C3.ai, Inc.

Previous wording

We have a history of losses, we anticipate our operating expenses will continue to increase in the future, and we may not be able to achieve or maintain profitability in the future.

Current wording

We have a history of losses, we anticipate our operating expenses will continue to increase, and we may not be able to achieve or maintain profitability in the future.

Previous wording

We incurred net losses in each period since our founding in 2009. We generated net losses of approximately $288.7 million, $279.7 million, and $268.8 million for the fiscal years ended April 30, 2025, 2024, and 2023 respectively. As a result, we had an accumulated deficit of $1.4 billion as of April 30, 2025. We expect to continue to incur net losses for the foreseeable future. These losses and accumulated deficit reflect the substantial investments we made to acquire new customers, commercialize our C3 AI Software, and continue to develop our C3 AI Software. While we have experienced revenue growth in recent periods, we do not know whether or when we will generate sufficient revenue to sustain or increase our growth or achieve or maintain profitability in the future. We also expect our costs and expenses to increase in future periods, which could negatively affect our future results of operations if our revenue does not increase. In particular, we intend to continue to expend significant funds to further develop our C3 AI Software and business, including:

Current wording

We incurred net losses in each period since our founding in 2009. We generated net losses of approximately $470.4 million, $288.7 million, and $279.7 million for the fiscal years ended April 30, 2026, 2025, and 2024 respectively. As a result, we had an accumulated deficit of $1.8 billion as of April 30, 2026. We expect to continue to incur net losses for the foreseeable future. These losses and accumulated deficit reflect the substantial investments we made to acquire new customers, commercialize our C3 AI Software, and continue to develop our C3 AI Software. We do not know whether or when we will generate sufficient revenue to achieve or maintain profitability in the future. We also expect our costs and expenses to increase in future periods, which could negatively affect our future results of operations if our revenue does not increase or declines. In particular, we intend to continue to expend significant funds to further develop our C3 AI Software and business, including:

Previous wording

•investments in sales, marketing, and services, including expanding our sales force and our customer service team, increasing our customer base, increasing market awareness of our C3 AI Software, and development of new technologies;

Current wording

•investments in sales, marketing, and services, including investments in our sales force and our customer service team, increasing our customer base, increasing market awareness of our C3 AI Software, and development of new technologies;

Previous wording

•expanding our operations and infrastructure; and

Current wording

•investments in our operations and infrastructure; and

Previous wording

We will also face increased compliance costs associated with growth, the expansion of our customer base, and being a public company. Our efforts to grow our business may be costlier than we expect, our revenue growth may be slower than we expect, and we may not be able to increase our revenue enough to offset our increased operating expenses. We may incur significant losses in the future for a number of reasons, such as the other risks described herein, unforeseen expenses, difficulties, complications or delays, and other unknown events. If we are unable to achieve and sustain profitability, the value of our business and Class A common stock may significantly decrease.

Current wording

We also face increased compliance costs associated with growth, the expansion of our customer base, and being a public company. Our efforts to grow our business may be costlier than we expect, our revenue may continue to decline or growth may be slower than we expect, and we may not be able to increase our revenue enough to offset our increased operating expenses. We may incur significant losses in the future for a number of reasons, such as the other risks described herein, unforeseen expenses, difficulties, complications or delays, and other unknown events. If we are unable to achieve and sustain profitability, the value of our business and Class A common stock may significantly decrease.

Previous wording

Further, in future periods, our revenue growth may be adversely impacted due to a number of factors, including a reduction in demand for our C3 AI Software, reduction in consumption of our C3 AI Software, increased competition, contraction of our overall market, our inability to accurately forecast demand for our C3 AI Software, or our failure, for any reason, to capitalize on growth opportunities. We have encountered and will encounter risks and uncertainties frequently experienced by growing companies in rapidly changing industries, such as the risks and uncertainties described herein. If our assumptions regarding these risks and uncertainties, which we use to plan our business, are incorrect or change, or if we do not address these risks successfully, our business will be harmed.

Current wording

Further, in future periods, our revenue may be adversely impacted due to a number of factors, including a reduction in demand for our C3 AI Software, reduction in consumption of our C3 AI Software, increased competition, contraction of our overall market, our inability to accurately forecast demand for our C3 AI Software, or our failure, for any reason, to capitalize on growth opportunities. We experienced a decline in revenue and an increase in operating losses in the fiscal year 2026 as compared to the prior fiscal year. The results were attributed, in part, to disruption from a comprehensive restructuring of our global sales and services organizations, our Chief Executive Officer (“CEO”) and Chairman’s unanticipated health limitations and unsatisfactory execution by our global sales and services organizations. We have encountered and will encounter risks and uncertainties frequently experienced by growing companies in rapidly changing industries, such as the risks and uncertainties described herein. If our assumptions regarding these risks and uncertainties, which we use to plan our business, are incorrect or change, or if we do not address these risks successfully, our business will be harmed.

Previous wording

In addition, our future success depends on our ability to sell additional subscriptions for our C3 AI Software to our existing customers, and our customers renewing their subscriptions when the contract term expires. Our customers generally have no contractual obligation to renew, upgrade, or expand their subscriptions after the terms of their existing subscriptions expire. Similarly, after completing an initial production deployment, customers do not have an obligation to continue to license our products, and we may not be able to convert initial production deployment customers into customers purchasing ongoing subscriptions or continue with a monthly consumption-based fee. In addition, our customers may opt to decrease their usage of our C3 AI Software. Given our limited experience with customer renewals of our AI products and services, we may not be able to accurately predict customer renewal rates. Our customers’ renewal and expansion commitments may decline or fluctuate as a result of a number of factors, including, but not limited to, their satisfaction with our C3 AI Software and our customer support, the frequency and severity of software and implementation errors or other reliability issues, the pricing of our subscriptions or competing solutions, changes in their IT budget, the effects of global economic conditions, and our customers’ financial circumstances, including their ability to maintain or expand their spending levels. In order for us to maintain or improve our results of operations, it is important that our customers renew or expand their subscriptions with us. If our customers do not purchase additional subscriptions, increase their usage of our software, or renew their subscriptions with us, our business, financial condition, and results of operations may be harmed.

Current wording

In addition, our future success depends on our ability to sell additional subscriptions for our C3 AI Software to our existing customers. Our customers generally have no contractual obligation to renew, upgrade, or expand their subscriptions after the terms of their existing subscriptions expire. Similarly, after completing an initial production deployment or trial customers do not have an obligation to continue to license our products, and we may not be able to convert initial production deployment customers into customers purchasing ongoing subscriptions or continue with a monthly consumption-based fee. In addition, our customers may opt to decrease their usage of our C3 AI Software. Given our limited experience with customer renewals of our AI products and services, we may not be able to accurately predict customer renewal rates. Our customers’ renewal and expansion commitments may decline or fluctuate as a result of a number of factors, including, but not limited to, their satisfaction with our C3 AI Software and our customer support, the frequency and severity of software and implementation errors or other reliability issues, the pricing of our subscriptions or competing solutions, changes in their IT budget, the effects of global economic conditions, and our customers’ financial circumstances, including their ability to maintain or expand their spending levels. In order for us to maintain or improve our results of operations, it is important that our customers renew or expand their subscriptions with us. If our customers do not purchase additional subscriptions, increase their usage of our software, or renew their subscriptions with us, our business, financial condition, and results of operations may be harmed.

Previous wording

We sell to U.S. federal, state, local, and foreign governmental agency customers, as well as to customers in highly regulated industries such as financial services, telecommunications, and healthcare. Sales to such entities are subject to a number of challenges and risks. Selling to such entities can be highly competitive, expensive, and time consuming, often requiring significant upfront time and expense without any assurance that these efforts will generate a sale. Government demand and payment for our products and services may be impacted by public sector budgetary cycles and funding reductions or delays, such as an extended federal government shutdown, which may adversely affect public sector demand for our products and services. Government contracting requirements may change and restrict our ability to sell into the government sector. Government demand and payment for our C3 AI Software is affected by public sector budgetary cycles and funding authorizations, with funding reductions or delays adversely affecting public sector demand for our C3 AI Software.

Current wording

We sell to U.S. federal, state, local, and foreign governmental agency customers, as well as to customers in highly regulated industries such as financial services, telecommunications, and healthcare. Sales to such entities are subject to a number of challenges and risks. Selling to such entities can be highly competitive, expensive, and time consuming, often requiring significant upfront time and expense without any assurance that these efforts will generate a sale. Government demand and payment for our products and services have been and may be impacted by public sector budgetary cycles and funding reductions or delays, such as an extended federal government shutdown, which have and may adversely affect public sector demand for our products and services and the timing of payment of our products and services. Government contracting requirements may change and restrict our ability to sell into the government sector. Government demand and payment for our C3 AI Software is affected by public sector budgetary cycles and funding authorizations, with funding reductions or delays adversely affecting public sector demand for our C3 AI Software.

Previous wording

Our use of artificial intelligence, or AI, and machine learning, or ML, technologies, collectively, AI/ML technologies, may also subject us to certain privacy and data security laws, as well as increasing regulation and scrutiny. There is increasing U.S. and foreign activity in the regulation of AI and other similar uses of technology. In Europe, the EU AI Act entered into force on August 1, 2024 and will become fully applicable on August 2, 2026, with some provisions already applying from February 2025. We do not engage in developing or providing AI systems or general-purpose AI models that would qualify as “prohibited AI practices”. However, if we or our customers are classified as developing or using "high-risk" AI systems, or general-purpose AI models, including general-purpose AI models with systemic risk, the EU AI Act could impose more restrictions and obligations. This could increase the costs and burdens to us and our customers, delay or halt deployment of new products and services, and may reduce the number of new customers, negatively impacting our business and financial results. Under the EU AI Act, non-compliant companies may be subject to administrative fines of up to 35 million Euros or 7% of a company’s total worldwide annual turnover for the preceding financial year, whichever is the higher. Moreover, in the United Kingdom, the government has confirmed its position that existing regulators are to implement certain specific principles (safety, security and robustness; transparency and explainability; fairness; accountability and governance; contestability and redress), within those regulators’ existing remits, to guide and inform the responsible development and use of AI / ML within their relevant sectors / competences. We expect other jurisdictions will adopt similar laws. In the United States, several states and localities have enacted measures related to the use of AI and ML in products and services. We may have to change our business practices to comply with such obligations. For example, our employees and personnel use generative AI technologies to perform their work. Our use of this technology could result in additional compliance costs, regulatory investigations and actions, and lawsuits. If we are unable to use generative AI, it could make our business less efficient and result in competitive disadvantages. We also use AI and ML technologies in our products and services. Our use of this technology could result in additional compliance costs, regulatory investigations and actions, and consumer lawsuits. Depending on how these AI laws and regulations are interpreted, we may have to make changes to our business practices and products, including our C3 AI Software, to comply with such obligations. These obligations may make it harder for us to conduct our business using AI/ML, lead to regulatory fines or penalties, require us retrain our AI/ML, or prevent or limit our use of AI/ML. Additionally, certain privacy laws extend rig…

Excerpt shortened here; the source contains the full paragraph.

Current wording

Our use of artificial intelligence, or AI, and machine learning, or ML, technologies, collectively, AI/ML technologies, may also subject us or our customers to certain privacy and data security laws, as well as increasing regulation and scrutiny. There is increasing U.S. and foreign activity in the regulation of AI and other similar uses of technology. In Europe, the EU AI Act entered into force on August 1, 2024 and will become fully applicable on August 2, 2026, with some provisions already applying from February 2025. We do not engage in developing or providing AI systems or general-purpose AI models that would qualify as “prohibited AI practices”. However, if we or our customers are classified as developing or using “high-risk” AI systems, or general-purpose AI models, including general-purpose AI models with systemic risk, the EU AI Act could impose more restrictions and obligations. This could increase the costs and burdens to us and our customers, delay or halt deployment of new products and services, and may reduce the number of new customers, negatively impacting our business and financial results. Under the EU AI Act, non-compliant companies may be subject to administrative fines of up to 35 million Euros or 7% of a company’s total worldwide annual turnover for the preceding financial year, whichever is the higher. Moreover, in the United Kingdom, the government has confirmed its position that existing regulators are to implement certain specific principles (safety, security and robustness; transparency and explainability; fairness; accountability and governance; contestability and redress), within those regulators’ existing remits, to guide and inform the responsible development and use of AI/ML within their relevant sectors/competences. We expect other jurisdictions will adopt similar laws. In the United States, several states and localities have enacted measures related to the use of AI and ML in products and services. We may have to change our business practices to comply with such obligations. For example, our employees and personnel use generative AI technologies to perform their work. Our use of this technology could result in additional compliance costs, regulatory investigations and actions, and lawsuits. If we are unable to use generative AI, it could make our business less efficient and result in competitive disadvantages.

Previous wording

Moreover, new innovative start‑up companies, and larger companies that are making significant investments in research and development, may introduce products that have greater performance or functionality, are easier to implement or use, or incorporate technological advances that we have not yet developed or implemented, or may invent similar or superior technologies that compete with ours. Our current and potential competitors may also establish cooperative relationships among themselves or with third parties that may further enhance their resources.

Current wording

Moreover, new innovative start‑up companies, and larger companies that are making significant investments in research and development, have and may continue to introduce products that have greater performance or functionality, are easier to implement or use, or incorporate technological advances that we have not yet developed or implemented, or have and may continue to invent similar or superior technologies that compete with ours. Our current and potential competitors have also established and may establish new cooperative relationships among themselves or with third parties that may further enhance their resources.

Previous wording

Our results of operations may fluctuate, in part, because of the complexity of customer problems that our C3 AI Software address, the resource‑intensive nature of our sales efforts, the length and variability of the sales cycle for our C3 AI Software, and the difficulty in making short‑term adjustments to our operating expenses. The timing of our sales is difficult to predict. The length of our sales cycle can vary substantially from customer to customer and can extend over a number of years for some customers. Our sales efforts involve educating our customers about the use, technical capabilities, and benefits of our C3 AI Software. Customers often undertake a prolonged evaluation process, which frequently involves not only our C3 AI Software but also those of other companies. In addition, the size of potential customers may lead to longer sales cycles. For instance, we invest resources into sales to large organizations and large organizations typically undertake a significant evaluation and negotiation process due to their leverage, size, organizational structure and approval requirements, all of which can lengthen our sales cycle. We may also face unexpected deployment challenges with large organizations or more complicated deployment of our C3 AI Software. Large organizations may demand additional features, support services, and pricing concessions or require additional security management or control features. Some organizations may also require an on-premise solution rather than a cloud solution, which potentially requires additional implementation time and potentially a longer sales cycle. We may spend substantial time, effort and money on sales efforts to large organizations without any assurance that our efforts will produce any sales or that these customers will deploy our C3 AI Software widely enough across their organization to justify our substantial upfront investment. As a result, it is difficult to predict exactly when, or even if, we will make a sale to a potential customer or if we can increase sales to our existing customers.

Current wording

Our results of operations may fluctuate, in part, because of the complexity of customer problems that our C3 AI Software addresses, the resource‑intensive nature of our sales efforts, the length and variability of the sales cycle for our C3 AI Software, and the difficulty in making short‑term adjustments to our operating expenses. The timing of our sales is difficult to predict. The length of our sales cycle can vary substantially from customer to customer and can extend over a number of years for some customers. Our sales efforts involve educating our customers about the use, technical capabilities, and benefits of our C3 AI Software. Customers often undertake a prolonged evaluation process, which frequently involves not only our C3 AI Software but also those of other companies. In addition, the size of potential customers may lead to longer sales cycles. For instance, we invest resources into sales to large organizations and large organizations typically undertake a significant evaluation and negotiation process due to their leverage, size, organizational structure and approval requirements, all of which can lengthen our sales cycle. We may also face unexpected deployment challenges with large organizations or more complicated deployment of our C3 AI Software. Large organizations may demand additional features, support services, and pricing concessions or require additional security management or control features. Some organizations may also require an on-premise solution rather than a cloud solution, which potentially requires additional implementation time and potentially a longer sales cycle. We may spend substantial time, effort and money on sales efforts to large organizations without any assurance that our efforts will produce any sales or that these customers will deploy our C3 AI Software widely enough across their organization to justify our substantial upfront investment. As a result, it is difficult to predict exactly when, or even if, we will make a sale to a potential customer or if we can increase sales to our existing customers.

Previous wording

We have limited experience with respect to determining the optimal prices for subscriptions for our C3 AI Software. In the past, we have been able to increase our prices for our C3 AI Software, but we may choose not to introduce or be unsuccessful in implementing future price increases or changes in our pricing models. In the second quarter of fiscal year 2023, we announced a change to our go-to-market strategy. This change includes a way for new customers to utilize our products at a smaller initial contract size and pay for services based on their monthly consumption of vCPU hours, rather than payment pursuant to a purely subscription-based payment option. Unlike customers utilizing our subscription-based option, in which revenue is recognized ratably over the term of the subscription, for customers utilizing our new consumption-based payment option, we will recognize revenue on consumption. Because such customers will have flexibility in the timing of their consumption, we do not have the same visibility into the timing of revenue recognition for such customers that we have with our subscription-based customers. There is a risk that customers using the consumption-based option will consume our platform more slowly than we expect, and our actual results may differ from our forecasts. This risk may increase as more customers move to the consumption-based model. Further, investors and securities analysts may not understand how our consumption-based option differs from our subscription-based option, or the intersection of our consumption-based option and our subscription-based option. If our results of operations fall below the expectations of investors and securities analysts who follow our stock, the price of our Class A common stock could decline substantially, and we could face costly lawsuits, including securities class actions.

Current wording

We have limited experience with respect to determining the optimal prices for subscriptions for our C3 AI Software. In the past, we have been able to increase our prices for our C3 AI Software, but we may choose not to introduce or be unsuccessful in implementing future price increases or changes in our pricing models. In the second quarter of fiscal year 2023, we announced a change to our go-to-market strategy. This change includes a way for new customers to utilize our products at a smaller initial contract size and pay for services based on their monthly consumption of vCPU hours, rather than payment pursuant to a purely subscription-based payment option. Unlike customers utilizing our subscription-based option, in which revenue is recognized ratably over the term of the subscription, for customers utilizing our new consumption-based payment option, we will recognize revenue on consumption. Because such customers will have flexibility in the timing of their consumption, we do not have the same visibility into the timing of revenue recognition for such customers that we have with our subscription-based customers. There is a risk that customers using the consumption-based option will consume our platform more slowly than we expect, and our actual results may differ from our forecasts. Further, investors and securities analysts may not understand how our consumption-based option differs from our subscription-based option, or the intersection of our consumption-based option and our subscription-based option. If our results of operations fall below the expectations of investors and securities analysts who follow our stock, the price of our Class A common stock could decline substantially, and we could face costly lawsuits, including securities class actions.

Previous wording

Our revenue growth depends in part on the success of our strategic relationships with third parties, including channel partners, and if we are unable to establish and maintain successful relationships with them, our business, operating results, and financial condition could be adversely affected.

Current wording

Our revenue depends in part on the success of our strategic relationships with third parties, including channel partners, and if we are unable to establish and maintain successful relationships with them, our business, operating results, and financial condition could be adversely affected.

Previous wording

We seek to grow our partner ecosystem as a way to grow our business. We anticipate that we will continue to establish and maintain relationships with third parties, such as channel partners, resellers, OEMs, system integrators, independent software and hardware vendors, and platform and cloud service providers. For example, in June 2019, we entered into a strategic collaboration with Baker Hughes whereby Baker Hughes operates as the exclusive channel partner and reseller of our C3 AI Software in the oil and gas industry and a non-exclusive reseller in other industries. This arrangement was most recently revised in January 2023 and again in April 30, 2025. Baker Hughes is no longer C3 AI’s exclusive reseller. We also have strategic relationships with AWS, FIS, Google Cloud, Microsoft, and Raytheon.

Current wording

We seek to grow our partner ecosystem as a way to grow our business. We anticipate that we will continue to establish and maintain relationships with third parties, such as channel partners, resellers, OEMs, system integrators, independent software and hardware vendors, and platform and cloud service providers. For example, in June 2019, we entered into a strategic collaboration with Baker Hughes whereby Baker Hughes operates as the exclusive channel partner and reseller of our C3 AI Software in the oil and gas industry and a non-exclusive reseller in other industries. This arrangement was most recently revised in January 2023 and again in April 2025. Baker Hughes is no longer C3 AI’s exclusive reseller. We also have strategic relationships with Microsoft, AWS, McKinsey & Company, Google Cloud, and Raytheon.

Previous wording

Moreover, we cannot guarantee that the partners with whom we have strategic relationships will continue to devote the resources necessary to expand our reach and increase our distribution. In addition, customer satisfaction with services and other support from our strategic partners may be less than anticipated, negatively impacting anticipated revenue growth and results of operations. We cannot be certain that these partners will prioritize or provide adequate resources to selling our C3 AI Software. Further, some of our strategic partners offer competing platforms and applications or also work with our competitors. As a result of these factors, many of the companies with whom we have strategic alliances may choose to pursue alternative technologies and develop alternative platforms and applications in addition to or in lieu of our C3 AI Software, either on their own or in collaboration with others, including our competitors. We cannot assure you that our strategic partners will continue to cooperate with us. In addition, actions taken or omitted to be taken by such parties may adversely affect us. Moreover, we rely on our channel partners to operate in accordance with the terms of their contractual agreements with us. For example, our agreements with our channel partners limit the terms and conditions pursuant to which they are authorized to resell or distribute our C3 AI Software and offer technical support and related services. If we are unsuccessful in establishing or maintaining our relationships with third parties, or if our strategic partners do not comply with their contractual obligations to us, our business, operating results, and financial condition may be adversely affected. Even if we are successful in establishing and maintaining these relationships with third parties, we cannot assure you that these relationships will result in increased customer usage of our C3 AI Software or increased revenue to us.

Current wording

Moreover, we cannot guarantee that the partners with whom we have strategic relationships will continue to devote the resources necessary to expand our reach and increase our distribution. In addition, customer satisfaction with services and other support from our strategic partners may be less than anticipated, negatively impacting anticipated revenue and results of operations. We cannot be certain that these partners will prioritize or provide adequate resources to selling our C3 AI Software. Further, some of our strategic partners offer competing platforms and applications or also work with our competitors. As a result of these factors, many of the companies with whom we have strategic alliances may choose to pursue alternative technologies and develop alternative platforms and applications in addition to or in lieu of our C3 AI Software, either on their own or in collaboration with others, including our competitors. We cannot assure you that our strategic partners will continue to cooperate with us. In addition, actions taken or omitted to be taken by such parties may adversely affect us. Moreover, we rely on our channel partners to operate in accordance with the terms of their contractual agreements with us. For example, our agreements with our channel partners limit the terms and conditions pursuant to which they are authorized to resell or distribute our C3 AI Software and offer technical support and related services. If we are unsuccessful in establishing or maintaining our relationships with third parties, or if our strategic partners do not comply with their contractual obligations to us, our business, operating results, and financial condition may be adversely affected. Even if we are successful in establishing and maintaining these relationships with third parties, we cannot assure you that these relationships will result in increased customer usage of our C3 AI Software or increased revenue to us.

Previous wording

Our success depends in a large part upon the continued service of key members of our senior management team. In particular, our founder and CEO, Thomas M. Siebel, is critical to our overall management, sales strategy, culture, strategic direction, engineering, and operations. In addition, Mr. Siebel is a recognized leader in information technology and is critical to the continued development of our C3 AI Software. On February 18, 2025, Mr. Siebel informed the Company that he had contracted an autoimmune disease and was experiencing significant vision impairment. In that communication, Mr. Siebel also stated that this health setback was not impacting his ability to manage the business in a hands-on manner, and that Jim H. Snabe, a member of our Board of Directors, had assumed the interim role of Special Advisor to the CEO to assist where and as needed. In addition, all of our executive officers are at-will employees, and we do not maintain any key person life insurance policies. The loss of any member of our senior management team could make it more difficult to execute our business strategy and, therefore, harm our business.

Current wording

Our success depends in a large part upon the continued service of key members of our senior management team. In particular, our founder and current CEO and Chairman, Thomas M. Siebel, is critical to our overall management, sales strategy, culture, strategic direction, engineering, and operations. In addition, Mr. Siebel is a recognized leader in information technology and is critical to the continued development of our C3 AI Software. All of our executive officers are at-will employees, and we do not maintain any key person life insurance policies. The loss of any member of our senior management team, whether in connection with the CEO transition, possible health setbacks or otherwise, could make it more difficult to execute our business strategy and, therefore, harm our business.

Previous wording

The failure to effectively develop and expand our marketing and sales capabilities could harm our ability to increase our customer base and achieve broader market acceptance of our C3 AI Software.

Current wording

The failure to effectively develop and invest in our marketing and sales capabilities could harm our ability to increase our customer base and achieve broader market acceptance of our C3 AI Software.

Previous wording

Our ability to expand our customer base and achieve broader market acceptance of our C3 AI Software depends to a significant extent on our ability to continue to expand our marketing and sales operations and the ultimate effectiveness of those operations. We plan to continue expanding our sales force and strategic partners, both domestically and internationally.

Current wording

Our ability to expand our customer base and achieve broader market acceptance of our C3 AI Software depends to a significant extent on our ability to continue to improve the efficiency and effectiveness of our marketing and sales operations. Our sales operations have been, and may in the future be, negatively impacted by our CEO's inability to actively participate in the sales process. We plan to continue investing in our sales force and strategic partners, both domestically and internationally.

Previous wording

We believe that developing, maintaining, and enhancing awareness and integrity of our brand and reputation in a cost-effective manner are important to achieving widespread acceptance of our C3 AI Software and are important elements in attracting new customers and maintaining existing customers. We believe that the importance of our brand and reputation will increase as competition in our market further intensifies. Successful promotion of our brand depends on the effectiveness of our marketing efforts, our ability to provide a reliable and useful C3 AI Software at competitive prices, the perceived value of our C3 AI Software, our ability to maintain our customers’ trust, our ability to continue to develop additional functionality and use cases and our ability to differentiate our C3 AI Software and capabilities from competitive offerings. Brand promotion activities may not yield increased revenue, and even if they do, the increased revenue may not offset the expenses we incur in building and maintaining our brand and reputation. We also rely on our customer base in a variety of ways, including to give us feedback on our C3 AI Software. If we fail to promote and maintain our brand successfully or to maintain loyalty among our customers, or if we incur substantial expenses in an unsuccessful attempt to promote and maintain our brand, we may fail to attract new customers and partners or retain our existing customers and partners and our business and financial condition may be adversely affected. Any negative publicity relating to our employees, partners, or others associated with these parties, may also tarnish our own reputation simply by association and may reduce the value of our brand. Damage to our brand and reputation may result in reduced demand for our C3 AI Software and increased risk of losing market share to our competitors. Any efforts to restore the value of our brand and rebuild our reputation may be costly and may not be successful.

Current wording

Brand promotion activities may not yield increased revenue, and even if they do, the resulting revenue may not offset the associated expenses. If we fail to promote and maintain our brand successfully, or incur substantial expenses in an unsuccessful attempt to do so, we may fail to attract new customers and partners or retain existing ones, which could adversely affect our business and financial condition. Negative publicity relating to our employees, partners, or others associated with us may also harm our reputation by association and reduce the value of our brand. Any such reputational damage may result in reduced demand for our C3 AI Software, increased risk of losing market share, and costly remediation efforts that may not be successful.

Previous wording

To execute our business strategy, we must attract and retain highly qualified personnel. Competition for executives, data scientists, engineers, software developers, sales personnel, and other key employees in our industry is intense. In particular, we compete with many other companies for employees with high levels of expertise in designing, developing and managing platforms and applications for data management, ML, and analytics technologies, as well as for skilled data scientists, sales, and operations professionals. In addition, we are extremely selective in our hiring process which requires significant investment of time and resources from internal stakeholders and management. At times, we have experienced, and we may continue to experience, difficulty in hiring personnel who meet the demands of our selection process and with appropriate qualifications, experience, or expertise, and we may not be able to fill positions as quickly as desired. We completed our initial public offering in December 2020 and potential candidates may not perceive our compensation package, including our equity awards, as favorably as employees hired prior to our initial public offering. In addition, our recruiting personnel, methodology, and approach may need to be altered to address a changing candidate pool and profile. We may not be able to identify or implement such changes in a timely manner.

Current wording

To execute our business strategy, we must attract and retain highly qualified personnel. Competition for executives, data scientists, engineers, software developers, sales personnel, and other key employees in our industry is intense. In particular, we compete with many other companies for employees with high levels of expertise in designing, developing and managing platforms and applications for data management, ML, and analytics technologies, as well as for skilled data scientists, sales, and operations professionals. In addition, we are extremely selective in our hiring process which requires significant investment of time and resources from internal stakeholders and management. At times, we have experienced, and we may continue to experience, difficulty in hiring personnel who meet the demands of our selection process and with appropriate qualifications, experience, or expertise, and we may not be able to fill positions as quickly as desired. In addition, our recruiting personnel, methodology, and approach may need to be altered to address a changing candidate pool and profile. We may not be able to identify or implement such changes in a timely manner.

Previous wording

Our performance metrics and certain other operational data in this report are subject to assumptions and limitations and may not provide an accurate indication of our future or expected results.

Current wording

Our performance metrics and certain operational data may not provide an accurate indication of our future or expected results.

Previous wording

Our performance metrics and other operational data may involve judgment and therefore may not reflect our actual performance, and investors should consider these metrics in light of the assumptions used in calculating such metrics and limitations as a result thereof. Our methodologies for tracking these metrics may change over time, which could result in unexpected changes to our metrics, including the metrics we report. In addition, investors should not place undue reliance on these metrics as an indicator of our future or expected results. Moreover, these metrics may differ from similarly titled metrics presented by other companies and may not be comparable to such other metrics. We regularly review and may adjust our processes for calculating our metrics to improve their accuracy. If our metrics are not accurate representations of our business; if we discover material inaccuracies in our metrics; or if the metrics we rely on to track our performance do not provide an accurate measurement of our business, our reputation may be harmed, we may be subject to legal or regulatory actions, and our operating and financial results could be adversely affected.

Current wording

Our performance metrics and other operational data may involve judgment and therefore may not accurately reflect our actual performance. Our methodologies for tracking these metrics may change over time, which could result in unexpected changes to our reported metrics, and our metrics may differ from similarly titled metrics presented by other companies and may not be comparable to such metrics. We regularly review and may adjust our processes for calculating metrics to improve their accuracy. If our metrics are not accurate representations of our business, if we discover material inaccuracies, or if the metrics we rely on do not provide an accurate measurement of our business, our reputation may be harmed, we may be subject to legal or regulatory actions, and our operating and financial results could be adversely affected.

Previous wording

Other subscription-based software companies often report on metrics such as net dollar-based revenue retention rate, annual recurring revenue or other revenue metrics, and investors and analysts sometimes look to these metrics as indicators of business activity in a period for businesses such as ours. However, due to our dependence on a small number of high-value customer contracts, these metrics are not accurate indicators of future revenue for any given period of time because the gain or loss of even a single high-value customer contract could cause significant volatility in these metrics. If investors and analysts view our business through these metrics, the trading price of our Class A common stock may be adversely affected.

Current wording

Certain metrics commonly reported by subscription-based software companies, such as net dollar-based revenue retention rate and annual recurring revenue, are particularly limited indicators of our future financial results. Due to our dependence on a relatively small number of high-value customer contracts, the gain or loss of even a single contract could cause significant volatility in these metrics, rendering them unreliable predictors of revenue for any given period. Investors and analysts should not place undue reliance on these metrics as indicators of our future or expected results, as doing so could adversely affect the trading price of our Class A common stock.

Previous wording

Global economic and business activities continue to face widespread macroeconomic uncertainties, including labor shortages and supply chain disruptions, inflation, interest rate fluctuations, bank failures, monetary supply shifts, and the imposition of tariffs or other impacts on trade relations, as well as recession risks, which may continue for an extended period and which could result in our customer prospects and our existing customers experiencing slowdowns in their businesses, which in turn may result in reduced demand for our C3 AI Software, lengthening of sales cycles, loss of customers, and difficulties in collections. Our vendors and suppliers may experience, or may continue to experience, disruptions in their supply chains, which may result in service interruptions or additional operating expenses, and may increase the price at which our vendors and suppliers are willing to sell their products to us.

Current wording

Global economic and business activities continue to face widespread macroeconomic uncertainties, including labor shortages and supply chain disruptions, inflation, interest rate fluctuations, bank failures, monetary supply shifts, government shutdowns and the imposition of tariffs or other impacts on trade relations, as well as recession risks, which may continue for an extended period and which could result in our customer prospects and our existing customers experiencing slowdowns in their businesses, which in turn may result in reduced demand for our C3 AI Software, lengthening of sales cycles, loss of customers, and difficulties in collections. To the extent our C3 AI Software is perceived by customers and potential customers as discretionary, our revenue may be disproportionately affected by delays or reductions in information technology spending. Our vendors and suppliers may experience, or may continue to experience, disruptions in their supply chains, which may result in service interruptions or additional operating expenses, and may increase the price at which our vendors and suppliers are willing to sell their products to us.

Previous wording

We collect, receive, store, process, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, and share (collectively, Process) personal data and other sensitive information, including proprietary and confidential business data, trade secrets, intellectual property, sensitive third-party data, protected health information, and financial data. Our data processing activities subject us to numerous data privacy and security obligations, such as various laws, regulations, guidance, industry standards, external and internal privacy and security policies, contractual requirements, and other obligations that govern the processing of personal data by us and on our behalf.

Current wording

We collect, receive, store, process, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, and share (collectively, Process) personal data and other sensitive information, including proprietary and confidential business data, trade secrets, intellectual property, sensitive third-party data, protected health information, financial data and information subject to government controls, such as controlled unclassified information (collectively, sensitive information). Our data processing activities subject us to numerous data privacy and security obligations, such as various laws, regulations, guidance, industry standards, external and internal privacy and security policies, contractual requirements, and other obligations that govern the processing of personal data by us and on our behalf.

Previous wording

In the United States, federal, state, and local governments have enacted numerous data privacy and security laws, including data breach notification laws, personal data privacy laws, consumer protection laws (e.g., Section 5 of the Federal Trade Commission Act), and other similar laws (e.g., wiretapping laws). For example, the federal Health Insurance Portability and Accountability Act of 1996, or HIPAA, as amended by the Health Information Technology for Economic and Clinical Health Act, or HITECH, imposes specific requirements relating to the privacy, security and transmission of individually identifiable health information. In the past few years, numerous U.S. states - including California, Virginia, Colorado, Connecticut, and Utah - have enacted comprehensive privacy laws that impose certain obligations on covered businesses, including providing specific disclosures in privacy notices and affording residents with certain rights concerning their personal data. As applicable, such rights may include the right to access, correct, or delete certain personal data, and to opt-out of certain data processing activities, such as targeted advertising, profiling, and automated decision-making. The exercise of these rights may impact our business and ability to provide our products and services. Certain states also impose strict requirements for processing certain personal data, including sensitive information, such as conducting data privacy impact assessments. These state laws allow for statutory fines for noncompliance. For example, the California Consumer Privacy Act of 2018 (CCPA), applies to personal data of consumers, business representatives and employees who are California residents, and imposes obligations on covered businesses, including, but not limited to, providing specific disclosures in privacy notices and honoring requests of such individuals to exercise certain privacy rights related to their personal data. The CCPA provides for statutory fines for noncompliance and allows private litigants affected by certain data breaches to recover significant statutory damages. Similar laws are being considered in several other states and at the federal level and local levels, and we expect more states to pass similar laws in the future, reflecting a trend toward more stringent privacy legislation in the United States. These new laws could further complicate compliance efforts and increase legal risk and compliance costs for us, the third parties with whom we work, and our customers.

Current wording

In the United States, federal, state, and local governments have enacted numerous data privacy and security laws, including data breach notification laws, personal data privacy laws, consumer protection laws (e.g., Section 5 of the Federal Trade Commission Act), and other similar laws (e.g., wiretapping laws). For example, the federal Health Insurance Portability and Accountability Act of 1996, or HIPAA, as amended by the Health Information Technology for Economic and Clinical Health Act imposes specific requirements relating to the privacy, security and transmission of individually identifiable health information. In the past few years, numerous U.S. states have enacted comprehensive privacy laws that impose certain obligations on covered businesses, including providing specific disclosures in privacy notices and affording residents with certain rights concerning their personal data. As applicable, such rights may include the right to access, correct, or delete certain personal data, and to opt-out of certain data processing activities, such as targeted advertising, profiling, and automated decision-making. The exercise of these rights may impact our business and ability to provide our products and services. Certain states also impose strict requirements for processing certain personal data, including sensitive information, such as conducting data privacy impact assessments. These state laws allow for statutory fines for noncompliance. For example, the California Consumer Privacy Act of 2018 (CCPA) applies to personal data of consumers, business representatives and employees who are California residents, and imposes obligations on covered businesses, including, but not limited to, providing specific disclosures in privacy notices and honoring requests of such individuals to exercise certain privacy rights related to their personal data. The CCPA provides for statutory fines for noncompliance and allows private litigants affected by certain data breaches to recover significant statutory damages. Numerous similar laws have been considered or enacted in several other states and at the federal level and local levels, and we expect more states to pass similar laws in the future. Further, the U.S. government is contemplating federal privacy legislation, and certain local jurisdictions have enacted privacy legislation. Collectively, these reflect a trend toward more stringent privacy legislation in the United States. Evolving privacy legislation in the United States could further complicate compliance efforts and increase legal risk and compliance costs for us, the third parties with whom we work, and our customers.

Previous wording

Outside the United States, an increasing number of laws, regulations, and industry standards apply to data privacy and security. In Canada, the Personal Information Protection and Electronic Documents Act, or PIPEDA, and various related provincial laws, as well as Canada’s Anti-Spam Legislation, or CASL, may apply to our operations. We also target customers in Asia and have operations in Japan and Singapore and may be subject to new and emerging data privacy regimes in Asia, including Japan’s Act on the Protection of Personal Information and Singapore’s Personal Data Protection Act. In the European Economic Area, or EEA, we are subject to the European General Data Protection Regulation, or GDPR, and in the United Kingdom, or UK, we are subject to the UK data protection regime, or UK GDPR (EU GDPR and UK GDPR, collectively GDPR). Companies that must comply with the GDPR face increased compliance obligations and risk, including more robust regulatory enforcement of data protection requirements, with violations potentially resulting in an order prohibiting the processing of personal data and/or fines of up to the greater of €20 million or 4% of the annual global revenues of the noncompliant company in the European Union, and up to the greater of GBP 17.5 million or 4% of the annual global revenues in the UK; or private litigation related to processing of personal data brought by classes of data subjects or consumer protection organizations authorized at law to represent their interests.

Current wording

Outside the United States, an increasing number of laws, regulations, and industry standards apply to data privacy and security. In Canada, the Personal Information Protection and Electronic Documents Act and various related provincial laws, as well as Canada’s Anti-Spam Legislation, may apply to our operations. We also target customers in Asia and have operations in Japan and Singapore and may be subject to new and emerging data privacy regimes in Asia, including Japan’s Act on the Protection of Personal Information and Singapore’s Personal Data Protection Act. In the European Economic Area, or EEA, we are subject to the European General Data Protection Regulation, or GDPR, and in the United Kingdom, or UK, we are subject to the UK data protection regime, or UK GDPR (EU GDPR and UK GDPR, collectively GDPR). Companies that must comply with the GDPR face increased compliance obligations and risk, including more robust regulatory enforcement of data protection requirements, with violations potentially resulting in an order prohibiting the processing of personal data and/or fines of up to the greater of €20 million or 4% of the annual global revenues of the noncompliant company in the European Union, and up to the greater of GBP 17.5 million or 4% of the annual global revenues in the UK; or private litigation related to processing of personal data brought by classes of data subjects or consumer protection organizations authorized at law to represent their interests.

Previous wording

In the ordinary course of business, we may transfer personal data from Europe and other jurisdictions to the United States or other countries. European and other data protection laws, including the GDPR also restrict the ability of companies to transfer personal data to the United States and other countries. Although there are currently various mechanisms that may be used to transfer personal data from the EEA and the UK to the United States in compliance with law, such as the EEA’s standard contractual clauses, the UK’s International Data Transfer Agreement/Addendum, and the Transatlantic Privacy Framework (which allows for transfers to relevant U.S.-based organizations who self-certify compliance and participate in the Framework), these mechanisms are subject to legal challenges, and there is no assurance that we can satisfy or rely on these measures to lawfully transfer personal data to the United States. It is unclear how data transfers from countries such as the EEA and UK to the United States will be regulated in the long term, which measures must be put in place for onward transfers, and whether or not the Transatlantic Data Privacy Framework will provide a long-term solution to managing flows of personal data from the EEA and the UK to the United States.

Current wording

In the ordinary course of business, we may transfer personal data from Europe and other jurisdictions to the United States or other countries. European and other data protection laws, including the GDPR, restrict the ability of companies to transfer personal data to the United States and other countries. Although there are currently various mechanisms that may be used to transfer personal data from the EEA and the UK to the United States in compliance with law, such as the EEA’s standard contractual clauses, the UK’s International Data Transfer Agreement/Addendum, and the EU-U.S. Data Privacy Framework (and UK Extension), these mechanisms are subject to legal challenges, and there is no assurance that we can satisfy or rely on these measures to lawfully transfer personal data to the United States. It is unclear how data transfers from countries such as the EEA and UK to the United States will be regulated in the long term, which measures must be put in place for onward transfers, and whether or not the Data Privacy Framework or related programs will provide a long-term solution to managing flows of personal data from the EEA and the UK to the United States.

Previous wording

As such, we, or our vendors, may be unable to implement measures sufficient to lawfully transfer personal data in a manner necessary to provide our services in certain regions without incurring significant cost, or at all. If we cannot implement a valid compliance mechanism for cross-border data transfers, we may face significant adverse consequences, including the interruption or degradation of our operations, increased exposure to regulatory actions, substantial fines and penalties, and injunctions against processing or transferring personal data from Europe or other foreign jurisdictions. The inability to import personal data to the United States could significantly and negatively impact our business operations, including by limiting our ability to collaborate with parties that are subject to such cross-border data transfer or localization laws; or requiring us to increase our personal data processing capabilities and infrastructure in foreign jurisdictions at significant expense. Additionally, companies that transfer personal data outside of the EEA and UK to other jurisdictions, particularly the United States, are subject to increased scrutiny from regulators, individual litigants and activist groups. Some European regulators have significantly restricted some companies’ data processing activities, including ordering certain companies to suspend or permanently cease the transfer of certain personal data out of Europe for allegedly violating the GDPR’s cross-border data transfer limitations, which has materially impacted companies’ operations revenues. For example, in May 2023, the Irish Data Protection Commission determined that a major social media company’s use of the standard contractual clauses to transfer personal data from Europe to the United States was insufficient and levied a 1.2 billion Euro fine against the company and prohibited the company from transferring personal data to the United States. Additionally, the U.S. Department of Justice issued a rule entitled the Preventing Access to U.S. Sensitive Personal Data and Government-Related Data by Countries of Concern or Covered Persons, which places additional restriction on certain data transactions involving countries of concern (e.g., China, Russia, Iran) and covered individuals (i.e., individuals and entities located in or controlled by individuals or entities located in those jurisdictions) that may impact certain business activities such as vendor engagements, sale or sharing of data, employment of certain individuals, and investor agreements. Violations of the rule could lead to significant civil and criminal fines and penalties.

Current wording

As such, we, or our vendors, may be unable to implement measures sufficient to lawfully transfer personal data in a manner necessary to provide our services in certain regions without incurring significant cost, or at all. If we cannot implement a valid compliance mechanism for cross-border data transfers, we may face significant adverse consequences, including the interruption or degradation of our operations, increased exposure to regulatory actions, substantial fines and penalties, and injunctions against processing or transferring personal data from Europe or other foreign jurisdictions. The inability to import personal data to the United States could significantly and negatively impact our business operations, including by limiting our ability to collaborate with parties that are subject to such cross-border data transfer or localization laws; or requiring us to increase our personal data processing capabilities and infrastructure in foreign jurisdictions at significant expense. Additionally, companies that transfer personal data outside of the EEA and UK to other jurisdictions, particularly the United States, are subject to increased scrutiny from regulators, individual litigants and activist groups. Some European regulators have significantly restricted some companies’ data processing activities, including ordering certain companies to suspend or permanently cease the transfer of certain personal data out of Europe for allegedly violating the GDPR’s cross-border data transfer limitations, which has materially impacted companies’ operations revenues.

Previous wording

Other data protection laws in the EEA and the UK, such as those implementing the ePrivacy Directive, restrict the use of cookies and similar technologies on which our website and product rely. Regulators are increasingly focused on compliance with requirements in the online tracking ecosystem, and current national laws implementing the ePrivacy Directive are likely to be replaced in the EU by a regulation known as the ePrivacy Regulation, which will significantly increase fines for non-compliance. Other countries outside of Europe increasingly emulate European data protection laws. As a result, operating our business or offering our services in Europe or other countries with similar data protection laws would subject us to substantial compliance costs and potential liability and may require changes to the ways we collect and use personal data. We may also become subject to new laws that regulate non-personal data. For example, the European Union’s Data Act imposes certain data and cloud service interoperability and switching obligations to enable users to switch between cloud service providers without undue delay or cost, as well as certain requirements concerning cross-border international transfers of, and governmental access to, non-personal data outside the EEA. Depending on how this Act and any similar laws are implemented and interpreted, we may have to adapt our business practices, contractual arrangements, and C3 AI Software to comply with such obligations.

Current wording

Other data protection laws in the EEA and the UK, such as those implementing the ePrivacy Directive, restrict the use of cookies and similar technologies on which our website and product rely. Regulators are increasingly focused on compliance with requirements in the online tracking ecosystem. Other countries outside of Europe increasingly emulate European data protection laws. As a result, operating our business or offering our services in Europe or other countries with similar data protection laws would subject us to substantial compliance costs and potential liability and may require changes to the ways we collect and use personal data. We may also become subject to new laws that regulate non-personal data. For example, the European Union’s Data Act imposes certain data and cloud service interoperability and switching obligations to enable users to switch between cloud service providers without undue delay or cost, as well as certain requirements concerning cross-border international transfers of, and governmental access to, non-personal data outside the EEA. Moreover, the European Union’s Network and Information Security Directive (“NIS2”) regulates resilience and incident response capabilities of entities operating in a number of sectors. Non-compliance with NIS2 may lead to administrative fines of a maximum of 10 million Euros or up to 2% of the total worldwide revenue of the preceding fiscal year. Depending on how this Act and any similar laws are implemented and interpreted, we may have to adapt our business practices, contractual arrangements, and C3 AI Software to comply with such obligations.

Previous wording

We may also be subject to new laws governing the privacy of consumer health data, including reproductive, sexual orientation, and gender identity privacy rights. For example, Washington’s My Health My Data Act (MHMD) broadly defines consumer health data, places restrictions on processing consumer health data (including imposing stringent requirements for consents), provides consumers certain rights with respect to their health data, and creates a private right of action to allow individuals to sue for violations of the law. Other states are considering and may adopt similar laws.

Current wording

We may also be subject to new laws governing the privacy of consumer health data. For example, Washington’s My Health My Data Act broadly defines consumer health data, places restrictions on processing consumer health data (including imposing stringent requirements for consents), provides consumers certain rights with respect to their health data, and creates a private right of action to allow individuals to sue for violations of the law. Other states are considering and may have adopted similar laws.

Previous wording

Obligations related to data privacy and security (and consumers’ data privacy expectations) are quickly changing in an increasingly stringent fashion, creating some uncertainty as to the effective future legal framework. Additionally, these obligations may be subject to differing applications and interpretations, which may be inconsistent or conflict among jurisdictions. Preparing for and complying with these obligations requires significant resources, which may necessitate changes to our information technologies, systems, and practices, including our C3 AI Software, possibly limiting our ability to develop new applications and features, and to those of any third parties with whom we work. Although we endeavor to comply with all applicable data privacy and security obligations, we may at times fail (or be perceived to have failed) to do so. Moreover, despite our efforts, our personnel or that of the third parties with whom we work may fail to comply with such obligations, which could negatively impact our business operations and compliance posture. For example, any failure by a third-party processor to comply with applicable law, regulations, or contractual obligations could result in adverse effects, including inability to or interruption in our ability to operate our business and proceedings against us by governmental entities or others. If we fail, or are perceived to have failed, to address or comply with data privacy and security obligations, we could face significant consequences. These consequences may include, but are not limited to, government enforcement actions (e.g., investigations, fines, penalties, audits, inspections, and similar); litigation (including class action claims) and mass arbitration demands; additional reporting requirements and/or oversight; bans or restrictions on processing personal data; orders to destroy or not use personal data; and imprisonment of company officials. In particular, plaintiffs have become increasingly more active in bringing privacy-related claims against companies, including class claims and mass arbitration demands. Some of these claims allow for the recovery of statutory damages on a per violation basis, and, if viable, carry the potential for monumental statutory damages, depending on the volume of data and the number of violations. Any of these events could have a material adverse effect on our reputation, business, or financial condition, including but not limited to: loss of customers; interruptions or stoppages in our business operations; interruptions or stoppages of data collection needed to train our algorithms; inability to process personal data or to operate in certain jurisdictions; limited ability to develop or commercialize our product; expenditure of time and resources to defend any claim or inquiry; adverse publicity; revision or restructuring of our operations; or reduced demand for our C3 AI Software. Governments and regulators in certain jurisdictions, including Europe, are inc…

Excerpt shortened here; the source contains the full paragraph.

Current wording

Obligations related to data privacy and security (and consumers’ data privacy expectations) are changing in an increasingly stringent fashion, creating some uncertainty as to effective legal frameworks. Additionally, these obligations may be subject to differing applications and interpretations, which may be inconsistent or conflict among jurisdictions. Preparing for and complying with these obligations requires significant resources, which may necessitate changes to our information technologies, systems, and practices, including our C3 AI Software, possibly limiting our ability to develop new applications and features, and to those of any third parties with whom we work. Although we endeavor to comply with all applicable data privacy and security obligations, we may at times fail (or be perceived to have failed) to do so. Moreover, despite our efforts, our personnel or those of the third parties with whom we work may fail to comply with such obligations, which could negatively impact our business operations and compliance posture. If we fail, or are perceived to have failed, to address or comply with data privacy and security obligations, we could face significant consequences. These consequences may include, but are not limited to, government enforcement actions (e.g., investigations, fines, penalties, audits, inspections, and similar); litigation (including class action claims) and mass arbitration demands; additional reporting requirements and/or oversight; bans or restrictions on processing personal data; orders to destroy or not use personal data; and imprisonment of company officials. In particular, plaintiffs have become increasingly active in bringing privacy-related claims against companies, including class claims and mass arbitration demands. Some of these claims allow for the recovery of statutory damages on a per violation basis, and, if viable, carry the potential for monumental statutory damages, depending on the volume of data and the number of violations. Any of these events could have a material adverse effect on our reputation, business, or financial condition, including but not limited to: loss of customers; interruptions or stoppages in our business operations; interruptions or stoppages of data collection needed to train our algorithms; inability to process personal data or to operate in certain jurisdictions; limited ability to develop or commercialize our product; expenditure of time and resources to defend any claim or inquiry; adverse publicity; revision or restructuring of our operations; or reduced demand for our C3 AI Software. Governments and regulators in certain jurisdictions, including Europe, are increasingly seeking to regulate cybersecurity and the use, transfer, and other processing of non-personal information (for example, under the European Union’s Data Act), an area which has typically been the subject of very limited or no specific regulation. This means that, if and to the extent such regulations are rele…

Excerpt shortened here; the source contains the full paragraph.

Previous wording

Our C3 AI Software processes our customers’ proprietary and sensitive data, potentially including personal information, confidential information, protected health information, financial data, intellectual property, and trade secrets. Our C3 AI Software is built to be available on the infrastructure of third-party public cloud providers such as AWS, Microsoft Azure, and Google Cloud. We also use third parties to help us deliver services to our customers. These third parties may process personal information, protected health information, or other confidential information of our employees, partners or customers in a variety of contexts, including, without limitation, third-party providers of cloud-based infrastructure, encryption and authentication technology, employee email and payroll, content delivery to customers, and other functions. We collect such information from individuals located both in the United States and abroad and may process such information outside the country in which it was collected. Our ability to monitor these third parties’ information security practices is limited, and these third parties may not have adequate information security measures in place. We may share or receive sensitive information with or from third parties.

Current wording

Our C3 AI Software processes our customers’ proprietary and sensitive information. Our C3 AI Software is built to be available on the infrastructure of third-party public cloud providers such as AWS, Microsoft Azure, and Google Cloud. We also use third parties to help us deliver services to our customers. These third parties may process personal information, protected health information, or other confidential information of our employees, partners or customers in a variety of contexts, including, without limitation, third-party providers of cloud-based infrastructure, encryption and authentication technology, employee email and payroll, content delivery to customers, and other functions. We collect such information from individuals located both in the United States and abroad and may process such information outside the country in which it was collected. Our ability to monitor these third parties’ information security practices is limited, and these third parties may not have adequate information security measures in place. We may share or receive sensitive information with or from third parties.

Previous wording

Cyber-attacks, denial-of-service attacks, ransomware attacks, business email compromises, computer malware, viruses, social engineering (including phishing), online and offline fraud and other malicious internet-based activity are prevalent in our industry and our customers’ industries and such attacks continue to increase. Some actors now engage and are expected to continue to engage in cyber-attacks, including without limitation nation-state actors for geopolitical reasons and in conjunction with military conflicts and defense activities. During times of war and other major conflicts, we and the third parties with whom we work may be vulnerable to a heightened risk of these attacks, including retaliatory and other cyber-attacks, that could materially disrupt our systems and operations, supply chain, and ability to produce, sell and distribute our goods and services. We also utilize third-party providers to host, transmit, or otherwise process electronic data in connection with our business activities. We or our vendors and business partners may experience social-engineering attacks (including through deep fakes, which may be increasingly more difficult to identify as fake, and phishing attacks), malicious code (such as viruses and worms), malware (including as a result of advanced persistent threat intrusions), denial-of-service attacks, credential stuffing, credential harvesting, unavailable systems, unauthorized access or disclosure due to employee or other theft or misuse, denial-of-service attacks, sophisticated attacks by nation-state and nation-state supported actors, ransomware attacks, supply-chain attacks, software bugs, server malfunctions, software or hardware failures, loss of data or other information technology assets, adware, telecommunications failures, attacks enhanced or facilitated by AI, and other similar threats. Ransomware attacks, including by organized criminal threat actors, nation-states, nation-state-supported actors, and “hacktivists,” are becoming increasingly prevalent and severe and can lead to significant interruptions in our operations, ability to provide our products or services, loss of data and income, reputational harm, and diversion of funds. Extortion payments may alleviate the negative impact of a ransomware attack, but we may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting such payments. Similarly, supply-chain attacks have increased in frequency and severity, and we cannot guarantee that third parties and infrastructure in our supply chain or our third-party partners’ supply chains have not been compromised or that they do not contain exploitable defects or bugs that could result in a breach of or disruption to our information technology systems (including our product) or the third-party information technology systems that support us and our services. Remote work has also become more common and has increased risks to our information technology…

Excerpt shortened here; the source contains the full paragraph.

Current wording

Cyber-attacks, denial-of-service attacks, ransomware attacks, business email compromises, computer malware, viruses, social engineering (including phishing), online and offline fraud and other malicious internet-based activity are prevalent in our industry and our customers’ industries and such attacks continue to increase. Some actors now engage and are expected to continue to engage in cyber-attacks, including without limitation nation-state actors for geopolitical reasons and in conjunction with military conflicts and defense activities. During times of war and other major conflicts, we and the third parties with whom we work may be vulnerable to a heightened risk of these attacks, including retaliatory and other cyber-attacks, that could materially disrupt our systems and operations, supply chain, and ability to produce, sell and distribute our goods and services. We also utilize third-party providers to host, transmit, or otherwise process electronic data in connection with our business activities. We or our vendors and business partners may experience social-engineering attacks (including through deep fakes, which may be increasingly more difficult to identify as fake, and phishing attacks), malicious code (such as viruses and worms), malware (including as a result of advanced persistent threat intrusions), denial-of-service attacks, credential stuffing, credential harvesting, unavailable systems, unauthorized access or disclosure due to employee or other theft or misuse, denial-of-service attacks, sophisticated attacks by nation-state and nation-state supported actors, ransomware attacks, supply-chain attacks, software bugs, server malfunctions, software or hardware failures, loss of data or other information technology assets, adware, telecommunications failures, attacks enhanced or facilitated by AI (including through the discovery or exploitation of vulnerabilities facilitated by AI), and other similar threats. Ransomware attacks, including by organized criminal threat actors, nation-states, nation-state-supported actors, and “hacktivists,” are becoming increasingly prevalent and severe and can lead to significant interruptions in our operations, ability to provide our products or services, loss of data and income, reputational harm, and diversion of funds. Extortion payments may alleviate the negative impact of a ransomware attack, but we may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting such payments. Similarly, supply-chain attacks have increased in frequency and severity, and we cannot guarantee that third parties and infrastructure in our supply chain or our third-party partners’ supply chains have not been compromised or that they do not contain exploitable defects or bugs that could result in a breach of, incident impacting, or disruption to our information technology systems (including our product) or the third-party information technology systems that support us and…

Excerpt shortened here; the source contains the full paragraph.

Previous wording

Any of the previously identified or similar threats could cause a security incident or other interruption that could result in unauthorized, unlawful, or accidental acquisition, modification, destruction, loss, alteration, encryption, disclosure of, or access to our sensitive information, or our technology systems, or those of the third parties with whom we work. A security incident or other interruption could disrupt our ability (and that of third parties with whom we work) to provide our platform. Any actual or potential security breach of our C3 AI Software, our operational systems, our physical facilities, or the systems or facilities of our partners, or the perception that one has occurred, could result in material adverse consequences, such as litigation, indemnity obligations, regulatory enforcement actions, investigations, fines, penalties, mitigation and remediation costs, disputes, reputational harm, diversion of management’s attention, and other liabilities and damage to our business. Even though we do not control the security measures of third parties, we may be perceived or asserted to be responsible for any breach of such measures or suffer reputational harm even where we do not have recourse to the third party that caused the breach. In addition, any failure by our partners to comply with applicable law or regulations could result in proceedings against us by governmental entities or others, with further financial, operational, and reputational damage. While we may be entitled to damages if the third parties with whom we work fail to satisfy their privacy or security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such award. In addition to experiencing a security incident, third parties may gather, collect, or infer sensitive information about us from public sources, data brokers, or other means that reveals competitively sensitive details about our organization and could be used to undermine our competitive advantage or market position.

Current wording

Any of the previously identified or similar threats could cause or lead to a security incident or other interruption that could result in unauthorized, unlawful, or accidental acquisition, modification, destruction, loss, alteration, encryption, disclosure of, or access to our sensitive information, or our technology systems, or those of the third parties with whom we work. A security incident or other interruption could disrupt our ability (and that of third parties with whom we work) to provide our platform. Any actual or potential security breach of, or incident impacting, our C3 AI Software, our operational systems, our physical facilities, or the systems or facilities of our partners, or the perception that one has occurred, could result in material adverse consequences, such as litigation, indemnity obligations, regulatory enforcement actions, investigations, fines, penalties, mitigation and remediation costs, disputes, reputational harm, diversion of management’s attention, and other liabilities and damage to our business. Even though we do not control the security measures of third parties, we may be perceived or asserted to be responsible for any security breach or incident or suffer reputational harm even where we do not have recourse to the third party that caused the breach or incident. In addition, any failure by our partners to comply with applicable law or regulations could result in proceedings against us by governmental entities or others, with further financial, operational, and reputational damage. While we may be entitled to damages if the third parties with whom we work fail to satisfy their privacy or security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such award. In addition to experiencing a security incident, third parties may gather, collect, or infer sensitive information about us from public sources, data brokers, or other means that reveals competitively sensitive details about our organization and could be used to undermine our competitive advantage or market position.

Previous wording

The costs to respond to a security breach and/or to mitigate any security vulnerabilities that may be identified could be significant, our efforts to address these problems may not be successful, and these problems could result in unexpected interruptions, delays, cessation of service, negative publicity, and other harm to our business and our competitive position. We could be required to fundamentally change our business activities and practices in response to a security breach or related regulatory actions or litigation, which could have an adverse effect on our business. In addition, laws, regulations, government guidance, and industry standards and practices in the United States and elsewhere are rapidly evolving to combat these threats. We may face increased compliance burdens regarding such requirements from regulators and customers regarding our products and services and also incur additional costs for oversight and monitoring of security risks relating to our own supply chain. For example, we have contractual and legal obligations, or we may voluntarily choose, to notify relevant stakeholders, including affected individuals, customers, regulators, and investors, of security breaches. Most jurisdictions have enacted laws requiring companies to notify individuals, regulatory authorities, and others of security breaches involving certain types of data, and implement other requirements, such as providing credit monitoring and identifying theft protection services. Such disclosures and related actions can be costly, and the disclosures or the failure to comply with such applicable requirements could lead to material adverse consequences. In addition, our agreements with certain customers and partners may require us to notify them in the event of a security breach involving customer or partner data on our systems or those of subcontractors processing customer or partner data on our behalf. Such mandatory disclosures are costly, could lead to negative publicity, may cause our customers to lose confidence in the effectiveness of our security measures, and require us to expend significant capital and other resources to respond to or alleviate problems caused by the actual or perceived security breach and may cause us to breach customer contracts. Our agreements with certain customers require us to use industry-standard, reasonable, or other specified measures to safeguard sensitive personal information or confidential information, and any actual or perceived breach of such measures may increase the likelihood and frequency of customer audits under our agreements, which is likely to increase the costs of doing business. An actual or perceived security breach could lead to claims by our customers, or other relevant stakeholders that we have failed to comply with such legal or contractual obligations. As a result, we could be subject to legal action or our customers could end their relationships with us. There can be no assurance that any limitations…

Excerpt shortened here; the source contains the full paragraph.

Current wording

The costs to respond to a security breach or incident and/or to mitigate any security vulnerabilities that may be identified could be significant, our efforts to address these problems may not be successful, and these problems could result in unexpected interruptions, delays, cessation of service, negative publicity, and other harm to our business and our competitive position. We could be required to fundamentally change our business activities and practices in response to a security breach or incident or related regulatory actions or litigation, which could have an adverse effect on our business. In addition, laws, regulations, government guidance, and industry standards and practices in the United States and elsewhere are rapidly evolving to combat these threats. We may face increased compliance burdens regarding such requirements from regulators and customers regarding our products and services and also incur additional costs for oversight and monitoring of security risks relating to our own supply chain. For example, we have contractual and legal obligations, or we may voluntarily choose, to notify relevant stakeholders, including affected individuals, customers, regulators, and investors, of security breaches or incidents. Most jurisdictions have enacted laws requiring companies to notify individuals, regulatory authorities, and others of security breaches involving certain types of data, and implement other requirements, such as providing credit monitoring and identifying theft protection services. Such disclosures and related actions can be costly, and the disclosures or any actual or alleged failure to comply with such applicable requirements could lead to material adverse consequences. In addition, our agreements with certain customers and partners may require us to notify them in the event of a security breach or incident involving customer or partner data on our systems or those of subcontractors processing customer or partner data on our behalf. The foregoing types of disclosures are costly, could lead to negative publicity, may cause our customers to lose confidence in the effectiveness of our security measures, and require us to expend significant capital and other resources to respond to or alleviate problems caused by the actual or perceived security breach or incident and may cause us to breach customer contracts. Our agreements with certain customers require us to use industry-standard, reasonable, or other specified measures to safeguard sensitive personal information or confidential information, and any actual or perceived breach by us of our obligations to maintain such measures may increase the likelihood and frequency of customer audits under our agreements, which is likely to increase the costs of doing business. An actual or perceived security breach or incident could lead to claims by our customers, or other relevant stakeholders that we have failed to comply with such legal or contractual obligations. As a result, we co…

Excerpt shortened here; the source contains the full paragraph.

Previous wording

While we and a number of our vendors and business partners have implemented security measures designed to protect against security incidents, there can be no assurance that these measures will be effective. We take steps designed to detect and remediate vulnerabilities in our information security systems (such as our hardware and/ or software, including that of third parties with whom we work), and ensure the security, privacy, integrity, confidentiality, availability, and authenticity of our information technology networks and systems, processing and information, but we may not be able to anticipate or to implement effective preventive and remedial measures against all data security and privacy threats or detect, mitigate and remediate all vulnerabilities on a timely basis. We cannot guarantee that the recovery systems, security protocols, network protection mechanisms and other security measures that we have integrated into our systems, networks and physical facilities, which are designed to protect against, detect and minimize security breaches and vulnerabilities, or those of our vendors and business partners, will be adequate to prevent or detect service interruption, system failure data loss or theft, or other material adverse consequences. Actions taken by us or the third parties with whom we work to detect, investigate, mitigate, contain, and remediate a security incident could result in outages, data losses, and disruptions of our business. Threat actors may also gain access to other networks and systems after a compromise of our networks and systems. No security solution, strategy, or measures can address all possible security threats or block all methods of penetrating a network or otherwise perpetrating a security incident. The risk of unauthorized circumvention of our security measures or those of the third parties with whom we work, has been heightened by advances in computer and software capabilities and the increasing sophistication of hackers who employ complex techniques, including without limitation, the theft or misuse of personal and financial information, counterfeiting, “phishing” or social engineering incidents, ransomware, extortion, publicly announcing security breaches, account takeover attacks, denial or degradation of service attacks, malware, fraudulent payment and identity theft. The techniques used to sabotage, disrupt or to obtain unauthorized access to our C3 AI Software, systems, networks, or physical facilities in which data is stored or through which data is transmitted change frequently, and we may be unable to implement adequate preventative measures or stop security breaches while they are occurring. Unremediated high risk or critical vulnerabilities pose material risks to our business. It may also be costly to detect, investigate, mitigate, contain, and remediate a security incident. Further, we may experience delays in developing and deploying remedial measures designed to address any such identified vuln…

Excerpt shortened here; the source contains the full paragraph.

Current wording

The techniques used to sabotage, disrupt or to obtain unauthorized access to our C3 AI Software, systems, networks, or physical facilities in which data is stored or through which data is transmitted change frequently. While we and a number of our vendors and business partners have implemented security measures designed to protect against security incidents, there can be no assurance that these measures will be effective. We take steps designed to detect and remediate vulnerabilities in our information security systems (such as our hardware and/ or software, including that of third parties with whom we work), and ensure the security, privacy, integrity, confidentiality, availability, and authenticity of our information technology networks and systems, processing and information, but we may not be able to anticipate or to implement effective preventive and remedial measures against all security and privacy threats or detect, mitigate and remediate all vulnerabilities on a timely basis. We cannot guarantee that the recovery systems, security protocols, network protection mechanisms and other security measures that we have integrated into our systems, networks and physical facilities, which are designed to protect against, detect and minimize security breaches and vulnerabilities, or those of our vendors and business partners, will be adequate to prevent or detect service interruption, unavailability or theft, or other material adverse consequences. Actions taken by us or the third parties with whom we work to detect, investigate, mitigate, contain, and remediate a security incident could result in outages, data losses, and disruptions of our business. Threat actors may also gain access to other networks and systems after a compromise of our networks and systems. No security solution, strategy, or measures can address all possible security threats or block all methods of penetrating a network or otherwise perpetrating a security breach or incident. The risk of unauthorized circumvention of our security measures or those of the third parties with whom we work, has been heightened by advances in computer and software capabilities and the increasing sophistication of hackers who employ complex techniques, including without limitation, the theft or misuse of personal and financial information, counterfeiting, “phishing” or social engineering incidents, ransomware, extortion, publicly announcing security breaches, account takeover attacks, denial or degradation of service attacks, malware, fraudulent payment and identity theft. The techniques used to sabotage, disrupt or to obtain unauthorized access to our C3 AI Software, systems, networks, or physical facilities in which data is stored or through which data is transmitted change frequently, and we may be unable to implement adequate preventative measures or stop security breaches while they are occurring. Unremediated high risk or critical vulnerabilities pose material risks to our business. It may als…

Excerpt shortened here; the source contains the full paragraph.

Previous wording

If we (or a third party with whom we work) experience a security incident or are perceived to have experienced a security incident, we may experience material adverse consequences such as government enforcement actions (for example, investigations, fines, penalties, audits, and inspections); additional reporting requirements and/or oversight; restrictions on processing sensitive information (including personal data); litigation (including class claims); indemnification obligations; negative publicity; reputational harm; monetary fund diversions; diversion of management attention; interruptions in our operations (including availability of data); financial loss; and other similar harms. Litigation resulting from security breaches may adversely affect our business. Unauthorized access to our C3 AI Software, systems, networks, or physical facilities could result in litigation with our customers or other relevant stakeholders. These proceedings could force us to spend money in defense or settlement, divert management’s time and attention, increase our costs of doing business, or adversely affect our reputation. We could be required to fundamentally change our business activities and practices or modify our C3 AI Software capabilities in response to such litigation, which could have an adverse effect on our business. If a security breach were to occur, and the confidentiality, integrity or availability of our data or the data of our partners or our customers was disrupted, we could incur significant liability, or our C3 AI Software, systems, or networks may be perceived as less desirable, which could negatively affect our business and damage our reputation.

Current wording

If we (or a third party with whom we work) experience a security incident or are perceived to have experienced a security incident, we may experience material adverse consequences such as government enforcement actions (for example, investigations, fines, penalties, audits, and inspections); additional reporting requirements and/or oversight; restrictions on processing sensitive information (including personal data); litigation (including class claims); indemnification obligations; negative publicity; reputational harm; monetary fund diversions; diversion of management attention; interruptions in our operations (including availability of data); financial loss; and other similar harms. Litigation resulting from security breaches or incidents may adversely affect our business. Unauthorized access to our C3 AI Software, systems, networks, or physical facilities could result in litigation with our customers or other relevant stakeholders. These proceedings could force us to spend money in defense or settlement, divert management’s time and attention, increase our costs of doing business, or adversely affect our reputation. We could be required to fundamentally change our business activities and practices or modify our C3 AI Software capabilities in response to such litigation, which could have an adverse effect on our business. If a security breach or incident were to occur, and the confidentiality, integrity or availability of our data or the data of our partners or our customers was disrupted or perceived to have been disrupted, we could incur significant liability, or our C3 AI Software, systems, or networks may be perceived as less desirable, which could negatively affect our business and damage our reputation.

Previous wording

We may not have adequate insurance coverage for security incidents or breaches, including fines, judgments, settlements, penalties, costs, attorney fees and other impacts that arise out of incidents or breaches. Depending on the facts and circumstances of such an incident, the damages, penalties and costs could be significant and may not be covered by insurance or could exceed our applicable insurance coverage limits. If the impacts of a security incident or breach, or the successful assertion of one or more large claims against us that exceeds our available insurance coverage, or results in changes to our insurance policies (including premium increases or the imposition of large deductible or co-insurance requirements), it could have an adverse effect on our business. In addition, we cannot be sure that our existing insurance coverage and coverage for errors and omissions will continue to be available on acceptable terms or that our insurers will not deny coverage as to all or part of any future claim or loss. Our risks are likely to increase as we continue to expand our C3 AI Software, grow our customer base, and store, transmit, and otherwise process increasingly large amounts of proprietary and sensitive data.

Current wording

We may not have adequate insurance coverage for security breaches or incidents, including fines, judgments, settlements, penalties, costs, attorney fees and other impacts that arise out of incidents or breaches. The damages, penalties and costs could be significant and may not be covered by insurance or could exceed our applicable insurance coverage limits. The successful assertion of one or more large claims against us that exceeds our available insurance coverage, or results in changes to our insurance policies (including premium increases or the imposition of large deductible or co-insurance requirements), it could have an adverse effect on our business. In addition, we cannot be sure that our insurance coverage and coverage for errors and omissions will continue to be available on acceptable terms or that our insurers will not deny coverage as to all or part of any future claim or loss. Our risks are likely to increase as we continue to expand our C3 AI Software, grow our customer base, and store, transmit, and otherwise process increasingly large amounts of proprietary and sensitive data.

Previous wording

In addition to experiencing a security incident, we may experience negative consequences from our use of AI/ML within our company and in our products and services. Our or our customers’ sensitive information could be leaked, disclosed, or revealed as a result of or in connection with our employees’, personnel’s, or vendors’ use of generative AI technologies. Any sensitive information (including confidential, competitive, proprietary, or personal data) that we input into a third-party generative AI/ML platform could be leaked or disclosed to others, including if sensitive information is used to train the third parties’ AI/ML model. Additionally, where an AI/ML model ingests personal data and makes connections using such data, those technologies may reveal other personal or sensitive information generated by the model. Moreover, AI/ML models may create flawed, incomplete, or inaccurate outputs, some of which may appear correct. This may happen if the inputs that the model relied on were inaccurate, incomplete or flawed (including if a bad actor “poisons” the AI/ML with bad inputs or logic), or if the logic of the AI/ML is flawed (a so-called “hallucination”). We may use AI/ML outputs to make certain decisions. Due to these potential inaccuracies or flaws, the model could be biased and could lead us to make decisions that could bias certain individuals (or classes of individuals), and adversely impact their rights, employment, and ability to obtain certain pricing, products, services, or benefits, including exposure to reputational and competitive harm, customer loss, and legal liability.

Current wording

In addition to experiencing a security incident, we may experience negative consequences from our use of AI/ML within our company and in our products and services. Our or our customers’ sensitive information could be leaked, disclosed, or revealed as a result of or in connection with our employees’, personnel’s, or vendors’ use of generative AI technologies. Any sensitive information (including confidential, competitive, proprietary, or personal data) that we input into a third-party generative AI/ML platform could be leaked or disclosed to others, including if sensitive information is used to train the third parties’ AI/ML model. Additionally, where an AI/ML model ingests personal data and makes connections using such data, those technologies may reveal other personal or sensitive information generated by the model. Moreover, AI/ML models may create flawed, incomplete, or inaccurate outputs, some of which may appear correct. This may happen if the inputs that the model relied on were inaccurate, incomplete or flawed (including if a bad actor “poisons” the AI/ML with bad inputs or logic), or if the logic of the AI/ML is flawed (a so-called “hallucination”). We may use AI/ML outputs to make certain decisions. Due to these potential inaccuracies or flaws, the model could be biased and could lead us to make decisions that could bias certain individuals (or classes of individuals), and adversely impact their rights, employment, and ability to obtain certain pricing, products, services, or benefits, and expose us to reputational and competitive harm, customer loss, and legal liability.