Skip to main content

DOMO INC

For the period ended Jan 31, 2025. Filed Apr 4, 2025.

View on SEC.gov

About this filing

A company's yearly report to the SEC, with audited financial statements. It is the fullest account a company gives of its business, its finances and the risks it sees.

FY2025 · Filed Apr 4, 2025

DOMO$3.55-4.1%Stored close · as of Sep 23, 2026

What changed in Risk Factors?

Read the current filing

Previous report: 10-K

Period ended 2024-01-31; filed 2024-03-28.

0001505952-24-000015

Item 1A. Risk Factors

Current report: 10-K

Period ended 2025-01-31; filed 2025-04-04.

0001505952-25-000045

Item 1A. Risk Factors

The baseline is this issuer’s latest earlier reporting period of the same form that was filed before the current report. A previous 10-Q is a different quarter, not a year-over-year comparison. Amendments are excluded.

Compared 314 previous paragraphs and 319 current paragraphs.

255 unchanged; 58 reworded; 3 added; 0 removed; 1 previous and 3 current paragraphs rearranged.

Tables are not compared: 0 previous and 0 current tables excluded. Dates, whitespace, punctuation and numbering changes are ignored; changes to financial figures remain significant.

A changed paragraph is not evidence that risk increased or decreased. An unchanged paragraph does not establish that risk stayed the same.

Added paragraphs (3)

Current report

There is no guarantee that we will be able to generate sufficient cash flow or sales to meet these financial covenants or pay the principal and interest on any such debt. Furthermore, there is no guarantee that future working capital, borrowings or equity financing will be available to repay or refinance any such debt. A breach of any of these covenants or the occurrence of certain other events (including a material adverse effect) specified in the credit facility and/or the related collateral documents could result in an event of default under the loan agreement. If an event of default has occurred and is continuing, the lenders could elect to declare all amounts outstanding under the credit facility immediately due and payable. If we are unable to repay those amounts, the lenders could foreclose on the collateral granted to them to secure such indebtedness. If the lenders accelerate the repayment of borrowings, if any, we may not have sufficient funds to repay our existing debt.

Current report

Artificial intelligence technologies also are subject to evolving legal and regulatory landscapes. Laws and regulations applicable to artificial intelligence continue to develop and may be inconsistent from jurisdiction to jurisdiction. For example, the Artificial Intelligence Act (EU AI Act), an E.U. regulation which came into effect on August 1, 2024, prohibits certain artificial intelligence applications and systems and imposes disclosure, transparency, and other requirements on the use of certain applications or systems. The EU AI Act could require us to alter or restrict our use of AI both in features or products available to our users and in our systems that interact with our users, depending on respective levels of risk-categorization, types of systems and manner of use. The EU AI Act also may require us to comply with monitoring and reporting requirements. We may need to devote substantial time and resources to evaluate our obligations under the EU AI Act and to develop and execute planned measures designed to comply with it. There have been numerous other laws and bills proposed at the U.S. federal and state level, as well as internationally, aimed at regulating the deployment or provision of AI systems and services or otherwise addressing aspects of the development or use of artificial intelligence. This includes the Utah Artificial Intelligence Policy Act, which, among other things, imposes disclosure requirements on entities using generative artificial intelligence with customers, and other similar regulatory schemes enacted by other states in the United States.

Current report

We expect laws, regulations, industry standards and other obligations worldwide relating to privacy, data protection, and cybersecurity to continue to evolve, and that there will continue to be new, modified, and re-interpreted laws, regulations, standards, and other obligations in these areas. For example, the Network and Information Security Directive II (NIS2), adopted in 2023, aims to enhance cybersecurity across critical infrastructure and essential services in the E.U. It expands the scope of the 2016 NIS Directive to include additional sectors while enforcing stricter governance and accountability requirements. NIS2 requires all 27 E.U. member states to issue implementing legislation by October 2024; however, several E.U. member states have not finalized their respective legislation and guidance. Additionally, the Digital Operational Resiliency Act (DORA) became effective on January 17, 2025, and aims to establish a universal framework for managing and mitigating information and communication technology risk that will apply to entities in the financial sector and their third-party cloud service providers.
Reworded paragraphs (58)

Previous wording

We incurred net losses of $102.1 million, $105.6 million and $75.6 million for the years ended January 31, 2022, 2023 and 2024, respectively, and had an accumulated deficit of $1,405.6 million at January 31, 2024. We may not be able to generate sufficient revenue to achieve or sustain profitability. We expect to continue to incur losses for the foreseeable future and we expect costs to increase in future periods as we expend substantial financial and other resources on, among other things:

Current wording

We incurred net losses of $105.6 million, $75.6 million and $81.9 million for the years ended January 31, 2023, 2024 and 2025, respectively, and had an accumulated deficit of $1,487.5 million at January 31, 2025. We may not be able to generate sufficient revenue to achieve or sustain profitability. We expect to continue to incur losses for the foreseeable future and we expect costs to increase in future periods as we expend substantial financial and other resources on, among other things:

Previous wording

•technology and data center infrastructure, enhancements to cloud architecture, improved disaster recovery protection, increasing data security, compliance and operations expenses;

Current wording

•technology and data center infrastructure, enhancements to cloud architecture, improved disaster recovery protection, and increasing cybersecurity, compliance and operations expenses;

Previous wording

Our business and operations may consume resources faster than we anticipate. We have incurred cumulative and recurring losses from operations since inception and had an accumulated deficit of $1,405.6 million as of January 31, 2024. We have also experienced negative or close to breakeven cash flows from operating activities, including cash used in operating activities of $10.9 million for the year ended January 31, 2023 and cash provided by operating activities of $0.4 million and $2.6 million for the years ended January 31, 2022 and 2024, respectively. As of January 31, 2024, we had $60.9 million of cash, cash equivalents, and restricted cash which were held for working capital purposes, of which $3.7 million was restricted cash. Additionally, no amounts were available to draw under our credit facility.

Current wording

Our business and operations may consume resources faster than we anticipate. We have incurred cumulative and recurring losses from operations since inception and had an accumulated deficit of $1,487.5 million as of January 31, 2025. We have also experienced negative or close to breakeven cash flows from operating activities, including cash provided by operating activities of $2.6 million and cash used in operating activities of $9.1 million for the years ended January 31, 2024 and 2025, respectively. As of January 31, 2025, we had $45.3 million of cash and cash equivalents, which were held for working capital purposes. Additionally, no amounts were available to draw under our credit facility.

Previous wording

We may need to raise additional funds to invest in growth opportunities, to continue product development and sales and marketing efforts, and for other purposes. Additional financing may not be available on favorable terms, if at all. If adequate funds are not available on acceptable terms, we may be unable to meet our obligations, invest in future growth opportunities, or continue operations at anticipated levels, which could harm our business and operating results. In addition, current and future debt instruments may impose restrictions on our ability to dispose of property, make changes in our business, engage in mergers or acquisitions, incur additional indebtedness, and make investments and distributions. Furthermore, if we issue additional equity securities, stockholders will experience dilution, and the new equity securities could have rights senior to those of our common stock. Because our decision to issue securities in any future offering will depend on market conditions and other factors beyond our control, we cannot predict or estimate the amount, timing or nature of any such future offerings. As a result, stockholders bear the risk that future securities offerings reduce the market price of our Class B common stock and dilute their interest.

Current wording

We may need to raise additional funds to invest in growth opportunities, to continue product development and sales and marketing efforts, and for other purposes. We filed: (i) on September 6, 2024, a shelf registration statement on Form S-3 with the SEC that became effective on September 20, 2024 and allows us to undertake various equity and debt offerings up to $300.0 million; and (ii) on September 20, 2024, a prospectus supplement to the shelf registration statement that covers the offering, issuance and sale of up to $150.0 million of our Class B common stock from time to time through an “at-the-market” program under the Securities Act. Additional financing may not be available on favorable terms, if at all. If adequate funds are not available on acceptable terms, we may be unable to meet our obligations, invest in future growth opportunities, or continue operations at anticipated levels, which could harm our business and operating results. In addition, current and future debt instruments may impose restrictions on our ability to dispose of property, make changes in our business, engage in mergers or acquisitions, incur additional indebtedness, and make investments and distributions. Furthermore, if we issue additional equity securities, stockholders will experience dilution, and the new equity securities could have rights senior to those of our common stock. Because our decision to issue securities in any future offering will depend on market conditions and other factors beyond our control, we cannot predict or estimate the amount, timing or nature of any such future offerings. As a result, stockholders bear the risk that future securities offerings reduce the market price of our Class B common stock and dilute their interest.

Previous wording

•general economic and political conditions, both domestically and internationally, including the impacts of pandemics or other catastrophic events, military conflicts (including the Russian invasion of Ukraine, and hostilities between Israel and Hamas), inflation, and adverse impacts to the financial service services industry, as well as economic conditions specifically affecting industries in which our customers operate.

Current wording

•general economic and political conditions, both domestically and internationally, including the impacts of pandemics or other catastrophic events, military conflicts (including the Russian invasion of Ukraine, and hostilities between Israel and Hamas), inflation, and adverse impacts to the financial services industry, as well as economic conditions specifically affecting industries in which our customers operate.

Previous wording

We offer our platform primarily through subscription agreements, which typically vary in length between one and three years, and may in many cases be subject to automatic renewal or renewal only at a customer's discretion. We generally invoice our customers in annual installments at the beginning of each year in the subscription period. Amounts that have been invoiced are initially recorded as deferred revenue and are recognized ratably over the subscription period. As a result, most of the revenue that we report in each period is derived from the recognition of deferred revenue relating to subscriptions entered into during previous periods. A decline in new or renewed subscriptions in any one quarter is not likely to have a material impact on results for that quarter. However, declines would negatively affect revenue and deferred revenue balances in future periods, and the effect of significant downturns in sales and market acceptance of our platform, and potential changes in our rate of renewals, may not be fully reflected in our results of operations until future periods. Our subscription model also makes it difficult for us to rapidly increase our total revenue through additional sales in any period, as revenue from new customers is recognized over the applicable subscription term. We may be unable to adjust our cost structure to reflect the changes in revenue. In addition, a significant majority of our costs are expensed as incurred, while revenue is generally recognized over the life of the customer agreement. As a result, increased growth in the number of our customers could result in our recognition of more costs than revenue in the earlier periods of the terms of our agreements.

Current wording

We offer our platform primarily through agreements which typically vary in length between one and five years, and in many cases may be subject to automatic renewal or renewal only at a customer's discretion. We generally invoice our customers in annual installments at the beginning of each year in the subscription period. Amounts that have been invoiced are initially recorded as deferred revenue and are recognized ratably over the subscription period. As a result, most of the revenue that we report in each period is derived from the recognition of deferred revenue relating to subscriptions entered into during previous periods. A decline in new or renewed subscriptions in any one quarter is not likely to have a material impact on results for that quarter. However, declines would negatively affect revenue and deferred revenue balances in future periods, and the effect of significant downturns in sales and market acceptance of our platform, and potential changes in our rate of renewals, may not be fully reflected in our results of operations until future periods. Our subscription model also makes it difficult for us to rapidly increase our total revenue through additional sales in any period, as revenue from new customers and higher subscription renewals from existing customers is recognized over the applicable subscription term. We may be unable to adjust our cost structure to reflect the changes in revenue. In addition, a significant majority of our costs are expensed as incurred, while revenue is generally recognized over the life of the customer agreement. As a result, increased growth in the number of our customers could result in our recognition of more costs than revenue in the earlier periods of the terms of our agreements.

Previous wording

Our credit facility contains restrictive covenants that may limit our operating flexibility.

Current wording

Our credit facility contains restrictive and financial covenants that may limit our operating flexibility.

Previous wording

Our credit facility contains restrictive covenants that limit our ability to transfer or dispose of assets, merge with other companies or consummate certain changes of control, acquire other companies, open new offices that contain a material amount of assets, pay dividends, incur additional indebtedness and liens and enter into new businesses. We therefore may not be able to engage in any of the foregoing transactions unless we obtain the consent of the lender or terminate the credit facility, which may limit our operating flexibility. In addition, our credit facility is secured by all of our assets, including our intellectual property, and requires us to satisfy certain financial covenants. There is no guarantee that we will be able to generate sufficient cash flow or sales to meet these financial covenants or pay the principal and interest on any such debt. Furthermore, there is no guarantee that future working capital, borrowings or equity financing will be available to repay or refinance any such debt. Any inability to make scheduled payments or meet the financial covenants on our credit facility would adversely affect our business.

Current wording

Our credit facility contains restrictive covenants that limit our ability to, among other things, transfer or dispose of assets, merge with other companies or consummate certain changes of control, acquire other companies, open new offices that contain a material amount of assets, pay dividends, incur additional indebtedness and liens and enter into new businesses. We therefore may not be able to engage in any of the foregoing transactions unless we obtain the consent of the lenders or terminate the credit facility, which may limit our operating flexibility. In addition, our credit facility is secured by all of our assets, including our intellectual property, and requires us to satisfy certain financial covenants. If we do not meet the financial covenants as specified in the credit facility, we may require forbearance or relief from our financial covenant violations from the lenders or be required to arrange alternative financing.

Previous wording

New income, sales, use or other tax laws, statutes, rules, regulations or ordinances could be enacted at any time, which could affect the tax treatment of our (and our subsidiaries’) domestic and foreign financial results. Any new taxes could adversely affect our domestic and international business operations, and our business and financial performance. Further, existing tax laws, statutes, rules, regulations or ordinances could be interpreted, changed, modified or applied adversely to us. For example, the Tax Cuts & Jobs Act of 2017 eliminated the ability to deduct research and development expenditures currently and instead requires taxpayers to capitalize and amortize those expenditures over five or fifteen years. However, recently proposed tax legislation, if enacted, would restore the ability to deduct currently domestic research and development expenditures through 2025 and would retroactively restore this benefit for 2022 and 2023. Further, the Inflation Reduction Act of 2022 introduced a non-deductible excise tax of 1% on the value of certain share repurchases by publicly traded corporations, which may increase the costs to us of any share repurchases.

Current wording

New income, sales, use or other tax laws, statutes, rules, regulations or ordinances could be enacted at any time, which could affect the tax treatment of our (and our subsidiaries’) domestic and foreign financial results. Any new taxes could adversely affect our domestic and international business operations, and our business and financial performance. Further, existing tax laws, statutes, rules, regulations or ordinances could be interpreted, changed, modified or applied adversely to us. For example, the Tax Cuts & Jobs Act of 2017 eliminated the ability to deduct research and development expenditures currently and instead requires taxpayers to capitalize and amortize those expenditures over five or fifteen years. Further, the Inflation Reduction Act of 2022 introduced a non-deductible excise tax of 1% on the value of certain share repurchases by publicly traded corporations, which may increase the costs to us of any share repurchases.

Previous wording

As of January 31, 2024, we had net operating loss (NOL) carryforwards for federal and state income tax purposes of approximately $1,178.3 million and $1,352.8 million, respectively, which may be available to offset taxable income in the future. The federal NOLs will begin to expire in various years beginning in 2032 if not utilized. The state NOLs will expire depending on the various rules in the state jurisdictions in which we operate. A lack of future taxable income could adversely affect our ability to utilize these NOLs before they expire.

Current wording

As of January 31, 2025, we had net operating loss (NOL) carryforwards for federal and state income tax purposes of approximately $1,183.2 million and $1,364.4 million, respectively, which may be available to offset taxable income in the future. The federal NOLs will begin to expire in various years beginning in 2032 if not utilized. The state NOLs will expire depending on the various rules in the state jurisdictions in which we operate. A lack of future taxable income could adversely affect our ability to utilize these NOLs before they expire.

Previous wording

In general, under Section 382 of the Internal Revenue Code of 1986, as amended (the Code), a corporation that undergoes an "ownership change" (as defined under Section 382 of the Code and applicable Treasury Regulations) is subject to limitations on its ability to utilize its pre-ownership change NOLs to offset its future taxable income. An ownership change under Section 382 of the Code could affect our ability to utilize the NOLs to offset our income. Furthermore, our ability to utilize NOLs of companies that we have acquired or may acquire in the future may be subject to limitations. We have historically contracted third parties to perform a Section 382 analysis to evaluate limitations on our NOLs due to ownership changes, with the most recent analysis being through January 31, 2023. There is also a risk that due to regulatory changes, such as suspensions on the use of NOLs or other unforeseen reasons, our existing NOLs could expire or otherwise be unavailable to reduce future income tax liabilities for federal and state tax purposes. For these reasons, we may not be able to utilize a material portion of our NOLs, even if we attain profitability, which could potentially result in increased future tax liability to us and could adversely affect our operating results and financial condition.

Current wording

In general, under Section 382 of the Internal Revenue Code of 1986, as amended, (the Code), a corporation that undergoes an "ownership change" (as defined under Section 382 of the Code and applicable Treasury Regulations) is subject to limitations on its ability to utilize its pre-ownership change NOLs to offset its future taxable income. An ownership change under Section 382 of the Code could affect our ability to utilize the NOLs to offset our income. Furthermore, our ability to utilize NOLs of companies that we have acquired or may acquire in the future may be subject to limitations. We have historically contracted third parties to perform a Section 382 analysis to evaluate limitations on our NOLs due to ownership changes, with the most recent analysis being through January 31, 2023. There is also a risk that due to regulatory changes, such as suspensions on the use of NOLs or other unforeseen reasons, our existing NOLs could expire or otherwise be unavailable to reduce future income tax liabilities for federal and state tax purposes. Limitations may also apply under state law. For example, recently enacted California legislation limits the use of state NOL carryforwards for tax years beginning on or after January 1, 2024 and before January 1, 2027. As a result of this legislation or other unforeseen reasons, we may not be able to utilize some or all of our NOL carryforwards, even if we attain profitability.

Previous wording

We rely on data centers and other technologies and services provided by third parties in order to manage our cloud-based infrastructure and operate our business. If any of these services becomes unavailable or otherwise is unable to serve our requirements due to extended outages, interruptions, facility closure, or because it is no longer available on commercially reasonable terms, expenses could increase, our ability to manage finances could be interrupted and our operations otherwise could be disrupted or otherwise impacted until appropriate substitute services, if available, are identified, obtained, and implemented.

Current wording

We rely on data centers and other technologies and services (including artificial intelligence) provided by third parties in order to manage our cloud-based infrastructure and operate our business. If any of these services becomes unavailable or otherwise is unable to serve our requirements due to extended outages, interruptions, facility closure, or because it is no longer available on commercially reasonable terms, expenses could increase, our ability to manage finances could be interrupted and our operations otherwise could be disrupted or otherwise impacted until appropriate substitute services, if available, are identified, obtained, and implemented.

Previous wording

Any unavailability of, or failure to meet our requirements by, third-party data centers or other third-party technologies or services, or any disruption of the internet or the third-party networks or facilities that we rely upon, could impede our ability to provide services to customers, harm our reputation, result in a loss of customers, cause us to issue refunds or service credits to customers, subject us to potential liabilities, result in contract terminations, and adversely affect our renewal rates. Any of these circumstances could adversely affect our business and operating results.

Current wording

Any unavailability of, or failure to meet our requirements by, third-party data centers or other third-party technologies or services, or any disruption of the internet or the third-party networks or facilities that we rely upon, could impede our ability to provide services to customers, harm our reputation, result in a loss of customers, cause us to issue refunds or service credits to customers, subject us to potential liabilities or investigations, result in contract terminations, and adversely affect our renewal rates. Any of these circumstances could adversely affect our business and operating results.

Previous wording

The market for our platform is intensely and increasingly competitive and subject to rapidly changing technology and evolving standards. In addition, many companies in our target market are offering, or may soon offer, products and services that may compete with our platform. Furthermore, many potential customers have made significant investments in legacy software systems and may be unwilling to invest in new solutions.

Current wording

The market for our platform is intensely and increasingly competitive and subject to rapidly changing technology and evolving standards. In addition, many companies in our target market are offering, or may soon offer, products and services that may compete with our platform. If we are unable to maintain and enhance our digital platforms, cloud platforms, and artificial intelligence related tools to keep pace with competitors and align with evolving customer expectations and demands, it could adversely impact our sales revenues and ability to retain existing and attract new customers. Furthermore, many potential customers have made significant investments in legacy software systems and may be unwilling to invest in new solutions.

Previous wording

•business analytics software companies, such as Tableau Software, Inc., Qlik Technologies, Looker Data Sciences, Inc., Sisense, Inc., and Tibco Software, Inc.; and

Current wording

•business analytics software companies, such as Tableau Software, Inc. (acquired by salesforce.com, inc.), Qlik Technologies, Looker Data Sciences, Inc. (acquired by Alphabet, Inc.), MicroStrategy, ThoughtSpot, Alteryx, Informatica, Sisense, Inc., and Tibco Software, Inc.; and

Previous wording

•SaaS-based products or cloud-based analytics providers such as salesforce.com, Inc. and Infor, Inc.

Current wording

•SaaS-based products or cloud-based analytics providers such as Amazon Web Services, Sigma Computing, Fivetran, Matillion, salesforce.com, inc. and Infor, Inc.

Previous wording

Our ability to compete successfully depends on a number of factors, both within and outside of our control. Some of these factors include ease and speed of platform deployment and use, accessibility across mobile devices, operating systems, and applications, discovery and visualization capabilities, analytical and statistical capabilities, performance and scalability, the quality of our data security infrastructure, the quality and reliability of our customer service and support, total cost of ownership, return on investment and brand recognition. Any failure by us to compete successfully in any one of these or other areas may reduce the demand for our platform, as well as adversely affect our business, operating results and financial condition.

Current wording

Our ability to compete successfully depends on a number of factors, both within and outside of our control. Some of these factors include ease and speed of platform deployment and use, accessibility across mobile devices, operating systems, and applications, discovery and visualization capabilities, analytical and statistical capabilities, performance and scalability, the quality of our cybersecurity infrastructure, the quality and reliability of our customer service and support, total cost of ownership, return on investment and brand recognition. Any failure by us to compete successfully in any one of these or other areas may reduce the demand for our platform, as well as adversely affect our business, operating results and financial condition.

Previous wording

Moreover, current and future competitors may also make strategic acquisitions or establish cooperative relationships among themselves or with others. By doing so, these competitors may increase their ability to meet the needs of customers. These relationships may limit our ability to sell or certify our platform through specific distributors, technology providers, database companies and distribution channels and allow competitors to rapidly gain significant market share. These developments could limit our ability to obtain revenue from existing and new customers. If we are unable to compete successfully against competitors, our business, operating results and financial condition would be harmed.

Current wording

As part of our ongoing strategic initiative, we have collaborated with and may in the future collaborate with companies with whom we also compete from time to time, in order to leverage shared expertise and enhance our collective ability to innovate and address evolving market demands. However, current and future competitors have also made and may continue to make strategic acquisitions or establish cooperative relationships among themselves or with others. By doing so, these competitors may increase their ability to meet the needs of customers. These relationships may limit our ability to sell or certify our platform through specific distributors, technology providers, database companies and distribution channels and allow competitors to rapidly gain significant market share. These developments could limit our ability to obtain revenue from existing and new customers. If we are unable to compete successfully against competitors, our business, operating results and financial condition would be harmed.

Previous wording

Our pricing and subscription models have evolved over time, and will continue to evolve in the future. We have started to introduce consumption-based pricing, which is pricing based upon the use of our platform, for certain of our customers. We have limited experience with determining the optimal pricing for our consumption-based contracts. Revenue recognized for certain customers may be negatively impacted due to our new consumption-based pricing model. For example, certain customers may end up using less data than originally contemplated in their initial consumption-based contract resulting in lower net retention in future years. The success of our pricing model transition is subject to numerous variables, including, but not limited to, customer demand, renewal and expansion rates, our ability to further develop and scale infrastructure, the ability of our sales force to successfully execute new sales strategies, tax and accounting implications, pricing, and our costs. Moreover, changes in our pricing and subscription models subject us to a number of uncertainties, including our ability to plan for and model future growth and make accurate projections regarding our future performance. Changes to our pricing and subscription models may also expose to unexpected or unintended effects, including increased user dissatisfaction, reputational harm and difficulty obtaining or retaining customers. Further, large customers, which are the focus of our direct sales efforts, may demand greater price discounts. In an inflationary environment, our costs may increase and we may not be able to adjust our pricing models accordingly, which could adversely impact our financial performance.

Current wording

Our pricing and subscription models have evolved over time and will continue to evolve in the future. While more than 68% our annual recurring revenue is now utilizing the platform as a consumption-based service, it is relatively new to our business and therefore contains inherent risks. Revenue recognized for certain customers may be negatively impacted due to our new consumption-based pricing model. For example, certain customers may end up using less data than originally contemplated in their initial consumption-based contract resulting in lower net retention in future years. Additionally, we believe our partner ecosystem will become increasingly important to our business as we continue its expansion. If our partners decide to internally adopt tools that we provide or find other ways that will reduce their need for our platform, that could result in lower volume of usage, which could adversely impact our financial performance. The success of our pricing model transition is subject to numerous variables, including, but not limited to, customer demand, renewal and expansion rates, our ability to capture upside from over-usage of volume in future contracts, our ability to further develop and scale infrastructure, the ability of our sales force to successfully execute new sales strategies and drive adoption of our platform, tax and accounting implications, pricing, and our costs. Moreover, changes in our pricing and subscription models subject us to a number of uncertainties, including our ability to plan for and model future growth and make accurate projections regarding our future performance. Changes to our pricing and subscription models may also expose us to unexpected or unintended effects, including increased user dissatisfaction, reputational harm and difficulty obtaining or retaining customers. Further, large customers, which are the focus of our direct sales efforts, may demand greater price discounts. In an inflationary environment, our costs may increase and we may not be able to adjust our pricing models accordingly, which could adversely impact our financial performance.

Previous wording

In addition, issues in the use of artificial intelligence in our platform may result in reputational harm or liability. Domo’s suite of data science leverages machine learning algorithms, predictive analytics, and other artificial intelligence technologies to identify trends, anomalies and correlations, provide alerts and initiate business processes. Artificial intelligence presents risks and challenges that could affect its adoption, and therefore our business. Artificial intelligence algorithms may be flawed. Datasets may be insufficient or contain biased information. Artificial intelligence technologies that we make use of may produce or create outputs that appear correct but are factually inaccurate or otherwise flawed. Inappropriate or controversial data practices by us or others could impair the acceptance of artificial intelligence solutions. These deficiencies could undermine the decisions, predictions, or analysis artificial intelligence applications produce, subjecting us to competitive harm, legal liability, and brand or reputational harm. Additionally, artificial intelligence technologies are complex and rapidly evolving, and we face significant competition from other companies as well as evolving legal and regulatory landscapes. Laws and regulations applicable to artificial intelligence continue to develop and may be inconsistent from jurisdiction to jurisdiction. For example, the E.U. has proposed an Artificial Intelligence Act that, if finalized, would prohibit certain artificial intelligence applications and systems and impose additional requirements on the use of certain applications or systems. The use of artificial intelligence technologies in our platform may result in new or enhanced governmental or regulatory scrutiny, new or modified laws or regulations, claims, demands, and litigation, confidentiality, privacy, data protection, or security risks, ethical concerns, or other complications that could adversely affect our business, financial condition, results of operations and prospects. Uncertainty around new and emerging artificial intelligence technologies may require additional investment in the development and maintenance of proprietary datasets and machine learning models, development of new approaches and processes to provide attribution or remuneration to creators of training data, and development of appropriate protections, safeguards, and policies for handling the processing of data with artificial intelligence technologies, which may be costly and could impact our expenses.

Current wording

In addition, the use of artificial intelligence tools on our platform may raise novel and complex issues that could result in liability, regulatory inquiry or reputational harm. Domo’s suite of data science leverages machine learning algorithms, predictive analytics, and other artificial intelligence technologies to identify trends, anomalies and correlations, provide alerts and initiate business processes. Artificial intelligence presents risks and challenges that could affect its adoption, and therefore our business. Artificial intelligence algorithms may be, or be perceived to be, deficient, inaccurate, biased, unethical or otherwise flawed. Datasets may be insufficient or contain biased information. Artificial intelligence technologies that we make use of may produce or create outputs that may appear correct but are factually inaccurate or otherwise flawed. Inappropriate or controversial data practices by us or others could impair the acceptance of artificial intelligence solutions. These actual or perceived deficiencies could undermine the decisions, predictions, inferences, analysis or other outputs that artificial intelligence applications produce, or this could be believed or reported to occur, subjecting us to competitive harm, legal liability, and brand or reputational harm. Additionally, artificial intelligence technologies are complex and rapidly evolving, and we face significant competition from other companies.

Previous wording

Moreover, many competitors expend a considerably greater amount of funds on their research and development programs, and those that do not may be acquired by larger companies that would allocate greater resources to competitors’ research and development programs. If we fail to maintain adequate research and development resources or compete effectively with the research and development programs of competitors, our business could be harmed. Our ability to grow is also subject to the risk of future disruptive technologies. If new technologies emerge that are able to deliver business intelligence solutions at lower prices, more efficiently, more conveniently or more securely, such technologies could adversely affect our ability to compete.

Current wording

Moreover, many competitors expend a considerably greater amount of funds on their research and development programs, and those that do not may be acquired by larger companies that would allocate greater resources to competitors’ research and development programs. If we fail to maintain adequate research and development resources or compete effectively with the research and development programs of competitors, our business could be harmed. Our ability to grow is also subject to the risk of future disruptive technologies. If new technologies, such as those relating to artificial intelligence, emerge or improve such that they are able to deliver business intelligence solutions or otherwise perform similar functions as our platform at lower prices, more efficiently, more conveniently or more securely, such technologies could adversely affect our ability to compete.

Previous wording

We have experienced management and board turnover, which creates uncertainties and could harm our business.

Current wording

We have experienced changes to our management and board, which creates uncertainties and could harm our business.

Previous wording

In March 2023, we announced John Mellor's resignation and the re-appointment of Joshua G. James as our chief executive officer. In December 2022, we announced the resignation of Bruce Felt as our chief financial officer and, in March 2023, the appointment of David Jolley to replace Mr. Felt. In January 2023, we announced the resignation of Catherine Wong as our chief operating officer and executive vice president of engineering and the appointment of Daren Thayne to succeed Ms. Wong as executive vice president of engineering. Mr. Thayne assumed the responsibilities of Ms. Wong in addition to his previous responsibilities. In addition, we recently have experienced significant changes in the composition of our board of directors, and more could occur in the future. In February 2023, we announced the resignation of Laurence “Jay” Brown, Jr., Dana Evan and Joy Driscoll Durling as our directors. In March 2023, we announced the appointment of Dan Strong and Renée Soto to our board of directors to fill the open vacancies. Changes to strategic or operating goals, which can often times occur with the appointment of new executives and directors, can create uncertainty, may negatively impact our ability to execute quickly and effectively, and may ultimately be unsuccessful. In addition, executive leadership and director transition periods are often difficult as the new executives and directors gain more detailed knowledge of our operations, and friction can result from changes in strategy and management style. Management and board turnover inherently causes some loss of institutional knowledge, which can negatively affect strategy and execution. In addition, to the extent we experience additional management turnover, competition for top management is high and it may take months to find a candidate that meets our requirements. If we are unable to attract and retain qualified management personnel, our business could suffer.

Current wording

We have experienced changes to our management and board in recent years. Changes to strategic or operating goals, which can often times occur with the appointment of new executives and directors, can create uncertainty, may negatively impact our ability to execute quickly and effectively, and may ultimately be unsuccessful. In addition, executive leadership and director transition periods are often difficult as the new executives and directors gain more detailed knowledge of our operations, and friction can result from changes in strategy and management style. Management and board changes may inherently causes some loss of institutional knowledge, which can negatively affect strategy and execution. In addition, to the extent we experience management turnover, competition for top management is high and it may take months to find a candidate that meets our requirements. If we are unable to attract and retain qualified management personnel, our business could suffer.

Previous wording

Our long-term growth depends in part on being able to expand internationally on a profitable basis.

Current wording

Our long-term growth may depend in part on being able to expand internationally on a profitable basis.

Previous wording

Historically, we have generated a substantial majority of our revenue from customers inside the United States. For example, approximately 78%, and 79% of our total revenue for the years ended January 31, 2023 and 2024, respectively, was derived from sales within the United States. We have begun to expand internationally and plan to continue to expand our international operations as part of our growth strategy. Expanding our international operations will subject us to a variety of risks and challenges, including:

Current wording

Historically, we have generated a substantial majority of our revenue from customers inside the United States. For example, approximately 79%, and 80% of our total revenue for the years ended January 31, 2024 and 2025, respectively, was derived from sales within the United States. We continue to expand internationally and plan to continue to expand our international operations as part of our growth strategy. Expanding our international operations will subject us to a variety of risks and challenges, including:

Previous wording

•political instability, terrorist activities or military conflicts (including the Russian invasion of Ukraine and hostilities between Israel and Hamas);

Current wording

•political instability, terrorist activities or military conflicts (including Russia’s invasion of Ukraine and hostilities between Israel and Hamas);

Previous wording

•requirements to comply with foreign privacy, information security, and data protection laws and regulations and the risks and costs of non-compliance;

Current wording

•requirements to comply with foreign privacy, cybersecurity, and data protection laws and regulations and the risks and costs of noncompliance;

Previous wording

Any of these risks could adversely affect our international operations, reduce our international revenue or increase our operating costs, adversely affecting our business, operating results and financial condition and growth prospects. Our limited experience operating our business in certain geographies outside of the United States increases the risk that recent and any potential future expansion efforts will not be successful. If substantial time and resources invested to expand our international operations do not result in a successful outcome, our operating results and business will suffer.

Current wording

Any of these risks could adversely affect our international operations, reduce our international revenue or increase our operating costs, adversely affecting our business, operating results and financial condition and growth prospects. Our limited experience operating our business in certain geographies outside of the United States increases the risk that recent and any potential future expansion efforts will not be successful. If substantial time and resources invested to expand our international operations do not result in a successful outcome, our operating results and business may suffer.

Previous wording

In addition, compliance with laws and regulations applicable to our international operations increases the cost of doing business in foreign jurisdictions. We may be unable to keep current with changes in government requirements as they change from time to time. Failure to comply with these regulations could have adverse effects on our business. In addition, in many foreign countries it is common for others to engage in business practices that are prohibited by our internal policies and procedures or U.S. laws and regulations applicable to us. There can be no assurance that all of our employees, contractors, and agents will comply with the formal policies we will implement, or applicable laws and regulations. Violations of laws or key control policies by our employees, contractors, channel partners or agents could result in delays in revenue recognition, financial reporting misstatements, fines, penalties, or the prohibition of the importation or exportation of our software and services and could have a material adverse effect on our business and operating results.

Current wording

In addition, compliance with laws and regulations applicable to our international operations increases the cost of doing business in foreign jurisdictions. We may be unable to keep current with changes in government requirements as they change from time to time. Failure to comply with these regulations could have adverse effects on our business. In addition, in many foreign countries it is common for others to engage in business practices that are prohibited by our internal policies and procedures or U.S. laws and regulations applicable to us. There can be no assurance that all of our employees, contractors, and agents will comply with the formal policies we will implement, or applicable laws and regulations. Violations of laws or key control policies by our employees, contractors, channel partners or agents could result in delays in revenue recognition, financial reporting misstatements, fines, penalties, or the prohibition of the importation or exportation of our software and services and could adversely affect our business and operating results.

Previous wording

We are subject to general business regulations and laws, as well as regulations and laws specifically governing the internet and software, in the United States as well as the international markets in which we do business. These regulations and laws may cover employment, taxation, privacy, data security, data protection, pricing, content, copyrights and other intellectual property, mobile communications, electronic contracts and other communications, consumer protection, unencumbered internet access to our services, the design and operation of websites, and the characteristics and quality of software and services. It is possible changes to these regulations and laws, as well as compliance challenges related to the complexity of multiple, conflicting and changing sets of applicable regulations and laws, may impact our sales, operations, and future growth.

Current wording

We are subject to general business regulations and laws, as well as regulations and laws specifically governing the internet and software, in the United States as well as the international markets in which we do business. These regulations and laws may cover employment, taxation, privacy, cybersecurity, data protection, pricing, content, copyrights and other intellectual property, mobile communications, electronic contracts and other communications, consumer protection, unencumbered internet access to our services, the design and operation of websites, artificial intelligence, and the characteristics and quality of software and services. It is possible changes to these regulations and laws, as well as compliance challenges related to the complexity of multiple, conflicting and changing sets of applicable regulations and laws, may impact our sales, operations, and future growth.

Previous wording

•potential known and unknown liabilities associated with an acquired company;

Current wording

•potential known and unknown liabilities, compliance risks, cybersecurity risks, privacy risks, or other risks associated with an acquired company;

Previous wording

We are subject to governmental laws, regulation and other legal obligations, particularly those related to privacy, data protection and information security, and any actual or perceived failure to comply with such obligations could impair our efforts to maintain and expand our customer base, causing our growth to be limited and harming our business.

Current wording

We are subject to governmental laws, regulation and other legal obligations, particularly those related to privacy, data protection and cybersecurity, and any actual or perceived failure to comply with such obligations could impair our efforts to maintain and expand our customer base, causing our growth to be limited and harming our business.

Previous wording

We receive, store, and otherwise process personal information and other data from and about customers and other individuals in addition to our employees and service providers. Our handling of data is subject to a variety of laws and regulations, including regulation by various government agencies, such as the U.S. Federal Trade Commission (FTC) and various state, local, and foreign agencies. Our data handling also is subject to contractual obligations and may be alleged or deemed to be subject to industry standards, including certain industry standards that we undertake to comply with.

Current wording

We receive, store, and otherwise process personal information and other data from and about customers and other individuals in addition to our employees and service providers. Our handling of data is subject to a variety of laws and regulations, including regulation by various government agencies, such as the U.S. Federal Trade Commission (the FTC) and various state, local, and foreign agencies. Our data handling also is subject to contractual obligations and may be alleged or deemed to be subject to industry standards, including certain industry standards that we undertake to comply with.

Previous wording

In the United States, various laws and regulations apply to the collection, disclosure, and other processing of certain types of data, including with respect to security measures used to protect such data. Additionally, the FTC and many state attorneys general are interpreting federal and state consumer protection laws as imposing standards for the collection, use, dissemination, security, and other processing of data. The laws and regulations relating to privacy and data security are evolving, can be subject to significant change, and may result in ever-increasing regulatory and public scrutiny and escalating levels of enforcement and sanctions. For example, California in 2018 enacted the California Consumer Privacy Act (CCPA), which went into effect on January 1, 2020. The CCPA requires covered companies to, among other things, provide disclosures to California consumers and afford such consumers new abilities to opt-out of certain sales of personal information. Additionally, the California Privacy Rights Act (CPRA) was approved by California voters in the November 3, 2020 election. The CPRA amends and expands the CCPA in numerous respects, including by expanding the CCPA’s private right of action. The CPRA created additional obligations relating to consumer data beginning on January 1, 2022, and became effective January 1, 2023. Following enactment of the CCPA, many other states have adopted or considered privacy legislation, many of which are comprehensive laws similar to the CCPA and CPRA. For example, Virginia, Colorado, Utah, and Connecticut have adopted such legislation that became effective in 2023, Texas, Montana, Oregon, and Florida have adopted such legislation that will become effective in 2024, Delaware, Iowa and Tennessee have adopted such legislation that will become effective in 2025, and Indiana has adopted such legislation that will become effective in 2026. Broad federal privacy legislation has also been proposed. Additionally, states have adopted other laws and regulations relating to privacy and information security, such as Washington’s My Health, My Data Act, which includes a private right of action. These and other new and evolving laws and regulations relating to privacy in the U.S. could increase our potential liability and adversely affect our business. Aspects of these laws and regulations and their interpretation and enforcement remain uncertain. We cannot fully predict the impact of these or other new and evolving laws and regulations relating to privacy and information security on our business or operations, but they may require us to modify our data processing practices and policies and to incur substantial costs and expenses in an effort to comply.

Current wording

In the United States, various laws and regulations apply to the collection, disclosure, and other processing of certain types of data, including with respect to security measures used to protect such data. Additionally, the FTC and many state attorneys general are interpreting federal and state consumer protection laws as imposing standards for the collection, use, dissemination, security, and other processing of data. The laws and regulations relating to privacy and cybersecurity are evolving, can be subject to significant change, and may result in ever-increasing regulatory and public scrutiny and escalating levels of enforcement and sanctions. For example, California in 2018 enacted the California Consumer Privacy Act (CCPA), which went into effect on January 1, 2020. The CCPA requires covered companies to, among other things, provide disclosures to California consumers and afford such consumers new abilities to opt-out of certain sales of personal information. Additionally, the California Privacy Rights Act (CPRA) was approved by California voters in November 2020 and became effective January 1, 2023. The CPRA amended and expanded the CCPA in numerous respects, including by expanding the CCPA’s private right of action. Following enactment of the CCPA, many other states have adopted or considered privacy legislation, many of which are comprehensive laws similar to the CCPA and CPRA. For example, Virginia, Colorado, Utah, and Connecticut have adopted such legislation that has become effective in 2023, Texas, Montana, Oregon, and Florida have adopted such legislation that became effective in 2024, Delaware, Iowa, Maryland, Minnesota, Nebraska, New Hampshire, New Jersey, and Tennessee have adopted such legislation that will become effective in 2025, and Indiana, Kentucky, and Rhode Island have adopted such legislation that will become effective in 2026. Broad federal privacy legislation has also been proposed. Additionally, states have adopted other laws and regulations relating to privacy and cybersecurity, such as Washington’s My Health, My Data Act, which includes a private right of action. These and other new and evolving laws and regulations relating to privacy in the U.S. could increase our potential liability and adversely affect our business. Aspects of these laws and regulations and their interpretation and enforcement remain uncertain. We cannot fully predict the impact of these or other new and evolving laws and regulations relating to privacy and cybersecurity on our business or operations, but they may require us to modify our data processing practices and policies and to incur substantial costs and expenses in an effort to comply.

Previous wording

In addition, several foreign countries and governmental bodies, including the E.U., as well as the United Kingdom, Australia, Brazil, the People’s Republic of China (the PRC), India, and Japan, where we maintain offices or other operational presences, have laws and regulations dealing with the handling and processing of personal data obtained from their residents, which in certain cases are more restrictive than those in the United States. Laws and regulations in these jurisdictions apply broadly to the collection, use, storage, security, disclosure, and other processing of various types of data, including data that identifies or may be used to identify an individual. Such laws and regulations may be modified or subject to new or different interpretations, and new laws and regulations may be enacted in the future. Within the E.U., in May 2018, a far-reaching regulation governing data and privacy practices called the General Data Protection Regulation (GDPR) became effective. The GDPR includes stringent operational requirements for processors and controllers of personal data and imposes significant penalties for non-compliance of up to the greater of €20 million or 4% of global annual revenues. Complying with the GDPR, the CCPA, and other laws and regulations governing privacy, data protection, and information security may cause us to incur substantial operational costs or require us to modify our data handling practices. Actual or alleged non-compliance could result in proceedings against us by governmental entities or others (including a private right of action for affected individuals in certain instances) and substantial penalties, fines, and other liabilities, and may otherwise adversely impact our business, financial condition, and operating results.

Current wording

In addition, several foreign countries and governmental bodies, including the E.U., as well as the United Kingdom, Australia, Brazil, India, and Japan, where we maintain offices or other operational presences, have laws and regulations dealing with the handling and processing of personal data obtained from their residents, which in certain cases are more restrictive than those in the United States. Laws and regulations in these jurisdictions apply broadly to the collection, use, storage, security, disclosure, and other processing of various types of data, including data that identifies or may be used to identify an individual. Such laws and regulations may be modified or subject to new or different interpretations, and new laws and regulations may be enacted in the future. Within the E.U., in May 2018, a far-reaching regulation governing data and privacy practices called the General Data Protection Regulation (GDPR) became effective. The GDPR includes stringent operational requirements for processors and controllers of personal data and imposes significant penalties for noncompliance of up to the greater of €20 million or 4% of global annual revenues. Complying with the GDPR, the CCPA, and other laws and regulations governing privacy, data protection, and cybersecurity may cause us to incur substantial operational costs or require us to modify our data handling practices. Actual or alleged noncompliance could result in proceedings against us by governmental entities or others (including a private right of action for affected individuals in certain instances) and substantial penalties, fines, and other liabilities, and may otherwise adversely impact our business, financial condition, and operating results.

Previous wording

Commission adopted an adequacy decision with respect to the DPF in July 2023, allowing for the DPF to be implemented and available for companies to use to legitimize transfers of personal data from the E.U. to the U.S. We have self-certified to the DPF and to the Swiss-U.S. Data Privacy Framework (the Swiss DPF). Each of these frameworks may be subject to legal challenge. Additionally, the European Commission’s adequacy decision regarding the DPF provides that it will be subject to future reviews and may be subject to suspension, amendment, repeal, or limitations to its scope by the European Commission. We and many other companies may need to implement different or additional measures to establish or maintain legitimate means for the transfer and receipt of personal data from the E.U., Switzerland, and the United Kingdom to the U.S., and we may, in addition to other impacts, be required to engage in additional contractual negotiations and experience additional costs associated with increased compliance burdens, and we and our customers face the potential for regulators to apply different standards to the transfer of personal data from the E.U., Switzerland and the United Kingdom to the U.S., and to block or require additional measures taken with respect to certain data flows from the E.U., Switzerland, and the United Kingdom to the U.S. We and our customers may face a risk of enforcement actions by data protection authorities in the E.U. and other jurisdictions relating to personal data transfers. Any such enforcement actions could result in substantial costs and diversion of resources, distract management and technical personnel and negatively affect our business, operating results, and financial condition. We may be at risk of experiencing reluctance or refusal of European or multi-national customers to use our solutions and being subject to regulatory action or incurring penalties. Any of these developments may have an adverse effect on our business.

Current wording

We previously were certified under the E.U.-U.S. Privacy Shield and the Swiss-U.S. Privacy Shield with respect to our transfer of certain personal data from the E.U. and Switzerland to the United States. The E.U.-U.S. Privacy Shield framework and the use of E.U. Standard Contractual Clauses (the SCCs) to protect data exports between the E.U. and the U.S. have been subject to legal challenges in the E.U, and on July 16, 2020, the Court of Justice of the European Union (the CJEU), Europe's highest court, held in the “Schrems II” case that the E.U.-U.S. Privacy Shield was invalid, and imposed additional obligations in connection with the use of the SCCs. The Swiss data protection and information commissioner subsequently concluded that the Swiss-U.S. Privacy Shield was invalid on similar grounds. The European Commission issued new SCCs on June 4, 2021, addressing aspects of the CJEU’s opinion in the Schrems II case, which were required to be implemented. The European Commission and United States agreed in principle in March 2022 to a new EU-U.S. Data Privacy Framework (DPF), with respect to the European Commission adopted an adequacy decision in July 2023, allowing the DPF to be implemented and available for participating entities to use to legitimize transfers of personal data from the E.U. to the U.S. We have self-certified to the DPF, the Swiss-U.S. Data Privacy Framework, and the United Kingdom Extension to the DPF. The DPF has faced legal challenge, and each of these frameworks may be subject to legal challenge in the future. Additionally, the European Commission’s adequacy decision regarding the DPF provides that it will be subject to future reviews and may be subject to suspension, amendment, repeal, or limitations to its scope by the European Commission. Numerous laws and regulations in other jurisdictions also have been enacted or modified in manners imposing data transfer restrictions, and we and many other companies may need to implement different or additional measures to establish or maintain legitimate means for the transfer and receipt of personal data from the E.U., Switzerland, the United Kingdom, or other countries or regions to the U.S., and we may, in addition to other impacts, be required to engage in additional contractual negotiations and experience additional costs associated with increased compliance burdens, and we and our customers face the potential for regulators to apply different standards to the transfer of personal data from the E.U., Switzerland, the United Kingdom, or other regions to the U.S., and to block or require additional measures taken with respect to certain data flows from the E.U., Switzerland, the United Kingdom, or other regions to the U.S. We and our customers may face a risk of enforcement actions or other proceedings by regulatory authorities relating to personal data transfers. Any such proceedings could result in substantial costs and diversion of resources, distract management and technical perso…

Excerpt shortened here; the source contains the full paragraph.

Previous wording

Other jurisdictions have adopted laws and regulations addressing privacy, data protection, and information security, many of which share similarities with the GDPR. For example, Law no. 13.709/2018 of Brazil, the Lei Geral de Proteção de Dados Pessoais (LGPD) entered into effect in 2020, authorizing a private right of action for violations. Penalties include fines of up to 2% of the organization’s revenue in Brazil in the previous year or 50 million Brazilian reais. The LGPD applies to businesses (both inside and outside Brazil) that process the personal data of users who are located in Brazil. The LGPD provides users with similar rights as the GDPR regarding their data. Additionally, the Personal Information Protection Law (PIPL) of the PRC was adopted and went into effect in 2021. The PIPL shares similarities with the GDPR, including extraterritorial application, data minimization, data localization, and purpose limitation requirements, and obligations to provide certain notices and rights to PRC citizens. The PIPL allows for fines of up to 50 million renminbi or 5% of a covered company’s revenue in the prior year.

Current wording

Pessoais (LGPD) entered into effect in 2020, authorizing a private right of action for violations. Penalties include fines of up to 2% of the organization’s revenue in Brazil in the previous year or 50 million Brazilian reais. The LGPD applies to businesses (both inside and outside Brazil) that process the personal data of users who are located in Brazil. The LGPD provides users with similar rights as the GDPR regarding their data. Additionally, the Personal Information Protection Law (PIPL) of the People’s Republic of China (PRC) was adopted and went into effect in 2021. The PIPL shares similarities with the GDPR, including extraterritorial application, data minimization, data localization, and purpose limitation requirements, and obligations to provide certain notices and rights to PRC citizens. The PIPL allows for fines of up to 50 million renminbi or 5% of a covered company’s revenue in the prior year.

Previous wording

Additionally, we may be or become subject to data localization laws mandating that data collected in a foreign country be processed only within that country. These or other laws relating to privacy or data protection could require us to expand data storage facilities in foreign jurisdictions or to obtain new local data storage in such countries. The expenditures this would require, as well as costs of compliance generally, could harm our financial condition. The regulatory environment applicable to the collection, use, and other processing of personal data of residents of the E.U., United Kingdom, Switzerland, Brazil, the PRC, and other foreign jurisdictions, and our actions taken in response, may cause us to be required to undertake additional contractual negotiations, modify policies and procedures, and otherwise to assume additional liabilities or incur additional costs, and could result in our business, operating results, and financial condition being harmed.

Current wording

Additionally, we may be or become subject to data localization laws mandating that data collected in a foreign country be processed only within that country. These or other laws relating to privacy or data protection could require us to expand data storage facilities in foreign jurisdictions or to obtain new local data storage in such countries. The expenditures this would require, as well as costs of compliance generally, could harm our financial condition. The regulatory environment applicable to the collection, use, and other processing of, and security measures with respect to, personal data of residents of the E.U., United Kingdom, Switzerland, Brazil, the PRC, and other foreign jurisdictions, and our actions taken in response, may cause us to be required to undertake additional contractual negotiations, modify policies and procedures, and otherwise to assume additional liabilities or incur additional costs, and could result in our business, operating results, and financial condition being harmed.

Previous wording

We enter into business associate agreements with our customers who require them in order to comply with the Health Insurance Portability and Accountability Act (HIPAA) and the Health Information Technology for Economic and Clinical Health Act, and therefore we are directly subject to certain provisions of HIPAA applicable to business associates. We may collect and process protected health information as part of our designated service, which may subject us to a number of data protection, security, privacy, and other government- and industry-specific requirements. In addition, if we are unable to comply with our obligations relating to the protection and processing of protected health information, we could be found to have breached our contracts with customers with whom we have a business associate relationship. Noncompliance with laws and regulations relating to privacy and security of personal information, including HIPAA, or with contractual obligations, including under any business associate agreement, may lead to significant fines, civil and criminal penalties, and other liabilities. The U.S. Department of Health and Human Services (HHS) audits the compliance of business associates and enforces HIPAA privacy and security standards. HHS enforcement activity has increased in recent years and HHS has signaled its intent to continue this trend. In addition to HHS, state attorneys general are authorized to bring civil actions seeking either injunctions or damages to the extent violations implicate the privacy of state residents.

Current wording

We enter into business associate agreements with our customers who require them in order to comply with the Health Insurance Portability and Accountability Act (HIPAA) and the Health Information Technology for Economic and Clinical Health Act, and therefore we are directly subject to certain provisions of HIPAA applicable to business associates. We may collect and process protected health information as part of our designated service, which may subject us to a number of data protection, security, privacy, and other government- and industry-specific requirements. In addition, if we are unable to comply with our obligations relating to the protection and processing of protected health information, we could be found to have breached our contracts with customers with whom we have a business associate relationship. Noncompliance with laws and regulations relating to privacy and security of personal information, including HIPAA, or with contractual obligations, including under any business associate agreement, may lead to significant fines, civil and criminal penalties, and other liabilities. The U.S. Department of Health and Human Services (HHS) audits the compliance of business associates and enforces HIPAA privacy and security standards. HHS enforcement activity has increased in recent years and HHS has signaled its intent to continue this trend. Implementing rules under HIPAA addressing privacy, and a related statute addressing security, are the subject of final and proposed modifications, respectively. In addition to HHS, state attorneys general are authorized to bring civil actions seeking either injunctions or damages to the extent violations implicate the privacy of state residents.

Previous wording

Federal, state, and foreign laws, regulations, and other actual or asserted obligations relating to privacy, data protection, or information security may be interpreted and applied in manners that are, or are alleged to be, inconsistent with our practices. Any failure or perceived failure by us to comply with federal, state, or foreign laws, regulations, policies, legal or contractual obligations, industry standards, regulatory guidance or other actual or asserted obligations relating to privacy, data protection, information security, marketing, or consumer communications may result in governmental investigations and enforcement actions, claims, demands, and litigation by private entities, fines, penalties, and other liabilities, harm to our reputation and adverse publicity, and could cause our customers and partners to lose trust in us, which could materially affect our business, operating results, and financial condition. We expect that there will continue to be new laws, regulations, industry standards and other actual and asserted obligations relating to privacy, data protection, marketing, consumer communications, and information security proposed and enacted or otherwise implemented in the United States, the E.U., and other jurisdictions, and we cannot fully predict the impact such future laws, regulations, standards, and obligations may have on our business. Future laws, regulations, standards, and other actual or asserted obligations, or any changed interpretation of existing laws or regulations could impair our ability to develop and market new features and maintain and grow our customer base and increase revenue. Future restrictions on the collection, use, sharing, disclosure, or other processing of data could require us to incur additional costs or modify our platform, possibly in a material manner, which we may be unable to achieve in a commercially reasonable manner or at all, and which could limit our ability to develop new features.

Current wording

Federal, state, and foreign laws, regulations, and other actual or asserted obligations relating to privacy, data protection, or cybersecurity may be interpreted and applied in manners that are, or are alleged to be, inconsistent with our practices. Any failure or perceived failure by us to comply with federal, state, or foreign laws, regulations, policies, legal or contractual obligations, industry standards, regulatory guidance or other actual or asserted obligations relating to privacy, data protection, cybersecurity, marketing, or consumer communications may result in governmental investigations and enforcement actions, claims, demands, and litigation by private entities, fines, penalties, and other liabilities, harm to our reputation and adverse publicity, and could cause our customers and partners to lose trust in us, which could materially affect our business, operating results, and financial condition. We expect that there will continue to be new laws, regulations, industry standards and other actual and asserted obligations relating to privacy, data protection, marketing, consumer communications, and cybersecurity proposed and enacted or otherwise implemented in the United States, the E.U., and other jurisdictions, and we cannot fully predict the impact such future laws, regulations, standards, and obligations may have on our business. Future laws, regulations, standards, and other actual or asserted obligations, or any changed interpretation of existing laws or regulations could impair our ability to develop and market new features and maintain and grow our customer base and increase revenue. Future restrictions on the collection, use, sharing, disclosure, or other processing of data could require us to incur additional costs or modify our platform, possibly in a material manner, which we may be unable to achieve in a commercially reasonable manner or at all, and which could limit our ability to develop new features.

Showing the first 40 of 58 pairs. Open the source sections for the rest.

Rearranged current paragraphs (3)

Current report — wording carried from elsewhere

Our ability to meet the financial covenants could be affected by events beyond our control. Any inability to make scheduled payments or meet the financial covenants on our credit facility would adversely affect our business.

Current report — wording carried from elsewhere

The use of artificial intelligence technologies in our platform and otherwise in our business may result in new or enhanced governmental or regulatory scrutiny, new or modified laws or regulations applicable to our development and use of artificial intelligence, claims, demands, and litigation, confidentiality, privacy, data protection, or security risks, ethical concerns, or other complications that could adversely affect our business, financial condition, results of operations and prospects. Uncertainty around new and emerging artificial intelligence technologies may require additional investment in the development and maintenance of proprietary datasets and machine learning models, development of new approaches and processes to provide attribution or remuneration to creators of training data, and development of appropriate protections, safeguards, and policies for handling the processing of data with artificial intelligence technologies, which may be costly and could impact our expenses. More generally, as use of artificial intelligence becomes more prevalent, we anticipate that it will continue to present new or unanticipated ethical, reputational, technical, operational, legal, competitive, and regulatory issues, among others. We expect that our incorporation of artificial intelligence within our platform and business will require additional resources, including the incurrence of additional costs, to develop and maintain our platform offerings, services, and features in efforts to minimize potentially harmful or unintended consequences, to comply with applicable and emerging laws and regulations, to maintain or extend our competitive position, and to address any ethical, reputational, technical, operational, legal, competitive or regulatory issues that may arise as a result of any of the foregoing. As a result, the challenges presented with our use of artificial intelligence could adversely affect our business, financial condition and results of operations.

Current report — wording carried from elsewhere

Other jurisdictions have adopted laws and regulations addressing privacy, data protection, and cybersecurity, many of which share similarities with the GDPR. For example, Law no. 13.709/2018 of Brazil, the Lei Geral de Proteção de Dados
Rearranged previous paragraphs (1)

Previous report — wording carried elsewhere

We previously were certified under the E.U.-U.S. Privacy Shield and the Swiss-U.S. Privacy Shield with respect to our transfer of certain personal data from the E.U. and Switzerland to the United States. The E.U.-U.S. Privacy Shield framework and the use of E.U. Standard Contractual Clauses (the SCCs) to protect data exports between the E.U. and the U.S. have been subject to legal challenges in the E.U, and on July 16, 2020, the Court of Justice of the European Union (the CJEU), Europe's highest court, held in the “Schrems II” case that the E.U.-U.S. Privacy Shield was invalid, and imposed additional obligations in connection with the use of the SCCs. The Swiss data protection and information commissioner concluded that the Swiss-U.S. Privacy Shield was invalid on similar grounds in September 2020. The European Commission issued new SCCs on June 4, 2021, addressing aspects of the CJEU’s opinion in the Schrems II case, which were required to be implemented. The European Commission and United States agreed in principle in March 2022 to a new EU-U.S. Data Privacy Framework (DPF), which would permit transfers of personal data from the E.U. to the U.S., by participating entities. The European