are using these technologies to create sophisticated new attack methods that are increasingly automated, faster to execute, large in scope, targeted, coordinated, and difficult to defend against. The proliferation of these technologies could enable less skilled threat actors to initiate attacks and increase the frequency, scale, and impact of security incidents. Moreover, our efforts to detect, prevent, and remediate known or unknown security vulnerabilities, including those arising from third-party hardware or software in our supply chain, may be insufficient to prevent security breaches or incidents resulting from such vulnerabilities, and may result in additional direct and indirect costs and liabilities and time of management and technical personnel. We may be required to expend significant capital and financial resources to protect against the foregoing threats and to alleviate problems caused by actual or perceived security breaches or incidents. Additionally, we and our service providers may face difficulties or delays in identifying, remediating, and otherwise responding to any cybersecurity attack or other security breach or incident.

Previous wording

•The markets in which we participate are highly competitive, and if we do not compete effectively, our business and operating results could be adversely affected.

Current wording

We face intense competition in markets in which we operate and if we do not compete effectively, we may lose customers and our business and operating results could be adversely affected.

Previous wording

The markets for our solutions are highly competitive. In new sales cycles within our largest product categories, we generally compete with other cloud-based solutions from providers that make applications geared toward the life sciences industry. Our CRM solutions primarily compete with Salesforce, which has developed a life sciences industry-specific CRM application. IQVIA, which historically offered a competitive CRM solution, has licensed its CRM software to Salesforce and intends to jointly market a CRM solution for life sciences with Salesforce. Our Veeva Data Cloud products as well as Veeva Crossix, compete with IQVIA, Ipsos Group S.A., Definitive Health Corp., and smaller data and data analytics providers. IQVIA, Dassault Systèmes, OpenText Corporation, Oracle Corporation, Honeywell International Inc., and other smaller application providers offer applications that compete with certain of our Veeva Development Cloud or Veeva Quality Cloud applications. Our Veeva Commercial Cloud, Veeva Development Cloud, and Veeva Quality Cloud applications also compete to replace client server-based legacy solutions offered by companies such as Oracle, Microsoft Corporation, and other smaller application providers. Our customers may also choose to use cloud-based applications or platforms that are not life sciences specific—such as Salesforce, Box.com, Amazon Web Services, or Microsoft—for certain of the functions our applications provide. Our business consulting and professional services offerings compete with a range of professional services firms, which include, at times, some of our partners. With the introduction of new technologies, we expect competition to intensify in the future, and we may face competition from new market entrants as well.

Current wording

The markets for our solutions are highly competitive. In new sales cycles within our largest product categories, we generally compete with other cloud-based solutions from providers that make applications geared toward the life sciences industry. Our CRM solutions primarily compete with Salesforce, Inc., which has developed a life sciences industry-specific CRM application. IQVIA Holdings Inc., which historically offered a competitive CRM solution, has licensed its CRM software to Salesforce. Our Veeva Data Cloud products as well as Veeva Crossix, compete with IQVIA, Ipsos Group S.A., Definitive Health Corp., and smaller data and data analytics providers. IQVIA, Dassault Systèmes, OpenText Corporation, Oracle Corporation, Honeywell International Inc., and other smaller application providers offer applications that compete with certain of our Veeva Development Cloud or Veeva Quality Cloud applications. Our Veeva Commercial Cloud, Veeva Development Cloud, and Veeva Quality Cloud applications also compete to replace client server-based legacy solutions offered by companies such as Oracle, Microsoft Corporation, and other smaller application providers. Our customers may also choose to use cloud-based applications or platforms that are not life sciences specific—such as Salesforce, Box.com, Amazon Web Services, or Microsoft—for certain of the functions our applications provide. Our business consulting and professional services offerings compete with a range of professional services firms, which include, at times, some of our partners. With the introduction of new technologies, we expect competition to intensify in the future, and we may face competition from new market entrants as well.

Previous wording

As we transition from our legacy Veeva CRM application to our Vault CRM application, as discussed in more detail below, certain customers have chosen, and other customers may in the future choose, to purchase CRM solutions from a competitor. For example, Salesforce, our primary CRM competitor, has announced that certain large Veeva CRM customers have committed to purchasing its CRM solutions.

Current wording

As we transition from our legacy Veeva CRM application to our Vault CRM application, as discussed in more detail below, certain customers have chosen, and other customers may in the future choose, to purchase CRM solutions from a competitor. For example, Salesforce, our primary CRM competitor, has announced that certain large Veeva CRM customers have committed to purchasing its CRM solutions and a number of our customers have informed us of their intent to move to Salesforce as their CRM provider.

Previous wording

If our competitors’ products, services, or technologies become more accepted than our solutions, if they are successful in bringing their products or services to market earlier than we are, if their products or services are more technologically capable than ours (including as a result of new or better use of evolving AI technologies), or if customers replace our solutions with custom-built software, then our revenues could be adversely affected. Moreover, if we enter new markets, we will likely face competition and will need to adapt to competitive factors that may be different from those we face today. Pricing pressures and increased competition could result in reduced sales, reduced margins, losses, or a failure to maintain or improve our competitive market position, any of which could adversely affect our business. For all of these reasons, we may not be able to compete favorably against our current and future competitors.

Current wording

If our actual or potential competitors’ products, services, or technologies become more accepted than our solutions, if they are successful in bringing their products or services to market earlier than we are, if their products or services are more technologically capable than ours (including as a result of new or better use of evolving AI technologies), or if customers replace our solutions with custom-built software, then our revenues could be adversely affected. Moreover, if we enter new markets, we will likely face competition and will need to adapt to competitive factors that may be different from those we face today. Pricing pressures and increased competition could result in reduced sales, reduced margins, losses, or a failure to maintain or improve our competitive market position, any of which could adversely affect our business. For all of these reasons, we may not be able to compete favorably against our current and future competitors.

Previous wording

We have from time to time found defects in our solutions, and new defects may be detected in the future. In addition, we have experienced, and may in the future experience, service disruptions, degradations, outages, and other performance problems. These types of problems may be caused by a variety of factors, including human or software errors, viruses, cyberattacks, fraud, spikes in customer usage, problems associated with our third-party computing infrastructure and network providers, infrastructure changes, and denial of service issues. Service disruptions may result from errors we make in delivering, configuring, or hosting our solutions, or designing, installing, expanding, or maintaining our computing infrastructure. In some instances, we may not be able to identify the cause or causes of these performance problems within an acceptable period of time. It is also possible that such problems could result in losses of customer data.

Current wording

We have from time to time found defects in our solutions, and new defects may be detected in the future. In addition, we have experienced, and may in the future experience, service disruptions, degradations, outages, and other performance problems, including from routine maintenance. These types of problems may be caused by a variety of factors, including human or software errors, viruses, cyberattacks, fraud, spikes in customer usage, problems associated with our third-party computing infrastructure and network providers, infrastructure changes, and denial of service issues. Service disruptions may result from errors we make in delivering, configuring, or hosting our solutions, or designing, installing, expanding, or maintaining our computing infrastructure. In some instances, we may not be able to identify the cause or causes of these performance problems within an acceptable period of time. It is also possible that such problems could result in losses of customer data.

Previous wording

Since our customers use our solutions for important aspects of their businesses, any errors, defects, disruptions, service degradations, or other performance problems with our solutions, could hurt our reputation and may damage our customers’ businesses. Such issues have in the past, and may in the future, result in increased operational costs, delays in delivering new products, our customers delaying or withholding payment to us, cancelling their agreements with us, electing not to renew, or making service credit claims, warranty claims, or other claims against us, and loss of future sales. The occurrence of any of these events could result in diminishing demand for our solutions, a reduction of our revenues, an increase in our bad debt expense or in collection cycles for accounts receivable, or could require us to incur the expense of litigation or substantial liability.

Current wording

Since our customers use our solutions for important aspects of their businesses, any errors, defects, disruptions, service degradations, or other performance problems with our solutions, could hurt our reputation and may damage our customers’ businesses. Such issues have in the past, and may in the future, result in increased operational costs, delays in delivering new products, our customers delaying or withholding payment to us, cancelling their agreements with us, electing not to renew, or making service credit claims, warranty claims, or other claims against us, and loss of future sales. The occurrence of any of these events could result in diminishing demand for our

Previous wording

In our fiscal years ended January 31, 2025, 2024, and 2023, our top 10 customers accounted for 28%, 28%, and 29% of our total revenues, respectively. We rely on our reputation and recommendations from key customers in order to promote our solutions to potential customers, which we call “reference selling.” The loss of any of our key customers, or a failure of one or more of them to renew or expand user subscriptions for some or all our products, could have a significant impact on the growth rate of our revenues, our reputation, and our ability to obtain new customers. In the event of an acquisition of one of our customers or a business combination between two of our customers, we have in the past and may in the future suffer reductions in user subscriptions or nonrenewal of certain or all of their subscription orders. We are also likely to face increasing purchasing scrutiny at the renewal of large customer subscription orders, which may result in reductions in user subscriptions or increased pricing pressure. The business impact of any of these negative events could be particularly pronounced with respect to our largest customers.

Current wording

In each of our fiscal years ended January 31, 2026, 2025, and 2024, our top 10 customers accounted for 28% of our total revenues. We rely on our reputation and recommendations from key customers in order to promote our solutions to potential customers, which we call “reference selling.” The loss of any of our key customers, or a failure of one or more of them to renew or expand user subscriptions for some or all our products, could have a significant impact on the growth rate of our revenues, our reputation, and our ability to obtain new customers. In the event of an acquisition of one of our customers or a business combination between two of our customers, we have in the past and may in the future suffer reductions in user subscriptions or nonrenewal of certain or all of their subscription orders. We are also likely to face increasing purchasing scrutiny at the renewal of large customer subscription orders, which may result in reductions in user subscriptions or increased pricing pressure. The business impact of any of these negative events could be particularly pronounced with respect to our largest customers.

Previous wording

Our sales process entails planning discussions with prospective customers, analyzing their existing solutions, and identifying how these potential customers could use and benefit from our solutions. The sales cycle for a new customer, from the time of prospect qualification to the completion of the first sale, may span 12 months or longer. Sales cycles for our newer applications or in newer markets or industries are also lengthy and difficult to predict. We spend substantial time, effort, and expense in our sales efforts without any assurance that our efforts will result in the sale of our solutions. In addition, our sales cycle can vary substantially from customer to customer because of various factors, including the discretionary nature of potential customers’ purchasing and budget decisions, the macroeconomic and regulatory environments, the availability of funding in the life sciences industry, the announcement or planned introduction of new solutions by us or our competitors, and the purchasing approval

Current wording

Our sales process entails planning discussions with prospective customers, analyzing their existing solutions, and identifying how these potential customers could use and benefit from our solutions. The sales cycle for a new customer, from the time of prospect qualification to the completion of the first sale, may span 12 months or longer. Sales cycles for our newer applications or in newer markets or industries are also lengthy and difficult to predict. We spend substantial time, effort, and expense in our sales efforts without any assurance that our efforts will result in the sale of our solutions. In addition, our sales cycle can vary substantially from customer to customer because of various factors, including the discretionary nature of potential customers’ purchasing and budget decisions, the macroeconomic and regulatory environments, the availability of funding in the life sciences industry, the announcement or planned introduction of new solutions by us or our competitors, and the purchasing approval processes of potential customers. If our sales cycle lengthens or we invest substantial resources pursuing unsuccessful sales opportunities, our operating results and growth would be harmed.

Previous wording

In our fiscal year ended January 31, 2025, customers outside North America accounted for approximately 41% of our total revenues. A key element of our growth strategy is to further expand our international operations and worldwide customer base. Operating in international markets requires significant resources and management attention and subjects us to regulatory, economic, and political risks that are different from those in the United States. We have limited operating experience in some international markets, and we cannot assure you that our expansion efforts into additional international markets will be successful. Our experience in the United States and other international markets in which we already have a presence may not be relevant to our ability to expand in other markets. Our efforts may not be successful in creating further demand for our solutions outside of the United States or in effectively selling our solutions in the international markets we enter.

Current wording

In our fiscal year ended January 31, 2026, customers outside North America accounted for approximately 40% of our total revenues. A key element of our growth strategy is to further expand our international operations and worldwide customer base. Operating in international markets requires significant resources and management attention and subjects us to regulatory, economic, and political risks that are different from those in the United States. We have limited operating experience in some international markets, and we cannot assure you that our expansion efforts into additional international markets will be successful. Our experience in the United States and other international markets in which we already have a presence may not be relevant to our ability to expand in other markets. Our efforts may not be successful in creating further demand for our solutions outside of the United States or in effectively selling our solutions in the international markets we enter.

Previous wording

•difficulties in repatriating funds without adverse tax consequences or restrictions on the transfer of funds more generally, including as a result of sanctions, including those arising from the Russian invasion of Ukraine, which may limit our ability to receive payment from Russian banks;

Current wording

•difficulties in repatriating funds without adverse tax consequences or restrictions on the transfer of funds more generally, including as a result of sanctions;

Previous wording

•changes in diplomatic relations and trade policy, including the status of relations between the United States and other countries, including China and Russia, and the implementation of or changes to tariffs, export controls, trade sanctions, and embargoes, including if the United States and other countries were to impose more significant general sanctions against Russia in response to the continuing conflict in Ukraine, which could ban the use of our products by companies or users in Russia;

Current wording

•changes in diplomatic relations and trade policy, including the status of relations between the United States and other countries, including China and Russia, and the implementation or threatened implementation of tariffs, export controls, trade sanctions, and embargoes;

Previous wording

•unstable regional and economic political conditions or armed conflicts in the markets in which we operate, including as a result of the Russian invasion of Ukraine and the regional conflict in the Middle East.

Current wording

•unstable regional and economic political conditions or armed conflicts in the markets in which we operate, including as a result of the conflict in the Middle East.

Previous wording

The migration of our CRM customers to our Vault CRM applications built on our own Veeva Vault platform could cause business disruptions for customers, lead to the loss of our customers to competitors, and adversely affect our operating results.

Current wording

The migration of our CRM customers to our Vault CRM applications built on our own Veeva Vault platform could cause business disruptions for customers and adversely affect our operating results.

Previous wording

We currently depend on the Salesforce platform to deliver our Veeva CRM application, but we have begun to migrate our CRM customers to our Vault CRM solutions, which are built on our Veeva Vault platform. Veeva CRM will be supported until September 1, 2030. The migration of our Veeva CRM customers will require time and expense, which may be significant. These migration processes are complex and we cannot be certain that we will be successful. Further, certain customers have decided, and other customers may in the future decide, not to migrate to Vault CRM and use a different CRM solution, including a CRM solution provided by Salesforce. Additionally, the migration may lead to outages or performance problems with Vault CRM or other Vault applications if we encounter difficulties supporting the increased volume of users migrating from Veeva CRM. Any disruptions in our services or other migration-related problems, whether or not such incidents are our fault, could subject us to liability or harm our reputation. If we are unsuccessful migrating our Veeva CRM customers to Vault CRM, encounter disruptions or other problems in the migration process, or our customers do not migrate to the Vault CRM in a timely manner, or at all, our business, operating results, and brand could be materially and adversely affected.

Current wording

We use the Salesforce platform to deliver our Veeva CRM application, but we are migrating our CRM customers to our Vault CRM solutions, which are built on our Veeva Vault platform. Veeva CRM will be supported until December 31, 2029. The migration of our Veeva CRM customers will require time and expense, which may be significant. These migration processes are complex and we cannot be certain that we will be successful. Additionally, the migration may lead to outages or performance problems with Vault CRM or other Vault applications if we encounter difficulties supporting the increased volume of users migrating from Veeva CRM. Any disruptions in our services or other migration-related problems, whether or not such incidents are our fault, could subject us to liability or harm our

Previous wording

Our corporate headquarters are located in Pleasanton, California and our primary third-party hosted computing infrastructure is located in the United States, the European Union, Japan, and South Korea. The west coast of the United States, Japan, and South Korea each contain active earthquake zones. Additionally, we rely on our network and third-party infrastructure and enterprise applications, internal technology systems, and our website, for our development, marketing, operational support, hosted services, and sales activities. In the event of a major earthquake, hurricane, or other natural disaster, or catastrophic event such as an actual or threatened public health emergency (e.g., a global pandemic), fire, extreme weather event, power loss, telecommunications failure, cyberattack, armed conflicts (including the Russian invasion of Ukraine and the regional conflict in the Middle East), or terrorist attack, we may be unable to continue our operations at full capacity or at all and may experience system interruptions, reputational harm, delays in our solution development, lengthy interruptions in our services, breaches

Current wording

Our corporate headquarters are located in Pleasanton, California and our primary third-party hosted computing infrastructure is located in the United States, the European Union, Japan, and South Korea. The west coast of the United States, Japan, and South Korea each contain active earthquake zones. Additionally, we rely on our network and third-party infrastructure and enterprise applications, internal technology systems, and our website, for our development, marketing, operational support, hosted services, and sales activities. In the event of a major earthquake, hurricane, or other natural disaster, or catastrophic event such as an actual or threatened public health emergency (e.g., a global pandemic), fire, extreme weather event, power loss, telecommunications failure, cyberattack, armed conflicts (including the conflict in the Middle East), or terrorist attack, we may be unable to continue our operations at full capacity or at all and may experience system interruptions, reputational harm, delays in our solution development, lengthy interruptions in our services, breaches of data security, loss of key employees, and loss of critical data, all of which could have an adverse effect on our future operating results.

Previous wording

We have limited experience in acquiring other businesses. We may not be able to successfully integrate the acquired personnel, operations, and technologies, or effectively manage the combined business following the acquisition. We also may not achieve the anticipated benefits from the acquired business due to a number of factors, including:

Current wording

We have limited experience in acquiring other businesses. We may not be able to successfully integrate the acquired personnel, operations, and technologies, or effectively manage the combined business following the

Previous wording

acquisitions do not yield expected returns, we may be required to take charges to our operating results based on this impairment assessment process, which could adversely affect our results of operations. Acquisitions may also result in purchase accounting adjustments, write-offs or restructuring charges, which may negatively affect our results.

Current wording

Moreover, a significant portion of the purchase price of companies we acquire may be allocated to acquired intangible assets and goodwill, which we must assess for impairment at least annually. In the future, if our acquisitions do not yield expected returns, we may be required to take charges to our operating results based on this impairment assessment process, which could adversely affect our results of operations. Acquisitions may also result in purchase accounting adjustments, write-offs or restructuring charges, which may negatively affect our results.

Previous wording

Our success depends in a large part upon the continued service of our senior management team and other key personnel. For example, our founder and Chief Executive Officer, Peter P. Gassner, is critical to our vision, strategic direction, culture, products, and technology. Leadership transitions can be inherently difficult to manage, and an unsuccessful transition may cause disruption to our business. If our succession planning for key personnel is inadequate, the loss of one or more of our key employees could harm our business. In addition, changes in our senior management team may create uncertainty among our customers, investors, employees, or job candidates concerning Veeva’s future direction and performance. Any disruption in our operations or uncertainty around our ability to execute could have an adverse effect on our business, financial condition, or results of operations.

Current wording

Our success depends in a large part upon the continued service of our senior management team and other key personnel. For example, our founder and Chief Executive Officer, Peter P. Gassner, is critical to our vision, strategic direction, culture, products, and technology. Leadership transitions can be inherently difficult to manage, and an unsuccessful transition may cause disruption to our business. If our succession planning for key personnel is inadequate, the loss of one or more of our key employees could harm our business. In addition, changes in our senior management team may create uncertainty among our customers, investors, employees, or job candidates

Previous wording

Once our solutions are deployed, our customers depend on our support organization to resolve technical issues relating to our solutions. We may be unable to sufficiently accommodate short-term increases in customer demand for technical support services to our customers’ satisfaction. Increased customer demand for our technical support services, without corresponding revenues, could increase costs and adversely affect our operating results. In addition, our sales process is highly dependent on the reputation of our solutions and business and on positive recommendations from our existing customers. Any failure to maintain high-quality technical support, or amarket perception that we do not maintain high-quality support, could adversely affect our reputation, our ability to sell our solutions to existing and prospective customers, and our business and operating results.

Current wording

Once our solutions are deployed, our customers depend on our support organization to resolve technical issues relating to our solutions. We may be unable to sufficiently accommodate short-term increases in customer demand for technical support services to our customers’ satisfaction. Increased customer demand for our technical support services, without corresponding revenues, could increase costs and adversely affect our operating results. In addition, our sales process is highly dependent on the reputation of our solutions and business and on positive recommendations from our existing customers. Any failure to maintain high-quality technical support, or a market perception that we do not maintain high-quality support, could adversely affect our reputation, our ability to sell our solutions to existing and prospective customers, and our business and operating results.

Previous wording

•Regulatory changes, government policies, and government funding decisions related to the life sciences industry—Changes in regulations could negatively impact the business environment for our life sciences customers and for us. Healthcare laws and regulations are rapidly evolving and may change significantly in the future. For example, regulatory changes with respect to life sciences advertising, such as limitations on or the elimination of the ability of pharmaceutical companies to engage in direct-to-consumer advertising, could negatively impact certain of our product offerings, including our Crossix business. Further, in recent years, there have been legislative and regulatory changes regarding the pricing of drugs and other healthcare treatments sold by life sciences companies, such as the drug pricing reforms in the Inflation Reduction Act, which went into effect in August 2022, drug pricing reforms proposed by the current administration, which would impose certain limits on drug prices in the U.S. relative to the prices paid in other countries, and drug price negotiations with the current administration and certain drug manufacturers. Other drug pricing reforms have been discussed and may be proposed in the future. Significant changes in drug pricing policy or regulation could result in lower revenues and profits for life sciences companies and reduced demand for our products. In addition, reductions in funding and staffing of government agencies and changes in the funding and eligibility for healthcare programs relevant to the life sciences industry—such as the Food and Drug Administration, the National Institutes of Health, and Medicaid—or changes in funding priorities relevant to the life sciences industry could adversely affect the life sciences industry.

Current wording

•Regulatory changes, government policies, and government funding decisions related to the life sciences industry—Changes in regulations could negatively impact the business environment for our life sciences customers and for us. Healthcare laws and regulations are rapidly evolving and may change significantly in the future. For example, regulatory changes with respect to life sciences advertising, such as limitations on or the elimination of the ability of pharmaceutical companies to engage in direct-to-consumer advertising, could negatively impact certain of our product offerings, including our Crossix business. Further, in recent years, there have been legislative and regulatory changes regarding the pricing of drugs and other healthcare treatments sold by life sciences companies, such as the drug pricing reforms in the Inflation Reduction Act, which went into effect in August 2022, drug pricing reforms proposed by the current administration, which would impose certain

Previous wording

perception regarding the practices of the life sciences industry may result in political pressure to increase the regulation of life sciences companies in one or more of the areas described above, which may negatively impact demand for our solutions. Other factors could lead to a significant reduction in sales representatives that use our solutions or otherwise change the demand for our solutions. For example, in recent years, certain life sciences companies have reduced the number of sales representatives they employ due to an increased preference for digitally-enabled sales channels, which negatively impacted sales of our solutions, including Veeva CRM and certain of our other Commercial Solutions.

Current wording

•Changes in market conditions and practices within the life sciences industry—The expiration of key patents, the implications of precision medicine treatments, changes in the practices of prescribing physicians and patients, changes with respect to payer relationships, and the policies and preferences of healthcare professionals and healthcare organizations with respect to the sales and marketing efforts of life sciences companies could negatively impact demand for our solutions. Changes in public perception regarding the practices of the life sciences industry may result in political pressure to increase the regulation of life sciences companies in one or more of the areas described above, which may negatively impact demand for our solutions. Other factors could lead to a significant reduction in sales representatives that use our solutions or otherwise change the demand for our solutions. For example, certain life sciences companies have reduced the number of sales representatives they employ due to an increased preference for digitally-enabled sales channels, which negatively impacted sales of our solutions, including Veeva CRM and certain of our other Commercial Solutions.

Previous wording

•Changes in trade policy or geopolitical conditions that impact the life sciences industry, changes in the ability to sell healthcare treatments in certain locations, and the global availability of healthcare treatments provided by the life sciences companies to which we sell—Tariffs imposed on the end products of the life sciences industry or on inputs relevant to the life sciences industry could increase costs for our customers or reduce demand for their products, which could delay or reduce their IT spending. If economic or geopolitical conditions deteriorate, or the ability to market life sciences products or conduct clinical trials in key markets is disrupted, including as a result of the Russian invasion of Ukraine; the regional conflict in the Middle East; changes in export controls; sanctions, or other international laws; or if the demand for life sciences products globally deteriorates for other reasons, our customers may delay or reduce their IT spending, particularly within the regions impacted by negative economic or geopolitical conditions. For example, a number of significant life sciences companies have scaled back sales, operations, and investments in Russia, including curtailing sales and marketing and clinical trial activity in Russia.

Current wording

•Changes in trade policy or geopolitical conditions that impact the life sciences industry, changes in the ability to sell healthcare treatments in certain locations, and the global availability of healthcare treatments provided by the life sciences companies to which we sell—Tariffs imposed on the end products of the life sciences industry or on inputs relevant to the life sciences industry could increase costs for our customers or reduce demand for their products, which could delay or reduce their IT spending. The imposition of tariffs or other trade measures could also provoke retaliatory responses from affected countries, including the imposition of digital services taxes, consumer boycotts resulting in depressed demand for products of the United States, or other measures that could negatively impact our business, operations, or financial condition. If economic or geopolitical conditions deteriorate, or the

Previous wording

As we increase the number of products we offer, increase the number of countries in which we operate, and incorporate new technologies and capabilities into our products (including the use of AI and machine learning technologies), the complexity of adjusting our solutions to comply with legal and regulatory changes will increase. If we are unable to effectively manage this increased complexity or if we are not able to provide solutions that can be used in compliance with applicable laws and regulations, customers may be unwilling to use our solutions, and any such non-compliance could result in the termination of our customer agreements or claims arising from such

Current wording

As we increase the number of products we offer, increase the number of countries in which we operate, and incorporate new technologies and capabilities into our products (including the use of AI and machine learning technologies), the complexity of adjusting our solutions to comply with legal and regulatory changes will increase. If we are unable to effectively manage this increased complexity or if we are not able to provide solutions that can be used in compliance with applicable laws and regulations, customers may be unwilling to use our solutions, and any such non-compliance could result in the termination of our customer agreements or claims arising from such agreements with our customers. Furthermore, we have in the past and may in the future be subject to inspections or audits by government agencies or other regulatory bodies to verify our customers’ compliance with applicable laws, regulations, or GxP principles.

Previous wording

Under the European General Data Protection Regulation (“EU GDPR”) and the United Kingdom’s General Data Protection Regulation (“UK GDPR”), as amended by the Data (Use and Access) Act 2025, we act as a data controller for our data products and a data processor with respect to our software products. Each of the GDPR and UK GDPR impose significant data protection obligations and provide for substantial penalties and other remedies for noncompliance. We maintain active self-certifications under the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework as set forth by the U.S. Department of Commerce. We also rely on EU, Swiss, and UK Standard Contractual Clauses, as well as our technical, contractual, and security measures, to help ensure that our European customers have the appropriate legal mechanisms in place for their personal data to be accessed from within the United States. We are required to take steps to legitimize any personal data transfers impacted by these developments and similar developments in other jurisdictions, and to engage in contract negotiations with third parties that aid in processing personal data on our behalf. We may be subject to increased costs of compliance and limitations on our service providers and us. In addition, these laws are complex, with the application and interpretation of them, at times, unclear and inconsistent, and significant penalties may be imposed for non-compliance. For example, in May 2023, the Irish Data Protection Commission imposed a significant fine on a large internet technology corporation for its failure to sufficiently address risks to EU data subjects when transferring data to the U.S.

Current wording

In addition, certain laws and regulations impose data localization obligations, cross-border data transfer restrictions, and other country-specific privacy and security requirements, which could be problematic to cloud software and data providers. In these cases, we are required to take steps to legitimize any personal data transfers in these jurisdictions, and to engage in contract negotiations with third parties that aid in processing personal data on our behalf. In China, for example, we offer the China CRM Suite, a CRM solution that does not require data to be transferred outside of China. We maintain active self-certifications under the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. Data Privacy Framework, and the Swiss-U.S. Data Privacy Framework as set forth by the U.S. Department of Commerce. We also rely on standard contractual clauses in various jurisdictions, such as the EU, Switzerland, the UK, and Brazil, as well as our technical, contractual, and security measures. These mechanisms help ensure that we, and our customers, have the appropriate legal frameworks in place for personal data to be transferred internationally.

Previous wording

U.S. federal and state data privacy laws are rapidly evolving. These laws impose new and modify existing obligations on businesses that collect personal information, create new privacy rights for individuals, and contain enhanced requirements for and restrictions on data brokers. For example, under the California Consumer Privacy Act (“CCPA”), as amended, we are generally considered a “service provider” for our software solutions and a “business” for our data products. Some of these laws and regulations also target certain types of marketing and advertising based on the use of personal information. The State of Washington, for example, passed the My Health My Data Act, which became effective on March 21, 2024, establishing significant new restrictions on how businesses can collect, use, and disclose consumer health data. Veeva Crossix’s data platform combines large-scale data sets, inclusive of de-identified health and consumer data, to provide insights, analytics, and audience segmentation for our life sciences customers in the U.S. In response to the Washington law, we made modifications to our audience segments that may reduce demand for our Crossix products, which, in turn, could adversely impact the business. Other states have considered, and in certain cases enacted, similar laws. Additionally, the U.S. Department of Justice recently issued a final rule that places limitations, and in some cases prohibitions, on certain transfers of and access to certain personal data of U.S. persons by persons and entities located in China (and other designated countries) or controlled by a person or entity located in China (and other designated countries). These various laws, regulations, and legislative developments have potentially far-reaching consequences and have and may continue to require us to modify our solutions, our global support business, and our data management practices and incur substantial expense in order to comply.

Current wording

In 2025, the U.S. Department of Justice issued a final rule that places limitations, and in some cases prohibitions, on certain transfers of and access to certain personal data of U.S. persons by persons and entities located in China (and other designated countries) or controlled by a person or entity located in China (and other designated countries). Additionally, the French governmental agency for health mandates a certification requiring that personal health data collected during healthcare activities be stored exclusively within the European Economic Area.

Previous wording

We also expect laws, regulations, industry standards and other obligations relating to privacy, data protection, and cybersecurity to continue to evolve, and that there will continue to be new, modified, and re-interpreted laws, regulations, standards, and other obligations in these areas. For example, the Network and Information Security Directive II (“NIS2”), adopted in 2023, aims to enhance cybersecurity across critical infrastructure and essential services in the EU. NIS2 provides for all 27 EU member states to have issued implementing legislation by October

Current wording

We expect these laws and regulations to continue to evolve, and that there will continue to be new, modified, and re-interpreted laws, regulations, standards, and other obligations relating to privacy, data protection, and cybersecurity, introducing uncertainty and increasing complexity. For example, the Network and Information Security Directive II (“NIS2”), adopted in 2023, aims to enhance cybersecurity across critical infrastructure and essential services in the EU. NIS2 provides for all 27 EU member states to have issued implementing legislation by October 2024; however, several EU member states have not finalized their respective legislation and guidance. The EU Data Act, which came into effect September 12, 2025, allows our EU customers to cancel their subscriptions without cause upon providing the notice and after the transition period specified by the Act. Furthermore, new and evolving regulations relating to the use of data in AI, such as the EU AI Act, are creating an increasingly complex and fragmented regulatory framework.

Previous wording

As we expand our data product offerings into new jurisdictions, we are required to assess, monitor, and comply with additional laws and regulations related to our collection and processing of data, which may include new registration, consent, and notification obligations.

Current wording

As we expand our data product offerings into new jurisdictions, we are required to assess, monitor, and comply with additional laws and regulations related to our collection and processing of data, which may include new registration, consent, and notification obligations. In addition to our own processing of personal data, our customers expect that

Previous wording

Customers expect that our solutions can be used in compliance with applicable data protection, data privacy and cybersecurity laws and regulations. Compliance with these global laws and regulations, including any new or evolving regulations relating to the use of data in AI and machine learning technologies, such as the EU AI Act, has and will continue to require valuable management and employee time and resources and modification of our products or operations, and may also limit use and adoption of our products. Data protection authorities from around the world will from time to time review our products and services and their compliance with applicable laws and regulations. Any actual or perceived failure to comply with such laws and regulations or other actual or asserted obligations relating to privacy, data protection, or cybersecurity could lead to inspections, audits, regulatory investigations and other proceedings, significant fines, penalties, and other relief imposed by government agencies and regulatory bodies, and claims, demands, and litigation by our customers or third parties, which may reduce demand for our solutions and result in reputational harm, substantial damages and other liabilities.

Current wording

These various laws, regulations, and legislative developments have potentially far-reaching consequences and have and may continue to require us to modify our solutions, our global support business, and our data management practices and incur substantial expense in our efforts to comply. Our work to comply with these global laws and regulations has and will continue to require valuable management and employee time and resources and modification of our products or operations and may also limit use and adoption of our products. Data protection authorities from around the world will from time to time review our products and services and their compliance with applicable laws and regulations. Any actual or perceived failure to comply with such laws and regulations or other actual or asserted obligations relating to privacy, data protection, cybersecurity, or our processing of data could lead to inspections, audits, regulatory investigations and other proceedings, significant fines, penalties, and other relief imposed by government agencies and regulatory bodies, and claims, demands, and litigation by our customers or third parties, which may reduce demand for our solutions and result in reputational harm, substantial damages and other liabilities.

Previous wording

In addition to governmental laws and regulations, privacy advocates and other key industry players have, and may continue to, establish various new standards and certifications, such as the prohibition of third-party cookies and other identifiers in certain digital environments, that may place additional burdens or resource constraints on us, limit our ability to collect, use, and otherwise process certain data, and limit our ability to generate certain analytics. Our customers may expect us to meet voluntary certifications or adhere to other standards established by third parties. Understanding and implementing industry and customer specific requirements and certifications on top of our internationally recognized security certifications could require additional investment and management attention and may subject us to significant liabilities if we are unable to comply. Moreover, the continuing evolution of these standards might cause confusion for our customers and may have an impact on the solutions we offer. If we are unable to maintain these certifications or meet these standards, it could reduce demand for our solutions and adversely affect our business and operating results.

Current wording

In addition to governmental laws and regulations, privacy advocates and other key industry players have, and may continue to, establish various new standards and certifications, such as the prohibition of third-party cookies and other identifiers in certain digital environments, that may place additional burdens or resource constraints on us, limit our ability to collect, use, and otherwise process certain data, and limit our ability to generate certain analytics. Our customers may expect us to meet voluntary certifications oradhere to other standards established by third parties. Understanding and implementing industry and customer specific requirements and certifications on top of our internationally recognized security certifications could require additional investment and management attention and may subject us to significant liabilities if we are unable to comply. Moreover, the continuing evolution of these standards might cause confusion for our customers and may have an impact on the solutions we offer. If we are unable to maintain these certifications or meet these standards, it could reduce demand for our solutions and adversely affect our business and operating results.

Previous wording

we may experience new or enhanced governmental or regulatory scrutiny, brand or reputational harm, competitive harm, or legal liability. If our users lose confidence in the decisions, predictions, analyses, or other content that our AI offerings produce, the adoption of our offerings could be adversely affected, which may harm our operating results and financial condition. We may also use AI for research and development and other internal operational use cases. The legal, regulatory, and policy environments around AI are evolving rapidly, and we may become subject to new and evolving legal and other obligations. These and other developments may require us to make significant changes to our use of AI, including by limiting or restricting our use of AI, and which may require us to make significant changes to our policies and practices, which may necessitate expenditure of significant time, expense, and other resources. Uncertainty around new and emerging AI applications and regulations may require us to make significant changes to our use of AI, including by limiting or restricting such use, and may cause us to incur increased research and development costs or compliance costs, or divert resources from other development efforts to address issues related to AI governance. If we are unable to mitigate these risks, or if we incur excessive expenses in our efforts to do so, our reputation, business, operating results, and financial condition may be harmed.

Current wording

Veeva AI, an initiative that adds AI to our applications across all major areas, including clinical, regulatory, safety, quality, medical, and commercial, presents new risks and challenges that could affect the adoption of our solutions and our business. If our AI offerings draw controversy due to their perceived or actual impact on privacy, security or confidentiality, inefficacy or inaccuracy, or contribution to bias, discrimination, other ethical harms, or other matters, we may experience new or enhanced governmental or regulatory scrutiny, brand or reputational harm, competitive harm, or legal liability. If our users lose confidence in the performance, including decisions, predictions, analyses, or other content that our AI offerings produce, the adoption of our offerings could be adversely affected, which may harm our operating results and financial condition. We may also use AI for research and development and other internal operational use cases, including the use of AI-enabled processes. The legal, regulatory, and policy environments around AI, such as the EU AI Act and legislation proposed and adopted in certain states in the U.S., are evolving rapidly and we may become subject to new and evolving legal and other obligations. These and other developments may force us to make significant changes to our AI strategy, including by limiting or restricting our use of AI or AI-enabled processes, which may cause us to incur increased research and development costs or compliance costs, divert resources from other development efforts to address issues related to AI governance, or otherwise necessitate expenditure of significant time, expense and other resources. If we are unable to mitigate these risks, or if we incur excessive expenses in our efforts to do so, our reputation, business, operating results, and financial condition may be harmed.

Previous wording

We are currently dependent upon the Salesforce platform to deliver Veeva CRM. However, we have begun to migrate our Veeva CRM customers to Vault CRM, which is built on our Veeva Vault platform. Our agreement with Salesforce expired on September 1, 2025, and pursuant to the terms of our agreement, during the wind-down period from September 1, 2025 to September 1, 2030, we may not sell applications that utilize the Salesforce platform tonew customers and our sales of applications that utilize the Salesforce platform to a customer existing at September 1, 2025 may not exceed 150% of the seats in use by each such customer as of September 1, 2025.

Current wording

We are currently dependent upon the Salesforce platform to deliver Veeva CRM. However, we have begun to migrate our Veeva CRM customers to Vault CRM, which is built on our Veeva Vault platform. Our agreement with Salesforce expired on September 1, 2025, and pursuant to the terms of our agreement, during the wind-down period from September 1, 2025 to September 1, 2030, we may not sell applications that utilize the Salesforce platform to new customers and our sales of applications that utilize the Salesforce platform to a customer existing at September 1, 2025 may not exceed 150% of the seats in use by each such customer as of September 1, 2025. After September 1, 2030, we will not be able to sell applications that utilize the Salesforce platform to any customers.

Previous wording

Our historic growth rates of total revenues and subscription services revenues should not be viewed as indicative of our future performance.

Current wording

Our historic growth rates of total revenues and subscription revenues should not be viewed as indicative of our future performance.

Previous wording

While we have experienced significant revenue growth in prior periods, it is not indicative of our future revenue growth. Our total revenues and subscription services revenue growth rates have declined in the past and may decline in the future. In our fiscal years ended January 31, 2025, 2024, and 2023, our total revenues grew by 16%, 10%, and 16% respectively, as compared to total revenues from the prior fiscal years. In our fiscal years ended January 31, 2025, 2024, and 2023, our subscription services revenues grew by 20%, 10%, and 17% respectively, as compared to subscription services revenues from the prior fiscal years. Over the longer term, our revenue growth

Current wording

While we have experienced significant revenue growth in prior periods, it is not indicative of our future revenue growth. Our total revenue and subscription revenue growth rates have declined in the past and may decline in the future. In our fiscal years ended January 31, 2026, 2025, and 2024, our total revenues grew by 16%, 16%, and 10% respectively, as compared to total revenues from the prior fiscal years. In our fiscal years ended January 31, 2026, 2025, and 2024, our subscription revenues grew by 17%, 20%, and 10% respectively, as compared to subscription revenues from the prior fiscal years. Over the longer term, our revenue growth rates are likely to fluctuate from year to year and may decline. If we are unable to maintain consistent revenue growth, it may adversely impact our profitability and the value of our common stock.

Previous wording

For example, certain of our contracting terms include an annual inflation adjustment that raises the price to each customer upon renewal by the lower of 4% or the Consumer Price Index (All Urban Consumer, U.S. City Average, All Items Index) published by the U.S. Bureau of Labor Statistics for the month of August of the prior calendar year. If this increase results in reduced renewal rates, our business and results of operations will be adversely affected. Further, our customers may negotiate terms less advantageous to us upon renewal, which could reduce our revenues from these customers. As a customer’s total spend on Veeva solutions increases, we expect purchasing scrutiny at renewal to increase as well, which may result in reductions in user subscriptions or increased pricing pressure. Other factors that are not within our control may contribute to a reduction in our subscription services revenues. For instance, our customers may reduce their number of sales representatives, which would result in a corresponding reduction in the number of user subscriptions needed for some of our solutions and thus a lower aggregate renewal fee, or our customers may discontinue clinical trials for which our solutions are being used. In addition, certain customers have in the past exercised their right to reduce usage or exercise termination rights, and other customers may also choose to do so in the future. Our master subscription agreements governing multi-year orders generally include a right to terminate for convenience. In addition, pursuant to the EU Data Act, which came

Current wording

Further, our customers may negotiate terms less advantageous to us upon renewal, which could reduce our revenues from these customers. As a customer’s total spend on Veeva solutions increases, we expect purchasing scrutiny at renewal to increase as well, which may result in reductions in user subscriptions or increased pricing pressure. Other factors that are not within our control may contribute to a reduction in our subscription revenues. For instance, our customers may reduce their number of sales representatives, which would result in a corresponding reduction in the number of user subscriptions needed for some of our solutions and thus a lower aggregate renewal fee, or our customers may discontinue clinical trials for which our solutions are being used. In addition, certain customers have in the past exercised their right to reduce usage or exercise termination rights, and other customers may also choose to do so in the future. Our master subscription agreements governing multi-year orders generally include a right to terminate for convenience. In addition, pursuant to the EU Data Act, which came into effect September 12, 2025, our EU customers may cancel their subscriptions without cause upon providing the notice and after the transition period specified by the Act.