Expensify, Inc.

Current report

We are subject to travel payments-related fraud risks.

Current report

Our results of operations and financial condition could be negatively affected by our unintentional acceptance of fraudulent travel bookings made using stolen credit and debit cards. We are sometimes held liable for accepting fraudulent bookings through our website or for accepting other bookings for which payment is subsequently disputed by our customers, both of which have lead, and in the future may lead to the reversal of payments received by our partners for such bookings (referred to as a “charge-back”). Our ability to detect and combat fraudulent schemes, which have become increasingly common and sophisticated, may be negatively impacted by the emergence and innovation of new technology platforms and our global expansion, including into markets with a history of elevated fraudulent activity. In addition, we have not broadly adopted certain protective capabilities across our platform, such as requiring mobile application-based multi-factor authentication or third-party identify verification, which could result in significantly increased fraudulent activity on our platform.

Current report

We depend on our travel partners to detect and prevent certain kinds of fraudulent bookings. If we or our partners are unable to effectively combat fraudulent bookings on our website or if we otherwise experience increased levels of charge-backs, our partners, and by extension we, may also be subject to significant fines and higher transaction fees, or payment card networks may revoke our partners' access to their networks, meaning they would be unable to continue to accept card payments for travel on our behalf, either of which could have a material adverse effect on our results of operations and financial condition.

Current report

The rapid evolution and increased adoption of AI technologies also increases the risk of fraudulent bookings. In addition to adversely affecting our business, results of operations and financial condition, any of the foregoing events could have a significant negative effect on the value of our brand, which could also in turn have a material adverse impact on our financial performance.

Previous report

We use third-party artificial intelligence technologies in our business, and the deployment, use, and maintenance of these technologies involve technological and legal risks.

Previous report

We use third-party artificial intelligence (“AI”), machine learning, and automated decision-making technologies (collectively, “AI Technologies”) throughout our business, and are making significant investments in this area.

Previous report

For example we use AI Technologies to optimize our internal processes, including analyzing and processing receipts and drafting personalized marketing communications.

Previous report

In particular, if the models underlying our AI Technologies are: incorrectly implemented; reliant on incomplete, inadequate, inaccurate, biased or otherwise poor quality data; used without sufficient oversight and governance to ensure their responsible use; and/or adversely impacted by unforeseen defects, technical challenges, cybersecurity threats or material performance issues, the performance of our products, services and business, as well as our reputation, could suffer or we could incur liability resulting from the violation of laws or contracts to which we are a party or civil claims.

Previous report

We use third-party AI Technologies and infrastructure which may pose operational and data security risks.

Previous report

We use AI Technologies licensed from third parties, such as OpenAI, in our technologies and our ability to continue to use such technologies at the scale we need may be dependent on access to OpenAI’s software and infrastructure. While we believe that there are alternative third-party AI Technologies which would be suitable, we cannot control the availability or pricing of such third-party AI Technologies, especially in a highly competitive environment, and we may be unable to negotiate favorable economic terms with the applicable providers. If any such third-party AI Technologies become incompatible with our solutions or unavailable for use, or if the providers of such models unfavorably change the terms on which their AI Technologies are offered or terminate their relationship with us, our solutions may become less appealing to our customers and our business will be harmed. In addition, to the extent any third-party AI Technologies are used as a hosted service, any disruption, outage, or loss of information through such hosted services could disrupt our operations or solutions, damage our reputation, cause a loss of confidence in our solutions, or result in legal claims or proceedings, for which we may be unable to recover damages from the affected provider.

Previous report

Additionally, our reliance on third-party AI Technologies, such as those licensed from OpenAI, involves certain data and security risks. While we seek to obtain contractual commitments from the applicable providers that prohibit the use of our data to train or refine their AI models, we may not be able to implement technical measures to prevent such providers from doing so in contravention to their contractual obligations.

Previous report

The use of generative AI Technologies may produce inaccurate or infringing content, leading to reputational damage and legal challenges.

Previous report

There is a risk that generative AI Technologies could produce inaccurate or misleading content or other discriminatory or unexpected results or behaviors, such as hallucinatory behavior that can generate irrelevant, nonsensical, or factually incorrect results, all of which could harm our reputation, business, or customer relationships. While we take measures designed to ensure the accuracy of such AI generated content and to monitor for potential inaccuracies, those measures may not always be successful, and in some cases, we may need to rely on end users to report such inaccuracies.\

Previous report

The regulatory framework governing the use of AI Technologies is rapidly evolving, and we cannot predict how future legislation and regulation will impact our ability to offer products or services that we develop which leverage AI Technologies.

Previous report

Already, certain existing legal regimes (e.g., relating to data privacy) regulate certain aspects of AI Technologies, and new laws regulating AI Technologies have been enacted in China and are expected to enter into force in the United States and the EU in 2024. In the United States, the Biden administration issued a broad Executive Order on the Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence (the “2023 AI Order”), that sets out principles intended to guide AI design and deployment for the public and private sector and signals the increase in governmental involvement and regulation over AI Technologies. The 2023 AI Order instructed several other federal agencies to promulgate additional regulations within specific timeframes regarding the use and development of AI Technologies. Already agencies such as the Department of Commerce and the Federal Trade Commission have issued proposed rules governing the use and development of AI Technologies. Additional legislation related to AI Technologies has also been introduced at the federal level and is advancing at the state level. In September 2024, California enacted seventeen new bills that further regulate use of AI Technologies and provide consumers with additional protections around companies’ use of AI Technologies, such as requiring companies to disclose certain uses of generative AI. These new bills may affect how we use AI Technologies in our business. For example, AB 1008 amends the CCPA to clarify that AI Technologies can generate output that is considered personal information, which would mean that California consumers have a right to request that such personal information generated by AI Technologies be deleted or corrected, pursuant to their rights under the CCPA. Such additional regulations may impact our ability to develop, use and commercialize AI Technologies in the future.

Previous report

In Europe, on August 1, 2024, the EU Artificial Intelligence Act (the “EU AI Act”) entered into force, and establishes a comprehensive, risk-based governance framework for AI in the EU market. The majority of the substantive requirements will apply from August 2, 2026. The EU AI Act applies to companies that develop, use and/or provide AI in the EU and includes requirements around transparency, conformity assessments and monitoring, risk assessments, human oversight, security, accuracy, general purpose AI and foundation models, and fines for breach of up to 7% of worldwide annual turnover. In addition, on September 28, 2022, the European Commission proposed two Directives seeking to establish a harmonized civil liability regime for AI in the EU. Once fully applicable, the EU AI Act and the Liability Directives will have a material impact on the way AI is regulated in the EU. Further, in Europe we are subject to the European Union General Data Protection Regulation (the “GDPR”), which regulates our use of personal data for automated decision making that results in a legal or similarly significant effect on an individual, and provides rights to individuals in respect of that automated decision making. Recent case law from the Court of Justice of the European Union (“CJEU”) has taken an expansive view of the scope of the GDPR’s requirements around automated decision making and introduced uncertainty in the interpretation of these rules. The EU AI Act, together with developing guidance and/or decisions in this area, may affect our use of AI Technologies and our ability to provide, improve or commercialize our services, require additional compliance measures and changes to our operations and processes, result in increased compliance costs and potential increases in civil claims against us, and could adversely affect our business, operations and financial condition.

Previous report

It is possible that further new laws and regulations will be adopted in the United States and in other non-U.S. jurisdictions, or that existing laws and regulations, including competition and antitrust laws, may be interpreted in ways that would limit our ability to use AI Technologies for our business, or require us to change the way we use AI Technologies in a manner that negatively affects the performance of our products, services, and business and the way in which we use AI Technologies. We may need to expend resources to adjust our products or services in certain jurisdictions if the laws, regulations, or decisions are not consistent across jurisdictions. Further, the cost to comply with such laws, regulations, or decisions and/or guidance interpreting existing laws, could be significant and would increase our operating expenses (such as by imposing additional reporting obligations regarding our use of AI Technologies). Such an increase in operating expenses, as well as any actual or perceived failure to comply with such laws and regulations, could adversely affect our business, financial condition and results of operations.