VEEVA SYSTEMS INC

Previous wording

•We face intense competition in markets in which we operate—particularly in the CRM market as we transition customers from our legacy CRM application to our Vault CRM application—and if we do not compete effectively, we may lose customers and our business and operating results could be adversely affected.

Current wording

We face intense competition in markets in which we operate and if we do not compete effectively, we may lose customers and our business and operating results could be adversely affected.

Previous wording

Some of our actual and potential competitors have advantages over us, such as longer operating histories, significantly greater financial, technical, marketing or other resources, stronger brand and business recognition, larger intellectual property portfolios, and agreements with a broader set of system integrators and other partners. In addition, our competitors have offered price concessions, delayed payment terms, or other more favorable terms and conditions in light of the recent macroeconomic environment.

Current wording

Some of our actual and potential competitors have advantages over us, such as longer operating histories, significantly greater financial, technical, marketing or other resources, stronger brand and business recognition, larger intellectual property portfolios, and agreements with a broader set of system integrators and other partners. In addition, our competitors have offered price concessions, delayed payment terms, or other more favorable terms and conditions in light of the macroeconomic environment.

Previous wording

We have from time to time found defects in our solutions, and new defects may be detected in the future. In addition, we have experienced, and may in the future experience, service disruptions, degradations, outages, and other performance problems, including from routine maintenance. These types of problems may be caused by a variety of factors, including human or software errors, viruses, cyberattacks, fraud, spikes in customer usage, problems associated with our third-party computing infrastructure and network providers, infrastructure changes, and denial of service issues. Service disruptions may result from errors we make in delivering, configuring, or hosting our solutions, or designing, installing, expanding, or maintaining our computing infrastructure. In some instances, we may not be able to identify the cause or causes of these performance problems within an acceptable period of time. It is also possible that such problems could result in losses of customer data.

Current wording

We have from time to time found defects in our solutions, and new defects may be detected in the future. In addition, we have experienced, and may in the future experience, service disruptions, degradations, outages, and other performance problems, including from routine maintenance. These types of problems may be caused by a variety of factors, including human, software, or AI errors, viruses, cyberattacks, fraud, spikes in customer usage, problems associated with our third-party computing infrastructure and network providers, infrastructure changes, and denial of service issues. Service disruptions may result from errors we make in delivering, configuring, or hosting our solutions, or designing, installing, expanding, or maintaining our computing infrastructure. In some instances, we may not be able to identify the cause or causes of these performance problems within an acceptable period of time. It is also possible that such problems could result in losses of customer data.

Previous wording

Our continued growth and profitability will depend on our ability to successfully develop and sell new solutions. It is uncertain whether these newer solutions will continue to grow as a percentage of revenues at a pace significant enough to support our expected overall growth. For example, as discussed in more detail below, we have begun to migrate our Veeva CRM customers to Vault CRM. We cannot be certain that we will be successful with respect to newer solutions, including AI technologies, and markets. It may take us significant time, and we may incur significant expense, to effectively market and sell these solutions, develop other new solutions, or make enhancements to our existing solutions. If our newer solutions do not continue to gain traction in the market, or other solutions that we may develop and introduce in the future do not achieve market acceptance in a timely manner, the growth rate of our revenues and operating results will be adversely affected.

Current wording

Our continued growth and profitability will depend on our ability to successfully develop and sell new solutions. It is uncertain whether these newer solutions will continue to grow as a percentage of revenues at a pace significant enough to support our expected overall growth. We cannot be certain that we will be successful with respect to newer solutions and markets, including our Veeva AI products and Aspen CRM, our recently announced CRM offering for non-life science companies. It may take us significant time, and we may incur significant expense, to effectively market and sell these solutions, develop other new solutions, or make enhancements to our existing solutions. If our newer solutions do not continue to gain traction in the market, or other solutions that we may develop and introduce in the future do not achieve market acceptance in a timely manner, the growth rate of our revenues and operating results will be adversely affected.

Previous wording

We use the Salesforce platform to deliver our Veeva CRM application, but we are migrating our CRM customers to our Vault CRM solutions, which are built on our Veeva Vault platform. Veeva CRM will be supported until December 31, 2029. The migration of our Veeva CRM customers will require time and expense, which may be significant. These migration processes are complex and we cannot be certain that we will be successful. Additionally, the migration may lead to outages or performance problems with Vault CRM or other Vault applications if we encounter difficulties supporting the increased volume of users migrating from Veeva CRM. Any disruptions in our services or other migration-related problems, whether or not such incidents are our fault, could subject us to liability or harm our

Current wording

We use the Salesforce platform to deliver our Veeva CRM application, but we are migrating our CRM customers to our Vault CRM solutions, which are built on our Veeva Vault platform. Veeva CRM will be supported until December 31, 2029. The migration of our Veeva CRM customers requires time and expense, which may be significant. These migration processes are complex and we cannot be certain that we will be successful. Additionally, the migration may lead to outages or performance problems with Vault CRM or other Vault applications if we encounter difficulties supporting the increased volume of users migrating from Veeva CRM. Any disruptions in our services or other migration-related problems, whether or not such incidents are our fault, could subject us to liability or harm our

Previous wording

Many countries and governmental bodies have adopted or may adopt laws and regulations governing our processing of personal and other data, making compliance an increasingly complex task. For example, we are regulated under the European General Data Protection Regulation (“EU GDPR”) and the United Kingdom’s General Data Protection Regulation (“UK GDPR”), as amended by the Data (Use and Access) Act of 2025, where we act as a data controller for our data products and a data processor with respect to our software products. In China, we are regulated under China’s Personal Information Protection Law (“PIPL”), where we process data as an entrusted party on behalf of our customers who operate as data handlers. In certain cases, we are regulated under the U.S. Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) that covers protected health information collected or maintained by covered entities and their business associates. Additionally, many states in the U.S. have passed comprehensive privacy legislation, such as the California Consumer Privacy Act. Some states in the U.S. also have passed legislation governing the processing of particular types of data, such as biometric data and certain other health-related data.

Current wording

Many countries and governmental bodies have adopted or may adopt laws and regulations governing our processing of personal and other data, making compliance an increasingly complex task. For example, we are regulated under the European General Data Protection Regulation (“EU GDPR”) and the United Kingdom’s General Data Protection Regulation (“UK GDPR”), as amended by the Data (Use and Access) Act of 2025, where we act as a data controller for our data products and a data processor with respect to our software products. In China, we are regulated under China’s Personal Information Protection Law (“PIPL”), where we process data as an entrusted party on behalf of our customers who operate as data handlers. In certain cases, we are regulated under the U.S. Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) that covers protected health information collected or maintained by covered entities and their business associates. Additionally, almost half of the states in the U.S. have passed comprehensive privacy legislation, such as the California Consumer Privacy Act. Some states in the U.S. also have passed legislation governing the processing of particular types of data, such as biometric data and certain other health-related data.

Previous wording

We expect these laws and regulations to continue to evolve, and that there will continue to be new, modified, and re-interpreted laws, regulations, standards, and other obligations relating to privacy, data protection, and cybersecurity, introducing uncertainty and increasing complexity. For example, the Network and Information Security Directive II (“NIS2”), adopted in 2023, aims to enhance cybersecurity across critical infrastructure and essential services in the EU. NIS2 provides for all 27 EU member states to have issued implementing legislation by October 2024; however, several EU member states have not finalized their respective legislation and guidance. The EU Data Act, which came into effect September 12, 2025, allows our EU customers to cancel their subscriptions without cause upon providing the notice and after the transition period specified by the Act. Furthermore, new and evolving regulations relating to the use of data in AI, such as the EU AI Act, are creating an increasingly complex and fragmented regulatory framework.

Current wording

We expect these laws and regulations to continue to evolve, and that there will continue to be new, modified, and re-interpreted laws, regulations, standards, and other obligations relating to privacy, data protection, and cybersecurity, introducing uncertainty and increasing complexity. For example, the EU Data Act, which came into effect September 12, 2025, allows our EU customers to cancel their subscriptions without cause upon providing the notice and after the transition period specified by the Act. Furthermore, new and evolving regulations relating to the use of data in AI, such as the EU AI Act, are creating an increasingly complex and fragmented regulatory framework.

Previous wording

As we expand our data product offerings into new jurisdictions, we are required to assess, monitor, and comply with additional laws and regulations related to our collection and processing of data, which may include new registration, consent, and notification obligations. In addition to our own processing of personal data, our customers expect that

Current wording

As we expand our data product offerings into new jurisdictions, we are required to assess, monitor, and comply with additional laws and regulations related to our collection and processing of data, which may include new registration, consent, and notification obligations. In addition to our own processing of personal data, our customers expect that our solutions can be used to enable their compliance with applicable data protection, data privacy, and cybersecurity laws and regulations.

Previous wording

Veeva AI, an initiative that adds AI to our applications across all major areas, including clinical, regulatory, safety, quality, medical, and commercial, presents new risks and challenges that could affect the adoption of our solutions and our business. If our AI offerings draw controversy due to their perceived or actual impact on privacy, security or confidentiality, inefficacy or inaccuracy, or contribution to bias, discrimination, other ethical harms, or other matters, we may experience new or enhanced governmental or regulatory scrutiny, brand or reputational harm, competitive harm, or legal liability. If our users lose confidence in the performance, including decisions, predictions, analyses, or other content that our AI offerings produce, the adoption of our offerings could be adversely affected, which may harm our operating results and financial condition. We may also use AI for research and development and other internal operational use cases, including the use of AI-enabled processes. The legal, regulatory, and policy environments around AI, such as the EU AI Act and legislation proposed and adopted in certain states in the U.S., are evolving rapidly and we may become subject to new and evolving legal and other obligations. These and other developments may force us to make significant changes to our AI strategy, including by limiting or restricting our use of AI or AI-enabled processes, which may cause us to incur increased research and development costs or compliance costs, divert resources from other development efforts to address issues related to AI governance, or otherwise necessitate expenditure of significant time, expense and other resources. If we are unable to mitigate these risks, or if we incur excessive expenses in our efforts to do so, our reputation, business, operating results, and financial condition may be harmed.

Current wording

Veeva’s AI products add AI to our applications across all major areas, including clinical, regulatory, safety, quality, medical, and commercial, and present new risks and challenges that could affect the adoption of our solutions and our business. If our AI offerings draw controversy due to their perceived or actual impact on privacy, security or confidentiality, inefficacy or inaccuracy, or contribution to bias, discrimination, other ethical harms, or other matters, we may experience new or enhanced governmental or regulatory scrutiny, brand or reputational harm, competitive harm, or legal liability. If our users lose confidence in their performance, including decisions, predictions, analyses, or other content that our AI offerings produce, the adoption of our offerings could be adversely affected, which may harm our operating results and financial condition. We may also use AI for research and development and other internal operational use cases, including the use of AI-enabled processes. The legal, regulatory, and policy environments around AI, such as the EU AI Act and legislation proposed and adopted in certain states in the U.S., are evolving rapidly and we may become subject to new and evolving legal and other obligations. These and other developments may force us to make significant changes to our AI strategy, including by limiting or restricting our use of AI or AI-enabled processes, which may cause us to incur increased research and development costs or compliance costs, divert resources from other development efforts to address issues related to AI governance, or otherwise necessitate expenditure of significant time, expense and other resources. If we are unable to mitigate these risks, or if we incur excessive expenses in our efforts to do so, our reputation, business, operating results, and financial condition may be harmed.

Previous wording

Our solutions are hosted from and use computing infrastructure provided by third parties. We utilize Amazon Web Services with respect to applications built on the Veeva Vault platform. Our Veeva CRM application is built on a platform provided by Salesforce that utilizes hosting and computing infrastructure provided by Salesforce. However, as discussed in more detail above, we have begun to migrate our Veeva CRM customers to Vault CRM, which is built on our Veeva Vault platform. We also utilize other computing infrastructure service providers to a lesser extent.

Current wording

Our solutions are hosted from and use computing infrastructure, including large language models, provided by third parties. We utilize Amazon Web Services with respect to applications built on the Veeva Vault platform. Our Veeva CRM application is built on a platform provided by Salesforce that utilizes hosting and computing infrastructure provided by Salesforce. However, as discussed in more detail above, we are migrating our Veeva CRM customers to Vault CRM, which is built on our Veeva Vault platform. And, our Veeva AI products leverage large language models provided by third parties, including Anthropic. We also utilize other computing infrastructure service providers to a lesser extent.

Previous wording

We do not own or control the operation of the third-party facilities or equipment used to provide the services described above. Our computing infrastructure service providers have no obligation to renew their agreements with us on commercially reasonable terms or at all. If we are unable to renew these agreements on commercially reasonable terms or if our computing infrastructure is unable to keep up with our needs for capacity, we may be required to transition to a new provider and we may incur significant costs and possible service interruption in connection with doing so. In addition, such service providers could decide to close their facilities or change or suspend their service offerings without adequate notice to us. Moreover, any financial difficulties, such as bankruptcy, faced by such service providers may have negative effects on our business, the nature and extent of which are difficult to predict. Since we cannot easily switch computing infrastructure service providers, any disruption with respect to our current providers would impact our operations and our business could be adversely impacted.

Current wording

We do not own or control the operation of the third-party facilities, equipment, or AI models used to provide the services described above. Our computing infrastructure service providers have no obligation to renew their agreements with us on commercially reasonable terms or at all. If we are unable to renew these agreements on commercially reasonable terms or if our computing infrastructure is unable to keep up with our needs for capacity, we may be required to transition to a new provider and we may incur significant costs and possible service interruption in connection with doing so. In addition, such service providers could decide to close their facilities or change or suspend their service offerings without adequate notice to us. Moreover, any financial difficulties, such as bankruptcy, faced by such service providers may have negative effects on our business, the nature and extent of which are difficult to predict. Access to certain frontier AI models may also be subject to sudden suspension or restriction by providers or by governments due to regulatory mandates. Since we cannot easily switch computing infrastructure service providers, any disruption with respect to our current providers would impact our operations and our business could be adversely impacted.

Previous wording

We are currently dependent upon the Salesforce platform to deliver Veeva CRM. However, we have begun to migrate our Veeva CRM customers to Vault CRM, which is built on our Veeva Vault platform. Our agreement with Salesforce expired on September 1, 2025, and pursuant to the terms of our agreement, during the wind-down period from September 1, 2025 to September 1, 2030, we may not sell applications that utilize the Salesforce platform to new customers and our sales of applications that utilize the Salesforce platform to a customer existing at September 1, 2025 may not exceed 150% of the seats in use by each such customer as of September 1, 2025. After September 1, 2030, we will not be able to sell applications that utilize the Salesforce platform to any customers.

Current wording

We are currently dependent upon the Salesforce platform to deliver Veeva CRM. However, we are migrating our Veeva CRM customers to Vault CRM, which is built on our Veeva Vault platform. Our agreement with Salesforce expired on September 1, 2025, and pursuant to the terms of our agreement, during the wind-down period from September 1, 2025 to September 1, 2030, we may not sell applications that utilize the Salesforce platform to new customers and our sales of applications that utilize the Salesforce platform to a customer existing at September 1, 2025 may not exceed 150% of the seats in use by each such customer as of September 1, 2025. After September 1, 2030, we will not be able to sell applications that utilize the Salesforce platform to any customers.

Previous wording

Our success and ability to compete depend in part upon our intellectual property. As of April 30, 2026, we have filed numerous domestic and foreign patent applications and have been issued 123 U.S. patents and 11 international patents. We also rely on copyright, trade secret and trademark laws, trade secret protection and confidentiality or license agreements with our employees, customers, partners, consultants and others to protect our intellectual property rights. However, the steps we take to protect our intellectual property rights may be inadequate and we may not be able to prevent the unauthorized or rogue disclosure or use of our technical knowledge, trade secrets or other confidential information. Further, if there is a breach or violation of the terms of our confidentiality agreements, we may not have adequate remedies.

Current wording

Our success and ability to compete depend in part upon our intellectual property. As of July 31, 2026, we have filed numerous domestic and foreign patent applications and have been issued 137 U.S. patents and 11 international patents. We also rely on copyright, trade secret and trademark laws, trade secret protection and confidentiality or license agreements with our employees, customers, partners, consultants and others to protect our intellectual property rights. However, the steps we take to protect our intellectual property rights may be inadequate and we may not be able to prevent the unauthorized or rogue disclosure or use of our technical knowledge, trade secrets or other confidential information. Further, if there is a breach or violation of the terms of our confidentiality agreements, we may not have adequate remedies.