CALIX, INC

Previous wording

We have platform, cloud and managed service offerings, including new AI-enabled “agentic” capabilities, which are early in their product life cycles and subject to uncertain market demand. If our customers are unwilling to adopt these new offerings, install our new products or deploy our new services, or if we are unable to achieve market acceptance of our products and platform, our business and financial results may be harmed. Moreover, adoption of our platform, cloud and managed service offerings is dependent upon the success of our customers in investing, marketing, selling and deploying broader services to their subscribers, and our ability to differentiate our products from competing or substitutive product and service offerings. For example, our SmartLife managed services include AI-driven managed Wi-Fi, network security, parental controls and an ecosystem of services from partners, including Arlo and Bark. However, if subscriber demand for such services does not grow as expected or declines, or our customers are unable or unwilling to invest in our platform to deploy and market these services, demand for our products may not grow at rates as we anticipate, negatively impacting our revenue and long-term growth.

Current wording

We have platform, cloud and managed service offerings, including new AI-enabled “agentic” capabilities, which are early in their product life cycles and subject to uncertain market demand. If our customers are unwilling to adopt these new offerings, install our new products or deploy our new services, or if we are unable to achieve market acceptance of our products and platform, our business and financial results may be harmed. Moreover, adoption of our platform, cloud and managed service offerings is dependent upon the success of our customers in investing, marketing, selling and deploying broader services to their subscribers, and our ability to differentiate our products from competing or substitutive product and service offerings. For example, our SmartLife managed services include AI-driven managed Wi-Fi, network security, parental controls and cyber monitoring. However, if subscriber demand for such services does not grow as expected or declines, or our customers are unable or unwilling to invest in our platform to deploy and market these services, demand for our products may not grow at rates as we anticipate, negatively impacting our revenue and long-term growth.

Previous wording

The implementation of significant changes to U.S. trade policies, sanctions, legislation, treaties and tariffs, including, but not limited to, significant new tariffs on goods imported into the U.S.(and uncertainty related to the enforceability thereof), have introduced uncertainty to our business and will increase the cost of our U.S. manufactured products and components sourced outside of the U.S., which will result in an increase to our cost of revenue and may cause a reduction in our gross margin. In response, China announced additional tariffs on U.S. goods and new export control restrictions. The imposition of additional tariffs or other trade barriers by countries outside of the U.S may increase our costs in these markets, and to the extent these increased costs result in increased prices for our customers, the demand for our products may decrease as our customers seek alternative sourcing, making it more difficult for us to sell our products in some markets.

Current wording

The implementation of significant changes to U.S. trade policies, sanctions, legislation, treaties and tariffs, including, but not limited to, significant new tariffs on goods imported into the U.S. (and uncertainty related to the enforceability thereof), have introduced uncertainty to our business and may increase the cost of our U.S. manufactured products and components sourced outside of the U.S., which may result in an increase to our cost of revenue and may cause a reduction in our gross margin. In response, China announced additional tariffs on U.S. goods and new export control restrictions. The imposition of additional tariffs or other trade barriers by countries outside of the U.S. may increase our costs in these markets, and to the extent these increased costs result in increased prices for our customers, the demand for our products may decrease as our customers seek alternative sourcing, making it more difficult for us to sell our products in some markets.

Previous wording

We are subject to business and operational risks associated with our international operations, including our global supply-chain operations, and our international offices located in Nanjing, China and Bangalore, India as well as dependence upon our international sales operations. In addition, we are exposed to risk arising from our dependence upon third-party development contractors in India. The risks associated with our international operations also include costs of complying with differing and changing laws and regulatory requirements, tariffs, export quotas, custom duties and other trade restrictions; effects of inflation, currency controls and/or fluctuations in currency exchange rates; limited, inadequate or non-existent intellectual property (“IP”) protection; and uncertainties associated with political conflicts and instabilities, variable economic conditions, terrorist attacks or acts of war. Our development operations and activities in China and India involve these and other significant risks, including: local labor conditions and regulations; knowledge transfer related to our technology and exposure to misappropriation of IP or Confidential Information, including information that is proprietary to us, our customers and third parties; heightened exposure to changes in the economic, security, political and pandemic conditions; international trade agreements and U.S. tax provisions that could adversely affect our international operations; complexities of managing development timelines and deliverables from abroad; and differences in local business practices and customs that may not align with our expectations and standards.

Current wording

protection; and uncertainties associated with political conflicts and instabilities, variable economic conditions, terrorist attacks or acts of war. Our development operations and activities in China and India involve these and other significant risks, including: local labor conditions and regulations; knowledge transfer related to our technology and exposure to misappropriation of IP or Confidential Information, including information that is proprietary to us, our customers and third parties; heightened exposure to changes in the economic, security, political and pandemic conditions; international trade agreements and U.S. tax provisions that could adversely affect our international operations; complexities of managing development timelines and deliverables from abroad; and differences in local business practices and customs that may not align with our expectations and standards.

Previous wording

In the ordinary course of business, we are subject to legal claims, litigation and regulatory proceedings related to disputes over commercial, securities class action litigation, competition, IP, labor and employment and other matters. Regardless of the merits of any such claims, litigation and regulatory proceedings are inherently uncertain, and can be costly, disruptive to our business and operations, harmful to our reputation and distracting to management. In particular, as a technology company, we are subject to IP claims asserting patent, copyright, trademark and/or other infringement claims that are costly to defend and could limit our ability to use some technologies in the future. The risk of such claims is heightened as we expand our products and services and rely on more technologies, including third-party IP rights that we license and incorporate into our products and services. Third parties from whom we license IP may be unable or unwilling to indemnify us for such claims or offer any other remedy to us. Patent infringement claims may be asserted by patent assertion entities and non-practicing entities (“NPEs”) that do not conduct business as an operating company and hold and own patents only for the purpose of aggressively pursuing royalties through infringement assertions or patent infringement litigation. Further, in our industry, the number of assertions by NPEs has continued to increase due in part to patent sales by operating companies to NPEs and availability of litigation financing. We have received and expect to continue to receive assertions from NPEs and other third parties alleging that we may be infringing their patents or other IP rights; offering licenses to such IP; and/or threatening litigation. If our products are found to infringe, these claims could also result in the suspension of our ability to import, market and sell our products and services, product shipment delays or requirements to modify our products or enter into costly settlements or licensing agreements. Such royalty or licensing agreements, if required, may not be available to us on acceptable terms, if at all. Furthermore, we may additionally be financially responsible for claims made against our customers, including costs of litigation and damages awarded, under indemnity obligations which could further negatively impact our results of operations. Protracted litigation could cause us to incur significant defense costs, which would negatively impact our results of operations.

Current wording

In the ordinary course of business, we have been, are currently and may be in the future subject to legal claims, litigation and regulatory proceedings related to disputes over commercial, securities class action litigation, competition, IP, labor and employment and other matters. Regardless of the merits of any such claims, litigation and regulatory proceedings are inherently uncertain, and can be costly, disruptive to our business and operations, harmful to our reputation and distracting to management. In particular, as a technology company, we are subject to IP claims asserting patent, copyright, trademark and/or other infringement claims that are costly to defend and could limit our ability to use some technologies in the future. The risk of such claims is heightened as we expand our products and services and rely on more technologies, including third-party IP rights that we license and incorporate into our products and services. Third parties from whom we license IP may be unable or unwilling to indemnify us for such claims or offer any other remedy to us. Patent infringement claims may be asserted by patent assertion entities and non-practicing entities (“NPEs”) that do not conduct business as an operating company and hold and own patents only for the purpose of aggressively pursuing royalties through infringement assertions or patent infringement litigation. Further, in our industry, the number of assertions by NPEs has continued to increase due in part to patent sales by operating companies to NPEs and availability of litigation financing. We have received and expect to continue to receive assertions from NPEs and other third parties alleging that we may be infringing their patents or other IP rights; offering licenses to such IP; and/or threatening litigation. If our products are found to infringe, these claims could also result in the suspension of our ability to import, market and sell our products and services, product shipment delays or requirements to modify our products or enter into costly settlements or licensing agreements. Such royalty or licensing agreements, if required, may not be available to us on acceptable terms, if at all. Furthermore, we may additionally be financially responsible for claims made against our customers, including costs of litigation and damages awarded, under indemnity obligations which could further negatively impact our results of operations. Protracted litigation could cause us to incur significant defense costs, which would negatively impact our results of operations.

Previous wording

Our gross margin and operating results has in the past and may in the future fluctuate due to component costs, pricing actions, customer and product mix, cloud costs, tariffs and market conditions. The timing and magnitude of these factors are difficult to predict, and prior period results may not be indicative of future performance.

Current wording

Our gross margin and operating results have in the past and may in the future fluctuate due to component costs, pricing actions, customer and product mix, cloud costs, tariffs and market conditions. The timing and magnitude of these factors are difficult to predict, and prior period results may not be indicative of future performance.

Previous wording

We operate our Oracle enterprise resource planning (“ERP”) system on Oracle’s cloud platform and our software billing application on Salesforce.com. With these implementations, we are highly dependent upon Oracle and Saleforce.com to host, manage and maintain our ERP system and supporting applications. Any disruptions to their business or processes, or delays in their ability to provide services to us, may in turn disrupt our business operations or increase costs. Furthermore, we receive quarterly system updates and enhancements on the cloud platform according to Oracle’s release timeline and change management processes, which if not managed properly may disrupt our business operations and delay our ability to process transactions and produce reports necessary to conduct our business. We are highly dependent upon our ERP system for critical business functions, including order processing and management, supply chain and procurement operations, financial planning, accounting and reporting; accordingly, protracted disruption in functionality or processing capabilities of the ERP system could materially impair our ability to process transactions timely or produce accurate financial statements on a timely basis. If our systems suffer prolonged interruption, our results of operations and cash flows would be adversely affected.

Current wording

We operate our Oracle enterprise resource planning (“ERP”) system on Oracle’s cloud platform and our software billing application on Salesforce.com. With these implementations, we are highly dependent upon Oracle and Salesforce.com to host, manage and maintain our ERP system and supporting applications. Any disruptions to their business or processes, or delays in their ability to provide services to us, may in turn disrupt our business operations or increase costs. Furthermore, we receive quarterly system updates and enhancements on the cloud platform according to Oracle’s release timeline and change management processes, which if not managed properly may disrupt our business operations and delay our ability to process transactions and produce reports necessary to conduct our business. We are highly dependent upon our ERP system for critical business functions, including order processing and management, supply chain and procurement operations, financial planning, accounting and reporting; accordingly, protracted disruption in functionality or processing capabilities of the ERP system could materially impair our ability to process transactions timely or produce accurate financial statements on a timely basis. If our systems suffer prolonged interruption, our results of operations and cash flows would be adversely affected.

Previous wording

We sell to broadband service providers and CXPs, including U.S.-based independent operating companies (“IOCs”) which rely significantly upon interstate and intrastate access charges and federal and state subsidies in the form of grants and other funding, such as the Federal Communications Commission’s (“FCC”) Rural Digital Opportunity Fund, the CARES Act Enhanced Alternative Connect America Cost Model, or the American Rescue Plan Act. The FCC and some states may change such payments and subsidies, which could reduce IOC revenue. Furthermore, many IOCs use or expect to use government-supported loan programs or grants, such as U.S. Department of Agriculture’s Rural Utility Service or National Telecommunications and Information Administration’s (“NTAI”) Broadband Equity, Access and Deployment (“BEAD”) program loans and grants, to finance capital spending. These government-supported loan programs and grants generally include conditions such as deployment criteria, domestic preference provisions and other requirements that apply to the project and selected equipment as conditions for funding. For example, the U.S. government passed The Infrastructure Investment Jobs Act, which charged the NTIA with establishing the BEAD Program and ensuring that BEAD-funded infrastructure projects comply with the Buy America Domestic Content Procurement Preference (“Buy America Preference”) of the Build America, Buy America Act (“BABA”). In accordance with BABA, the U.S. Department of Commerce has issued a limited, general applicability, nonavailability waiver of the Buy America Preference to recipients of Federal financial assistance under the NTIA’s BEAD Program. Notwithstanding this waiver, certain of our products will be required to meet BABA domestic content requirements to enable certain customers to qualify for grant funding under the BEAD Program. Any failure of such products to meet BABA domestic content requirements would result in those products being ineligible for purchase and use by certain customers under the BEAD Program, and could result in lost sales, lost business opportunity, breach of warranty claims, and damage to our reputation and customer relationships.

Current wording

We sell to broadband service providers and CXPs, including U.S.-based independent operating companies (“IOCs”) which rely significantly upon interstate and intrastate access charges and federal and state subsidies in the form of grants and other funding, such as the Federal Communications Commission’s (“FCC”) Rural Digital Opportunity Fund, the CARES Act Enhanced Alternative Connect America Cost Model, or the American Rescue Plan Act. The FCC and some states may change such payments and subsidies, which could reduce IOC revenue. Furthermore, many IOCs use or expect to use government- supported loan programs or grants, such as U.S. Department of Agriculture’s Rural Utility Service or National Telecommunications and Information Administration’s (“NTIA”) Broadband Equity, Access and Deployment (“BEAD”) program loans and grants, to finance capital spending. These government-supported loan programs and grants generally include conditions such as deployment criteria, domestic preference provisions and other requirements that apply to the project and selected equipment as conditions for funding. For example, the U.S. government passed The Infrastructure Investment Jobs Act, which charged the NTIA with establishing the BEAD Program and ensuring that BEAD-funded infrastructure projects comply with the Buy America Domestic Content Procurement Preference (“Buy America Preference”) of the Build America, Buy America Act (“BABA”). In accordance with BABA, the U.S. Department of Commerce has issued a limited, general applicability, nonavailability waiver of the Buy America Preference to recipients of Federal financial assistance under the NTIA’s BEAD Program. Notwithstanding this waiver, certain of our products will be required to meet BABA domestic content requirements to enable certain customers to qualify for grant funding under the BEAD Program. Any failure of such products to meet BABA domestic content requirements would result in those products being ineligible for purchase and use by certain customers under the BEAD Program, and could result in lost sales, lost business opportunity, breach of warranty claims, and damage to our reputation and customer relationships.

Previous wording

Geopolitical issues such as armed conflicts, relations between the U.S. and China, tariff and trade policy changes (and uncertainty related to the enforceability thereof) and increasing potential of conflict involving countries in Asia that are critical to our supply-chain operations, such as Taiwan and China, have resulted in increasing global tensions and create uncertainty for global commerce. New or increased tariffs and other changes in U.S. trade policy, including new sanctions, have triggered and may continue to trigger retaliatory actions by affected countries or changes in demand from customers displeased with U.S. tariff and trade policy changes. U.S. executive orders have resulted in tariffs on imports from numerous countries, including China and other Asian countries where our sole-source or limited-source suppliers are located. Consequently, absent policy changes, these actions will increase our cost of revenue. To the extent dissatisfaction with U.S. government policy results in U.S.-based suppliers being disfavored over foreign-based alternatives, it may diminish demand for our products with such customers and cause them to find alternative sourcing or otherwise make it more difficult for us to sell more products to these customers. The imposition of additional tariffs or other trade barriers by countries other than the U.S., including China and other Asian countries, will increase our costs in these markets, and to the extent these increased costs result in increased prices for our customers, we expect the demand for products in these markets to decrease as some of our customers seek alternative sources, making it more difficult for us to sell our products in these markets. In addition, inflation in the U.S. has affected businesses across many industries, including ours, by increasing the costs of labor, employee healthcare, components and freight and shipping, which may further constrain our customers’ or prospective customers’ budgets. To the extent there is a sustained general economic downturn, and our platform and services are perceived by customers or potential customers as costly, or too difficult to deploy or migrate to, our revenue may be disproportionately affected by delays or reductions in spending. Sustained or worsening of global economic conditions and geopolitical issues may increase our cost of doing business, materially disrupt our supply chain operations, cause our customers to reduce or delay spending and intensify pricing pressures. We cannot predict the timing, strength or duration of any economic slowdown, instability or recovery, generally or within any particular industry. If the economic conditions of the general economy or markets in which we operate worsen from present levels, demand for our products, and our business, financial condition and results of operations, could be adversely affected.

Current wording

Geopolitical issues such as armed conflicts, relations between the U.S. and China, tariff and trade policy changes (and uncertainty related to the enforceability thereof) and increasing potential of conflict involving countries in Asia that are critical to our supply-chain operations, such as Taiwan and China, have resulted in increasing global tensions and create uncertainty for global commerce. New or increased tariffs and other changes in U.S. trade policy, including new sanctions, have triggered and may continue to trigger retaliatory actions by affected countries or changes in demand from customers displeased with U.S. tariff and trade policy changes. U.S. executive orders have resulted in tariffs on imports from numerous countries, including China and other Asian countries where our sole-source or limited-source suppliers are located. Consequently, absent policy changes, these actions may increase our cost of revenue. To the extent dissatisfaction with U.S. government policy results in U.S.-based suppliers being disfavored over foreign-based alternatives, it may diminish demand for our products with such customers and cause them to find alternative sourcing or otherwise make it more difficult for us to sell more products to these customers. The imposition of additional tariffs or other trade barriers by countries other than the U.S., including China and other Asian countries, may increase our costs in these markets, and to the extent these increased costs result in increased prices for our customers, we expect the demand for products in these markets to decrease as some of our customers seek alternative sources, making it more difficult for us to sell our products in these markets. In addition, inflation in the U.S. has affected businesses across many industries, including ours, by increasing the costs of labor, employee healthcare, components and freight and shipping, which may further constrain our customers’ or prospective customers’ budgets. To the extent there is a sustained general economic downturn, and our platform and services are perceived by customers or potential customers as costly, or too difficult to deploy or migrate to, our revenue may be disproportionately affected by delays or reductions in spending. Sustained or worsening of global economic conditions and geopolitical issues may increase our cost of doing business, materially disrupt our supply chain operations, cause our customers to reduce or delay spending and intensify pricing pressures. We cannot predict the timing, strength or duration of any economic slowdown, instability or recovery, generally or within any particular industry. If the economic conditions of the general economy or markets in which we operate worsen from present levels, demand for our products, and our business, financial condition and results of operations, could be adversely affected.

Previous wording

For example, in the U.S., certain states have adopted or modified privacy and security laws and regulations which govern the privacy, processing and protection of personal information. Such laws and regulations will be subject to interpretation by various courts and other governmental authorities, thus creating potentially complex compliance issues for us and our future customers and strategic partners. For example, the California Consumer Privacy Act (the “CCPA”) requires covered businesses that process the personal information of California residents to, among other things: (i) provide certain disclosures to California residents regarding the business’s collection, use and disclosure of their personal information; (ii) receive and respond to requests from California residents to access, delete and correct their personal information or to opt out of certain disclosures of their personal information; and (iii) enter into specific contractual provisions with service providers that process California resident personal information on the business’s behalf. Additional compliance investment and potential business process changes may also be required. Similar laws have been passed in other states, creating a patchwork of overlapping but different state laws, and are continuing to be proposed at the state and federal level, reflecting a trend toward more stringent privacy legislation in the U.S. Many of these laws include restrictions on processing consumer information for targeted advertising, which could negatively affect our marketing cloud products. The enactment of such laws could have potentially conflicting requirements that would make compliance challenging. If we are subject to or affected by the CCPA, or other domestic privacy and data protection laws, any liability from failure to comply with the requirements of these laws could adversely affect our financial condition.

Current wording

For example, in the U.S., certain states have adopted or modified privacy and security laws and regulations which govern the privacy, processing and protection of personal information. Such laws and regulations are subject to interpretation by various courts and other governmental authorities, thus creating potentially complex compliance issues for us and our future customers and strategic partners. For example, the California Consumer Privacy Act (the “CCPA”) requires covered businesses that process the personal information of California residents to, among other things: (i) provide certain disclosures to California residents regarding the business’s collection, use and disclosure of their personal information; (ii) receive and respond to requests from California residents to access, delete and correct their personal information or to opt out of certain disclosures of their personal information; and (iii) enter into specific contractual provisions with service providers that process California resident personal information on the business’s behalf. Additional compliance investment and potential business process changes may also be required. Similar laws have been passed in other states, creating a patchwork of overlapping but different state laws, and are continuing to be proposed at the state and federal level, reflecting a trend toward more stringent privacy legislation in the U.S. Many of these laws include restrictions on processing consumer information for targeted advertising, which could negatively affect our marketing cloud products. The enactment of such laws could have potentially conflicting requirements that would make compliance challenging. Any liability from failure to comply with the applicable privacy and data protection laws could adversely affect our financial condition.

Previous wording

In 2024, the National Security Division of the U.S. Department of Justice (“DOJ”) issued a new rule—referred to as the “Data Security Program” (“DSP”) to implement Executive Order 14117, aimed at preventing access to “bulk U.S. sensitive personal data” and “government-related data” by “countries of concern” (including China, Russia, Iran, North Korea, Cuba, and Venezuela) and “covered persons” (as all such terms are defined in the DSP). Effective as of April 8, 2025, and fully enforceable as of July 9, 2025, the DSP imposes stringent obligations on companies within its scope and prohibits or restricts “covered data transactions” that grant countries of concern or covered persons access to bulk U.S. sensitive personal data or any amount of government-related data. The DSP is new, complex and has yet to be enforced, and as such, there is a risk that our interpretation of its applicability, scope and requirements is incorrect, incomplete or misapplied.

Current wording

Venezuela) and “covered persons” (as all such terms are defined in the DSP). Effective as of April 8, 2025, and fully enforceable as of July 9, 2025, the DSP imposes stringent obligations on companies within its scope and prohibits or restricts “covered data transactions” that grant countries of concern or covered persons access to bulk U.S. sensitive personal data or any amount of government-related data. The DSP is new, complex and has yet to be enforced, and as such, there is a risk that our interpretation of its applicability, scope and requirements is incorrect, incomplete or misapplied.

Previous wording

The General Data Protection Regulation (“EU GDPR”) adopted by the European Union (“EU”) and the UK General Data Protection Regulation (“UK GDPR”) adopted by the United Kingdom (“UK”) (the EU GDPR and UK GDPR hereinafter referred to as the “GDPR”) and national data protection supplementing laws in these jurisdictions impose specific duties and requirements upon companies that are subject to their provisions and collect, process or control personal data of individuals. Although we currently do not have material operations or business in the EU or the UK, we are in the process of expanding in these jurisdictions, and we have incurred and will continue to incur substantial costs in this respect. Furthermore, the GDPR imposes significant penalties for noncompliance which can amount to the greater of €20 million (for the EU GDPR) or £17.5 million (for the UK GDPR) or 4% of the total worldwide annual turnover of the preceding financial year; thus, any non-compliance with the GDPR could result in a material adverse effect on our business, financial condition and results of operations.

Current wording

The General Data Protection Regulation (“EU GDPR”) adopted by the European Union (“EU”) and the UK General Data Protection Regulation (“UK GDPR”) adopted by the United Kingdom (“UK”) (the EU GDPR and UK GDPR hereinafter referred to as the “GDPR”) and national data protection supplementing laws in these jurisdictions impose specific duties and requirements upon companies in relation to the processing of personal data of individuals. Although we currently do not have material operations or business in the EU or the UK, we are in the process of expanding in these jurisdictions, and we have incurred and will continue to incur substantial costs in this respect. Furthermore, the GDPR imposes significant penalties for noncompliance which can amount to the greater of €20 million (for the EU GDPR) or £17.5 million (for the UK GDPR) or 4% of the total worldwide annual turnover of the preceding financial year; thus, any non-compliance with the GDPR could result in a material adverse effect on our business, financial condition and results of operations.

Previous wording

The GDPR regulate cross-border transfers of personal data out of the European Economic Area (the “EEA”) and the UK. There is currently legal complexity and uncertainty regarding international personal data transfers, and we expect this to continue. For example, there are number of decisions and proceedings in the EU where the legality of data transfers to China is being challenged. As the regulatory guidance and enforcement landscape in relation to data transfers further develops, our business, operations and financial condition could be adversely affected and we could suffer additional costs, complaints and/or regulatory investigations or fines. We may also have to stop using certain tools and vendors and make other operational changes. Further, our customers may not use our services in a manner that is compliant with applicable data privacy laws and regulations and our services may not be competitive in certain markets. We may also become subject to new laws that regulate both personal and non-personal data. For example, the Data Act came into effect on September 12, 2025, establishing new requirements for providers of data processing services (including cloud, SaaS) into the EU. The Data Act requires providers to facilitate customers switching to other providers/ on-premise solutions and porting their data within certain timeframes; remove technical, contractual, and commercial obstacles to service switching (including switching charges); and include certain mandatory terms in customer contracts. Failure to comply with the Data Act can result in regulatory enforcement and fines, civil claims, and reputational damage. The Data Act, together with developing guidance in this area, may require changes to our customer contracts, products, operations and business practices, increase our compliance costs, require adjustments to our revenue recognition practices and adversely affect our financial condition, business and operations.

Current wording

The GDPR regulates cross-border transfers of personal data out of the European Economic Area (the “EEA”) and the UK. There is currently legal complexity and uncertainty regarding international personal data transfers, and we expect this to continue. For example, there are a number of decisions and proceedings in the EU where the legality of data transfers to China is being challenged. As the regulatory guidance and enforcement landscape in relation to data transfers further develops, our business, operations and financial condition could be adversely affected and we could suffer additional costs, complaints and/or regulatory investigations or fines. We may also have to stop using certain tools and vendors and make other operational changes. Further, our customers may not use our services in a manner that is compliant with applicable data privacy laws and regulations and our services may not be competitive in certain markets. We may also become subject to new laws that regulate both personal and non-personal data. For example, the Data Act came into effect on September 12, 2025, establishing new requirements for providers of data processing services (including cloud, SaaS) into the EU. The Data Act requires providers to facilitate customers switching to other providers/ on-premise solutions and porting their data within certain timeframes; remove technical, contractual, and commercial obstacles to service switching (including switching charges); and include certain mandatory terms in customer contracts. Failure to comply with the Data Act can result in regulatory enforcement and fines, civil claims, and reputational damage. The Data Act, together with developing guidance in this area, may require changes to our customer contracts, products, operations and business practices, increase our compliance costs, require adjustments to our revenue recognition practices and adversely affect our financial condition, business and operations.

Previous wording

Complying with new and changing laws could cause us to incur substantial costs in order to market and sell our cloud-based solutions in the U.S. and internationally, deter customers from adopting our cloud-based solutions or require us to redesign our platform in order to meet customer requirements related to such laws. Regulatory actions or claims involving our practices in the collection, storage, processing, use or disclosure of consumer information or other personal data, even if unfounded, could damage our reputation and adversely affect our operating results. The failure or perceived failure to comply with such laws, rules, regulations, industry standards and other requirements relating to data privacy, security or the processing of personal information may result in proceedings or actions against us, by individuals, consumer rights groups, government agencies or others, could cause us to incur significant costs in investigations and defending such claims, or could cause us to incur significant costs in investigations and defending such claims, pay significant damages or fines or be required to make changes to our business if found liable, lose customers and subject us to significant negative publicity and an erosion of trust, all of which could have an adverse effect on our business, results of operations and financial condition.

Current wording

Complying with new and changing laws could cause us to incur substantial costs in order to market and sell our cloud-based solutions in the U.S. and internationally, deter customers from adopting our cloud-based solutions or require us to redesign our platform in order to meet customer requirements related to such laws. Regulatory actions or claims involving our practices in the collection, storage, processing, use or disclosure of consumer information or other personal data, even if unfounded, could damage our reputation and adversely affect our operating results. The failure or perceived failure to comply with such laws, rules, regulations, industry standards and other requirements relating to data privacy, security or the processing of personal information may result in proceedings or actions against us, by individuals, consumer rights groups, government agencies or others, could cause us to incur significant costs in investigations and defending such claims, pay significant damages or fines or be required to make changes to our business if found liable, lose customers and subject us to significant negative publicity and an erosion of trust, all of which could have an adverse effect on our business, results of operations and financial condition.

Previous wording

On March 23, 2026, the FCC updated its “Covered List” under Section 2 of the Secure and Trusted Communications Networks Act of 2019 to include consumer-grade routers produced outside of the U.S. This action effectively bars the future importation, sale, or use of these products in the U.S. absent regulatory approval or waiver.

Current wording

On March 23, 2026, the FCC updated its “Covered List” under Section 2 of the Secure and Trusted Communications Networks Act of 2019 to include certain foreign-produced “consumer-grade routers.” Models previously authorized by the FCC generally may continue to be imported, marketed and sold in the U.S. New covered models, however, generally cannot obtain the required FCC equipment authorization without first securing conditional approval from the Department of War (“DoW”) or the Department of Homeland Security (“DHS”), or an applicable waiver.

Previous wording

The stock market in general, and the market for technology companies in particular, has experienced extreme price and volume fluctuations that have often been unrelated or disproportionate to the operating performance of those companies. Broad market and industry factors may seriously affect the market price and volatility of our common stock, regardless of our actual operating performance. Historically, following periods of volatility in the market price of a company’s securities, there is increased risk that stockholders may initiate securities class action litigation against the company. Such litigation, if instituted against us, could result in substantial costs and a diversion of our management’s attention and resources.

Current wording

The stock market in general, and the market for technology companies in particular, has experienced extreme price and volume fluctuations that have often been unrelated or disproportionate to the operating performance of those companies. Broad market and industry factors may seriously affect the market price and volatility of our common stock, regardless of our actual operating performance. Historically, following periods of volatility in the market price of a company’s securities, there is increased risk that stockholders may initiate securities class action litigation against the company. For example, we are currently a defendant in litigation as described in the risk factor titled “We are currently a defendant in a putative securities class action alleging that we have made materially false or misleading statements regarding our memory component supply and its impact on our non-GAAP gross margin”. This litigation, and any pending litigation or litigation instituted against us in the future, could result in substantial costs and a diversion of our management's attention and resources.

Previous wording

We have a common stock repurchase program of which $94.1 million was available as of June 27, 2026. Under the repurchase program, repurchases can be made from time to time using a variety of methods, which may include open market purchases, privately negotiated transactions or otherwise, all in accordance with the rules of the SEC and other applicable legal requirements. The specific timing, price and size of the purchases will depend on prevailing stock prices, general economic and market conditions, and other considerations consistent with our capital allocation strategy. Stock repurchases could have an impact on our common stock trading prices, increase the volatility of the price of our common stock, or reduce our available cash balance such that we will be required to seek financing to support our operations. The repurchase program does not obligate us to acquire a particular amount of common stock, and the repurchase program may be suspended or discontinued at any time at our discretion, which may result in a decrease in the trading prices of our common stock. Even if our share repurchase program is fully implemented, it may not enhance long-term stockholder value.

Current wording

We have a common stock repurchase program of which $44.1 million was available as of September 26, 2026. Under the repurchase program, repurchases can be made from time to time using a variety of methods, which may include open market purchases, privately negotiated transactions or otherwise, all in accordance with the rules of the SEC and other applicable legal requirements. The specific timing, price and size of the purchases will depend on prevailing stock prices, general economic and market conditions, and other considerations consistent with our capital allocation strategy. Stock repurchases could have an impact on our common stock trading prices, increase the volatility of the price of our common stock, or reduce our available cash balance such that we will be required to seek financing to support our operations. The repurchase program does not obligate us to acquire a particular amount of common stock, and the repurchase program may be suspended or discontinued at any time at our discretion, which may result in a decrease in the trading prices of our common stock. Even if our share repurchase program is fully implemented, it may not enhance long-term stockholder value. In October 2026, our Board of Directors authorized an additional $100.0 million increase to our common stock repurchase program.