C3.ai, Inc.

Previous wording

We have a history of losses, we anticipate our operating expenses will continue to increase in the future, and we may not be able to achieve or maintain profitability in the future.

Current wording

We have a history of losses, we anticipate our operating expenses will increase in the future, and we may not be able to achieve or maintain profitability in the future.

Previous wording

We incurred net losses in each period since our founding in 2009. We generated net losses of approximately $133.4 million and $80.2 million for the three months ended January 31, 2026 and 2025, respectively, $354.8 million and $209.0 million for the nine months ended January 31, 2026 and 2025, respectively. As a result, we had an accumulated deficit of $1.7 billion as of January 31, 2026. We expect to continue to incur net losses for the foreseeable future. These losses and accumulated deficit reflect the substantial investments we made to acquire new customers, commercialize our C3 AI Software, and continue to develop our C3 AI Software. We do not know whether or when we will generate sufficient revenue to achieve or maintain profitability in the future. We also expect our costs and expenses to increase in future periods, which could negatively affect our future results of operations if our revenue does not increase or declines. In particular, we intend to continue to expend significant funds to further develop our C3 AI Software and business, including:

Current wording

We incurred net losses in each period since our founding in 2009. We generated net losses of approximately $92.8 million and $116.8 million for the three months ended July 31, 2026 and 2025, respectively. As a result, we had an accumulated deficit of $1.9 billion as of July 31, 2026. We expect to continue to incur net losses for the foreseeable future. These losses and accumulated deficit reflect the substantial investments we made to acquire new customers, commercialize our C3 AI Software, and continue to develop our C3 AI Software. We do not know whether or when we will generate sufficient revenue to achieve or maintain profitability in the future. We also expect our costs and expenses to increase in future periods, which could negatively affect our future results of operations if our revenue does not increase or declines. In particular, we intend to continue to expend significant funds to further develop our C3 AI Software and business, including:

Previous wording

We will also face increased compliance costs associated with growth, the expansion of our customer base, and being a public company. Our efforts to grow our business may be costlier than we expect, our revenue may continue to decline or growth may be slower than we expect, and we may not be able to increase our revenue enough to offset our increased operating expenses. We may incur significant losses in the future for a number of reasons, such as the other risks described herein, unforeseen expenses, difficulties, complications or delays, and other unknown events. If we are unable to achieve and sustain profitability, the value of our business and Class A common stock may significantly decrease.

Current wording

We also face increased compliance costs associated with growth, the expansion of our customer base, and being a public company. Our efforts to grow our business may be costlier than we expect, our revenue may continue to decline or growth may be slower than we expect, and we may not be able to increase our revenue enough to offset our increased operating expenses. We may incur significant losses in the future for a number of reasons, such as the other risks described herein, unforeseen expenses, difficulties, complications or delays, and other unknown events. If we are unable to achieve and sustain profitability, the value of our business and Class A common stock may significantly decrease.

Previous wording

Further, in future periods, our revenue may be adversely impacted due to a number of factors, including a reduction in demand for our C3 AI Software, reduction in consumption of our C3 AI Software, increased competition, contraction of our overall market, our inability to accurately forecast demand for our C3 AI Software, or our failure, for any reason, to capitalize on growth opportunities. We experienced a decline in revenue and an increase in operating losses in the first three quarters for the fiscal year 2026 as compared to one year prior. The results were attributed, in part, to disruption from a comprehensive restructuring of our global sales and services organizations, our Executive Chairman’s unanticipated health limitations and unsatisfactory execution by our global sales and services organizations. Our results of operations may be negatively impacted by our Executive Chairman’s inability to engage in some key business initiatives of the Company. We have encountered and will encounter risks and uncertainties frequently experienced by growing companies in rapidly changing industries, such as the risks and uncertainties described herein. If our assumptions regarding these risks and uncertainties, which we use to plan our business, are incorrect or change, or if we do not address these risks successfully, our business will be harmed.

Current wording

Further, in future periods, our revenue may be adversely impacted due to a number of factors, including a reduction in demand for our C3 AI Software, reduction in consumption of our C3 AI Software, increased competition, contraction of our overall market, our inability to accurately forecast demand for our C3 AI Software, or our failure, for any reason, to capitalize on growth opportunities. We experienced a decline in revenue and an increase in operating losses in the fiscal year 2026 as compared to the prior fiscal year. The results were attributed, in part, to disruption from a comprehensive restructuring of our global sales and services organizations, our Chief Executive Officer (“CEO”) and Chairman’s unanticipated health limitations and unsatisfactory execution by our global sales and services organizations. We have encountered and will encounter risks and uncertainties frequently experienced by growing companies in rapidly changing industries, such as the risks and uncertainties described herein. If our assumptions regarding these risks and uncertainties, which we use to plan our business, are incorrect or change, or if we do not address these risks successfully, our business will be harmed.

Previous wording

In addition, our future success depends on our ability to sell additional subscriptions for our C3 AI Software to our existing customers, and our customers renewing their subscriptions when the contract term expires. Our customers generally have no contractual obligation to renew, upgrade, or expand their subscriptions after the terms of their existing subscriptions expire. Similarly, after completing an initial production deployment, customers do not have an obligation to continue to license our products, and we may not be able to convert initial production deployment or trial customers into customers purchasing ongoing subscriptions or continue with a monthly consumption-based fee. In addition, our customers may opt to decrease their usage of our C3 AI Software. Given our limited experience with customer renewals of our AI products and services, we may not be able to accurately predict customer renewal rates. Our customers’ renewal and expansion commitments may decline or fluctuate as a result of a number of factors, including, but not limited to, their satisfaction with our C3 AI Software and our customer support, the frequency and severity of software and implementation errors or other reliability issues, the pricing of our subscriptions or competing solutions, changes in their IT budget, the effects of global economic conditions, and our customers’ financial circumstances, including their ability to maintain or expand their spending levels. In order for us to maintain or improve our results of operations, it is important that our customers renew or expand their subscriptions with us. If our customers do not purchase additional subscriptions, increase their usage of our software, or renew their subscriptions with us, our business, financial condition, and results of operations may be harmed.

Current wording

In addition, our future success depends on our ability to sell additional subscriptions for our C3 AI Software to our existing customers. Our customers generally have no contractual obligation to renew, upgrade, or expand their subscriptions after the terms of their existing subscriptions expire. Similarly, after completing a short proof of value or an initial production deployment, customers do not have an obligation to continue to license our products, and we may not be able to convert short proof of value or initial production deployment customers into customers purchasing ongoing subscriptions or continue with a monthly consumption-based fee. In addition, our customers may opt to decrease their usage of our C3 AI Software. Given our limited experience with customer renewals of our AI products and services, we may not be able to accurately predict customer renewal rates. Our customers’ renewal and expansion commitments may decline or fluctuate as a result of a number of factors, including, but not limited to, their satisfaction with our C3 AI Software and our customer support, the frequency and severity of software and implementation errors or other reliability issues, the pricing of our subscriptions or competing solutions, changes in their IT budget, the effects of global economic conditions, and our customers’ financial circumstances, including their ability to maintain or expand their spending levels. In order for us to maintain or improve our results of operations, it is important that our customers renew or expand their subscriptions with us. If our customers do not purchase additional subscriptions, increase their usage of our software, or renew their subscriptions with us, our business, financial condition, and results of operations may be harmed.

Previous wording

We sell to U.S. federal, state, local, and foreign governmental agency customers, as well as to customers in highly regulated industries such as financial services, telecommunications, and healthcare. Sales to such entities are subject to a number of challenges and risks. Selling to such entities can be highly competitive, expensive, and time consuming, often requiring significant upfront time and expense without any assurance that these efforts will generate a sale. Government demand and payment for our products and services have been and may be impacted by public sector budgetary cycles and funding reductions or delays, such as an extended federal government shutdown, which have and may adversely affect public sector demand for our products and services and the timing of payment for our products and services. Government contracting requirements may change and restrict our ability to sell into the government sector. Government demand and payment for our C3 AI Software is affected by public sector budgetary cycles and funding authorizations, with funding reductions or delays adversely affecting public sector demand for our C3 AI Software.

Current wording

We sell to U.S. federal, state, local, and foreign governmental agency customers, as well as to customers in highly regulated industries such as financial services, telecommunications, and healthcare. Sales to such entities are subject to a number of challenges and risks. Selling to such entities can be highly competitive, expensive, and time consuming, often requiring significant upfront time and expense without any assurance that these efforts will generate a sale. Government demand and payment for our products and services have been and may be impacted by public sector budgetary cycles and funding reductions or delays, such as an extended federal government shutdown, which have and may adversely affect public sector demand for our products and services and the timing of payment of our products and services. Government contracting requirements may change and restrict our ability to sell into the government sector. Government demand and payment for our C3 AI Software is affected by public sector budgetary cycles and funding authorizations, with funding reductions or delays adversely affecting public sector demand for our C3 AI Software.

Previous wording

Our use of artificial intelligence, or AI, and machine learning, or ML, technologies, collectively, AI/ML technologies, may also subject us or our customers to certain privacy and data security laws, as well as increasing regulation and scrutiny. There is increasing U.S. and foreign activity in the regulation of AI and other similar uses of technology. In Europe, the EU AI Act entered into force on August 1, 2024 and will become fully applicable on August 2, 2026, with some provisions already applying from February 2025. We do not engage in developing or providing AI systems or general-purpose AI models that would qualify as “prohibited AI practices”. However, if we or our customers are classified as developing or using "high-risk" AI systems, or general-purpose AI models, including general-purpose AI models with systemic risk, the EU AI Act could impose more restrictions and obligations. This could increase the costs and burdens to us and our customers, delay or halt deployment of new products and services, and may reduce the number of new customers, negatively impacting our business and financial results. Under the EU AI Act, non-compliant companies may be subject to administrative fines of up to 35 million Euros or 7% of a company’s total worldwide annual turnover for the preceding financial year, whichever is the higher. Moreover, in the United Kingdom, the government has confirmed its position that existing regulators are to implement certain specific principles (safety, security and robustness; transparency and explainability; fairness; accountability and governance; contestability and redress), within those regulators’ existing remits, to guide and inform the responsible development and use of AI/ML within their relevant sectors/competences. We expect other jurisdictions will adopt similar laws. In the United States, several states and localities have enacted measures related to the use of AI and ML in products and services. We may have to change our business practices to comply with such obligations. For example, our employees and personnel use generative AI technologies to perform their work. Our use of this technology could result in additional compliance costs, regulatory investigations and actions, and lawsuits. If we are unable to use generative AI, it could make our business less efficient and result in competitive disadvantages.

Current wording

Our use of artificial intelligence, or AI, and machine learning, or ML, technologies, collectively, AI/ML technologies, may also subject us or our customers to certain privacy and data security laws, as well as increasing regulation and scrutiny. There is increasing U.S. and foreign activity in the regulation of AI and other similar uses of technology. In Europe, the EU AI Act entered into force on August 1, 2024 and became fully applicable on August 2, 2026, with some provisions already applying from February 2025. We do not engage in developing or providing AI systems or general-purpose AI models that would qualify as “prohibited AI practices.” However, if we or our customers are classified as developing or using “high-risk” AI systems, or general-purpose AI models, including general-purpose AI models with systemic risk, the EU AI Act could impose more restrictions and obligations. This could increase the costs and burdens to us and our customers, delay or halt deployment of new products and services, and may reduce the number of new customers, negatively impacting our business and financial results. Under the EU AI Act, non-compliant companies may be subject to administrative fines of up to 35 million Euros or 7% of a company’s total worldwide annual turnover for the preceding financial year, whichever is the higher, and dependent on the type of violation. Moreover, in the United Kingdom, the government has confirmed its position that existing regulators are to implement certain specific principles (safety, security and robustness; transparency and explainability; fairness; accountability and governance; contestability and redress), within those regulators’ existing remits, to guide and inform the responsible development and use of AI/ML within their relevant sectors/competences. We expect other jurisdictions will adopt similar laws. In the United States, several states and localities have enacted measures related to the use of AI and ML in products and services. We may have to change our business practices to comply with such obligations. For example, our employees and personnel use generative AI technologies to perform their work. Our use of this technology could result in additional compliance costs, regulatory investigations and actions, and lawsuits. If we are unable to use generative AI, it could make our business less efficient and result in competitive disadvantages.

Previous wording

Furthermore, there is increasing regulation and scrutiny over the outputs of AI/ML tools and their potential impacts on end-users. In particular, California Senate Bill 243 requires operators of companion chatbots to take certain measures to bolster transparency and user safety, including ensuring end-users know that the companion chatbot is artificially generated and not human and maintaining a protocol for preventing the production of suicidal ideation, suicide, or self-harm content to the user. Even to the extent such laws may not be directly applicable to us, they may be applicable to our customers, and we may in turn face contractual obligations that require us to take measures to ensure our AI/ML tools are capable of complying with requirements under the laws. Thes obligations could increase the cost of research and development in AI/ML, make it harder for us to conduct our business using AI/ML, or require us retrain our AI/ML.

Current wording

Furthermore, there is increasing regulation and scrutiny over the outputs of AI/ML tools and their potential impacts on end-users. In particular, California Senate Bill 243 requires operators of companion chatbots to take certain measures to bolster transparency and user safety, including ensuring end-users know that the companion chatbot is artificially generated and not human and maintaining a protocol for preventing the production of suicidal ideation, suicide, or self-harm content to the user. Even to the extent such laws may not be directly applicable to us, they may be applicable to our customers, and we may in turn face contractual obligations that require us to take measures to ensure our AI/ML tools are capable of complying with requirements under the laws. These obligations could increase the cost of research and development in AI/ML, make it harder for us to conduct our business using AI/ML, or require us retrain our AI/ML.

Previous wording

Moreover, new innovative start‑up companies, and larger companies that are making significant investments in research and development, may introduce products that have greater performance or functionality, are easier to implement or use, or incorporate technological advances that we have not yet developed or implemented, or may invent similar or superior technologies that compete with ours. Our current and potential competitors may also establish cooperative relationships among themselves or with third parties that may further enhance their resources.

Current wording

Moreover, new innovative start‑up companies, and larger companies that are making significant investments in research and development, have and may continue to introduce products that have greater performance or functionality, are easier to implement or use, or incorporate technological advances that we have not yet developed or implemented, or have and may continue to invent similar or superior technologies that compete with ours. Our current and potential competitors have also established and may establish new cooperative relationships among themselves or with third parties that may further enhance their resources.

Previous wording

Our results of operations may fluctuate, in part, because of the complexity of customer problems that our C3 AI Software address, the resource‑intensive nature of our sales efforts, the length and variability of the sales cycle for our C3 AI Software, and the difficulty in making short‑term adjustments to our operating expenses. The timing of our sales is difficult to predict. The length of our sales cycle can vary substantially from customer to customer and can extend over a number of years for some customers. Our sales efforts involve educating our customers about the use, technical capabilities, and benefits of our C3 AI Software. Customers often undertake a prolonged evaluation process, which frequently involves not only our C3 AI Software but also those of other companies. In addition, the size of potential customers may lead to longer sales cycles. For instance, we invest resources into sales to large organizations and large organizations typically undertake a significant evaluation and negotiation process due to their leverage, size, organizational structure and approval requirements, all of which can lengthen our sales cycle. We may also face unexpected deployment challenges with large organizations or more complicated deployment of our C3 AI Software. Large organizations may demand additional features, support services, and pricing concessions or require additional security management or control features. Some organizations may also require an on-premise solution rather than a cloud solution, which potentially requires additional implementation time and potentially a longer sales cycle. We may spend substantial time, effort and money on sales efforts to large organizations without any assurance that our efforts will produce any sales or that these customers will deploy our C3 AI Software widely enough across their organization to justify our substantial upfront investment. As a result, it is difficult to predict exactly when, or even if, we will make a sale to a potential customer or if we can increase sales to our existing customers.

Current wording

Our results of operations may fluctuate, in part, because of the complexity of customer problems that our C3 AI Software addresses, the resource‑intensive nature of our sales efforts, the length and variability of the sales cycle for our C3 AI Software, and the difficulty in making short‑term adjustments to our operating expenses. The timing of our sales is difficult to predict. The length of our sales cycle can vary substantially from customer to customer and can extend over a number of years for some customers. Our sales efforts involve educating our customers about the use, technical capabilities, and benefits of our C3 AI Software. Customers often undertake a prolonged evaluation process, which frequently involves not only our C3 AI Software but also those of other companies. In addition, the size of potential customers may lead to longer sales cycles. For instance, we invest resources into sales to large organizations and large organizations typically undertake a significant evaluation and negotiation process due to their leverage, size, organizational structure and approval requirements, all of which can lengthen our sales cycle. We may also face unexpected deployment challenges with large organizations or more complicated deployment of our C3 AI Software. Large organizations may demand additional features, support services, and pricing concessions or require additional security management or control features. Some organizations may also require an on-premise solution rather than a cloud solution, which potentially requires additional implementation time and potentially a longer sales cycle. We may spend substantial time, effort and money on sales efforts to large organizations without any assurance that our efforts will produce any sales or that these customers will deploy our C3 AI Software widely enough across their organization to justify our substantial upfront investment. As a result, it is difficult to predict exactly when, or even if, we will make a sale to a potential customer or if we can increase sales to our existing customers.

Previous wording

We have limited experience with respect to determining the optimal prices for subscriptions for our C3 AI Software. In the past, we have been able to increase our prices for our C3 AI Software, but we may choose not to introduce or be unsuccessful in implementing future price increases or changes in our pricing models. In the second quarter of fiscal year 2023, we announced a change to our go-to-market strategy. This change includes a way for new customers to utilize our products at a smaller initial contract size and pay for services based on their monthly consumption of vCPU hours, rather than payment pursuant to a purely subscription-based payment option. Unlike customers utilizing our subscription-based option, in which revenue is recognized ratably over the term of the subscription, for customers utilizing our new consumption-based payment option, we will recognize revenue on consumption. Because such customers will have flexibility in the timing of their consumption, we do not have the same visibility into the timing of revenue recognition for such customers that we have with our subscription-based customers. There is a risk that customers using the consumption-based option will consume our platform more slowly than we expect, and our actual results may differ from our forecasts. This risk may increase as more customers move to the consumption-based model. Further, investors and securities analysts may not understand how our consumption-based option differs from our subscription-based option, or the intersection of our consumption-based option and our subscription-based option. If our results of operations fall below the expectations of investors and securities analysts who follow our stock, the price of our Class A common stock could decline substantially, and we could face costly lawsuits, including securities class actions.

Current wording

We have limited experience with respect to determining the optimal prices for subscriptions for our C3 AI Software. In the past, we have been able to increase our prices for our C3 AI Software, but we may choose not to introduce or be unsuccessful in implementing future price increases or changes in our pricing models. In the second quarter of fiscal year 2023, we announced a change to our go-to-market strategy. This change includes a way for new customers to utilize our products at a smaller initial contract size and pay for services based on their monthly consumption of vCPU hours, rather than payment pursuant to a purely subscription-based payment option. Unlike customers utilizing our subscription-based option, in which revenue is recognized ratably over the term of the subscription, for customers utilizing our consumption-based payment option, we recognize revenue on consumption. Because such customers have flexibility in the timing of their consumption, we do not have the same visibility into the timing of revenue recognition for such customers that we have with our subscription-based customers. There is a risk that customers using the consumption-based option will consume our platform more slowly than we expect, and our actual results may differ from our forecasts. Further, investors and securities analysts may not understand how our consumption-based option differs from our subscription-based option, or the intersection of our consumption-based option and our subscription-based option. If our results of operations fall below the expectations of investors and securities analysts who follow our stock, the price of our Class A common stock could decline substantially, and we could face costly lawsuits, including securities class actions.

Previous wording

We seek to grow our partner ecosystem as a way to grow our business. We anticipate that we will continue to establish and maintain relationships with third parties, such as channel partners, resellers, OEMs, system integrators, independent software and hardware vendors, and platform and cloud service providers. For example, in June 2019, we entered into a strategic collaboration with Baker Hughes whereby Baker Hughes operates as the exclusive channel partner and reseller of our C3 AI Software in the oil and gas industry and a non-exclusive reseller in other industries. This arrangement was most recently revised in January 2023 and again in April 30, 2025. We also have strategic relationships with Microsoft, AWS, McKinsey & Company, Google Cloud, and Raytheon.

Current wording

We seek to grow our partner ecosystem as a way to grow our business. We anticipate that we will continue to establish and maintain relationships with third parties, such as channel partners, resellers, OEMs, system integrators, independent software and hardware vendors, and platform and cloud service providers. For example, in June 2019, we entered into a strategic collaboration with Baker Hughes whereby Baker Hughes operated as the exclusive channel partner and reseller of our C3 AI Software in the oil and gas industry and a non-exclusive reseller in other industries. This arrangement was revised in April 2025. Baker Hughes is no longer C3 AI’s exclusive reseller. We also have strategic relationships with Microsoft, AWS, McKinsey & Company, Google Cloud, and Raytheon.

Previous wording

The transition of our CEO and our ability to retain key members of our senior management may impact the successful execution of our business strategy.

Current wording

Our ability to retain key members of our senior management may impact the successful execution of our business strategy.

Previous wording

Our success depends in a large part upon the continued service of key members of our senior management team. In particular, our founder and Executive Chairman, Thomas M. Siebel, is critical to our overall management, sales strategy, culture, strategic direction, engineering, and operations. In addition, Mr. Siebel is a recognized leader in information technology and is critical to the continued development of our C3 AI Software. On September 3, 2025, we announced that our board of directors appointed Stephen Ehikian to succeed Mr. Siebel as CEO. Mr. Ehikian is a recognized innovator in the enterprise software industry and most recently served as Acting Administrator of the U.S. General Services Administration, or GSA. Mr. Siebel plans to continue in the role of Executive Chairman. Changes in our organization as a result of the CEO transition may have disruptive impact on our ability to implement our strategy. Until we integrate our new CEO, and unless he is able to succeed in his position, we may be unable to successfully manage and grow our business. In addition, all of our executive officers are at-will employees, and we do not maintain any key person life insurance policies. The loss of any member of our senior management team, whether in connection with the CEO transition or otherwise, could make it more difficult to execute our business strategy and, therefore, harm our business.

Current wording

Our success depends in a large part upon the continued service of key members of our senior management team. In particular, our founder and current CEO and Chairman, Thomas M. Siebel, is critical to our overall management, sales strategy, culture, strategic direction, engineering, and operations. In addition, Mr. Siebel is a recognized leader in information technology and is critical to the continued development of our C3 AI Software. All of our executive officers are at-will employees, and we do not maintain any key person life insurance policies. The loss of any member of our senior management team, whether in connection with possible health setbacks or otherwise, could make it more difficult to execute our business strategy and, therefore, harm our business.

Previous wording

On February 24, 2026, we announced a restructuring plan (the “Plan”), intended to fundamentally improve our operating efficiency and reposition our company for long term success. In connection with the Plan, we have restructured our sales organization, realigned proved personnel directly under our Chief Executive Officer to increase accountability and execution, and reengineered our product design and delivery framework to increase development speed and enhance our competitive positioning. These measures are intended to address our short and long-term objectives and are based on our current estimates, assumptions, and forecasts, which are subject to known and unknown risks and uncertainties. Implementation of these and any other initiatives may not achieve our expected benefits, may be disruptive to our business, the expected costs and charges may be greater than we have forecasted, and the estimated cost savings may be lower than we have forecasted. In addition, the Plan could result in personnel attrition beyond our planned reduction in headcount or could reduce employee morale, which could in turn adversely impact productivity, including through a loss of continuity, loss of accumulated knowledge and/or inefficiency during transitional periods, could affect our ability to attract highly skilled employees, or may otherwise adversely affect our business.

Current wording

On February 24, 2026, the Company’s board of directors approved a restructuring plan (the “Plan”), intended to fundamentally improve our operating efficiency and reposition our company for long term success. In connection with the Plan, we have restructured our sales organization, realigned proved personnel directly under our Chief Executive Officer to increase accountability and execution, and reengineered our product design and delivery framework to increase development speed and enhance our competitive positioning. These measures are intended to address our short and long-term objectives and are based on our current estimates, assumptions, and forecasts, which are subject to known and unknown risks and uncertainties. Implementation of these and any other initiatives may not achieve our expected benefits, may be disruptive to our business, the expected costs and charges may be greater than we have forecasted, and the estimated cost savings may be lower than we have forecasted. In addition, the Plan could result in personnel attrition beyond our planned reduction in headcount or could reduce employee morale, which could in turn adversely impact productivity, including through a loss of continuity, loss of accumulated knowledge and/or inefficiency during transitional periods, could affect our ability to attract highly skilled employees, or may otherwise adversely affect our business.

Previous wording

Our ability to expand our customer base and achieve broader market acceptance of our C3 AI Software depends to a significant extent on our ability to continue to improve efficiencies in our marketing and sales operations and the effectiveness of those operations has been in the past and may in the future be negatively impacted by our Executive Chairman’s inability to actively participate in the sales process. Moreover, the effectiveness of our marketing and sales operations may be negatively impacted by the transition of the CEO role from Mr. Siebel to Mr. Ehikian. We plan to continue invest in our sales force and strategic partners, both domestically and internationally.

Current wording

Our ability to expand our customer base and achieve broader market acceptance of our C3 AI Software depends to a significant extent on our ability to continue to improve the efficiency and effectiveness of our marketing and sales operations. Our sales operations have been, and may in the future be, negatively impacted by our CEO's inability to actively participate in the sales process. We plan to continue investing in our sales force and strategic partners, both domestically and internationally.

Previous wording

Identifying and recruiting qualified sales representatives and training them is time consuming and resource intensive, and they may not be fully trained and productive for a significant amount of time. Our C3 AI Software is complicated and, as such, our sales force and operations require significant time and investment for proper recruitment, onboarding, and training in order for our sales operations to be productive. In addition, as we enter into new markets, expand the capabilities of our C3 AI Software and offer new C3 AI Software, we may need to identify and recruit additional sales and marketing efforts specific to such strategic expansion. Our efforts to do so may be increasingly resource intensive, time consuming, and ultimately unsuccessful. We also dedicate significant resources to sales and marketing programs, including internet and other online advertising. As more customers take advantage of our consumption-based pricing options, once a new customer begins using our C3 AI Software, our sales team will need to continue to focus on expanding consumption with that customer. All of these efforts require us to invest significant financial and other resources. In addition, the cost to acquire customers is high due to these marketing and sales efforts. Our business will be harmed if our efforts do not generate a correspondingly significant increase in revenue. We will not achieve anticipated revenue if we are unable to hire, develop, and retain talented sales personnel, if our new sales personnel are unable to achieve desired productivity levels in a reasonable period of time, or if our sales and marketing programs are not effective.

Current wording

Our business will be harmed if our marketing and sales efforts do not generate a correspondingly significant increase in revenue. If we are unable to hire, develop, and retain talented sales personnel, or if our sales and marketing programs are not effective, our revenue may grow more slowly than expected or materially decline.

Previous wording

We believe that developing, maintaining, and enhancing awareness and integrity of our brand and reputation in a cost-effective manner are important to achieving widespread acceptance of our C3 AI Software and are important elements in attracting new customers and maintaining existing customers. We believe that the importance of our brand and reputation will increase as competition in our market further intensifies. Successful promotion of our brand depends on the effectiveness of our marketing efforts, our ability to provide a reliable and useful C3 AI Software at competitive prices, the perceived value of our C3 AI Software, our ability to maintain our customers’ trust, our ability to continue to develop additional functionality and use cases and our ability to differentiate our C3 AI Software and capabilities from competitive offerings. Brand promotion activities may not yield increased revenue, and even if they do, the increased revenue may not offset the expenses we incur in building and maintaining our brand and reputation. We also rely on our customer base in a variety of ways, including to give us feedback on our C3 AI Software. If we fail to promote and maintain our brand successfully or to maintain loyalty among our customers, or if we incur substantial expenses in an unsuccessful attempt to promote and maintain our brand, we may fail to attract new customers and partners or retain our existing customers and partners and our business and financial condition may be adversely affected. Any negative publicity relating to our employees, partners, or others associated with these parties, may also tarnish our own reputation simply by association and may reduce the value of our brand. Damage to our brand and reputation may result in reduced demand for our C3 AI Software and increased risk of losing market share to our competitors. Any efforts to restore the value of our brand and rebuild our reputation may be costly and may not be successful.

Current wording

Brand promotion activities may not yield increased revenue, and even if they do, the resulting revenue may not offset the associated expenses. If we fail to promote and maintain our brand successfully, or incur substantial expenses in an unsuccessful attempt to do so, we may fail to attract new customers and partners or retain existing ones, which could adversely affect our business and financial condition. Negative publicity relating to our employees, partners, or others associated with us may also harm our reputation by association and reduce the value of our brand. Any such reputational damage may result in reduced demand for our C3 AI Software, increased risk of losing market share, and costly remediation efforts that may not be successful.

Previous wording

To execute our business strategy, we must attract and retain highly qualified personnel. Competition for executives, data scientists, engineers, software developers, sales personnel, and other key employees in our industry is intense. In particular, we compete with many other companies for employees with high levels of expertise in designing, developing and managing platforms and applications for data management, ML, and analytics technologies, as well as for skilled data scientists, sales, and operations professionals. In addition, we are extremely selective in our hiring process which requires significant investment of time and resources from internal stakeholders and management. At times, we have experienced, and we may continue to experience, difficulty in hiring personnel who meet the demands of our selection process and with appropriate qualifications, experience, or expertise, and we may not be able to fill positions as quickly as desired. We completed our initial public offering in December 2020 and potential candidates may not perceive our compensation package, including our equity awards, as favorably as employees hired prior to our initial public offering. In addition, our recruiting personnel, methodology, and approach may need to be altered to address a changing candidate pool and profile. We may not be able to identify or implement such changes in a timely manner.

Current wording

To execute our business strategy, we must attract and retain highly qualified personnel. Competition for executives, data scientists, engineers, software developers, sales personnel, and other key employees in our industry is intense. In particular, we compete with many other companies for employees with high levels of expertise in designing, developing and managing platforms and applications for data management, ML, and analytics technologies, as well as for skilled data scientists, sales, and operations professionals. In addition, we are extremely selective in our hiring process which requires significant investment of time and resources from internal stakeholders and management. At times, we have experienced, and we may continue to experience, difficulty in hiring personnel who meet the demands of our selection process and with appropriate qualifications, experience, or expertise, and we may not be able to fill positions as quickly as desired. In addition, our recruiting personnel, methodology, and approach may need to be altered to address a changing candidate pool and profile. We may not be able to identify or implement such changes in a timely manner.

Previous wording

Our performance metrics and certain other operational data in this report are subject to assumptions and limitations and may not provide an accurate indication of our future or expected results.

Current wording

Our performance metrics and certain operational data may not provide an accurate indication of our future or expected results.

Previous wording

Our performance metrics and other operational data may involve judgment and therefore may not reflect our actual performance, and investors should consider these metrics in light of the assumptions used in calculating such metrics and limitations as a result thereof. Our methodologies for tracking these metrics may change over time, which could result in unexpected changes to our metrics, including the metrics we report. In addition, investors should not place undue reliance on these metrics as an indicator of our future or expected results. Moreover, these metrics may differ from similarly titled metrics presented by other companies and may not be comparable to such other metrics. We regularly review and may adjust our processes for calculating our metrics to improve their accuracy. If our metrics are not accurate representations of our business; if we discover material inaccuracies in our metrics; or if the metrics we rely on to track our performance do not provide an accurate measurement of our business, our reputation may be harmed, we may be subject to legal or regulatory actions, and our operating and financial results could be adversely affected.

Current wording

Our performance metrics and other operational data may involve judgment and therefore may not accurately reflect our actual performance. Our methodologies for tracking these metrics may change over time, which could result in unexpected changes to our reported metrics, and our metrics may differ from similarly titled metrics presented by other companies and may not be comparable to such metrics. We regularly review and may adjust our processes for calculating metrics to improve their accuracy. If our metrics are not accurate representations of our business, if we discover material inaccuracies, or if the metrics we rely on do not provide an accurate measurement of our business, our reputation may be harmed, we may be subject to legal or regulatory actions, and our operating and financial results could be adversely affected.

Previous wording

Other subscription-based software companies often report on metrics such as net dollar-based revenue retention rate, annual recurring revenue or other revenue metrics, and investors and analysts sometimes look to these metrics as indicators of business activity in a period for businesses such as ours. However, due to our dependence on a small number of high-value customer contracts, these metrics are not accurate indicators of future revenue for any given period of time because the gain or loss of even a single high-value customer contract could cause significant volatility in these metrics. If investors and analysts view our business through these metrics, the trading price of our Class A common stock may be adversely affected.

Current wording

Certain metrics commonly reported by subscription-based software companies, such as net dollar-based revenue retention rate and annual recurring revenue, are particularly limited indicators of our future financial results. Due to our dependence on a relatively small number of high-value customer contracts, the gain or loss of even a single contract could cause significant volatility in these metrics, rendering them unreliable predictors of revenue for any given period. Investors and analysts should not place undue reliance on these metrics as indicators of our future or expected results, as doing so could adversely affect the trading price of our Class A common stock.

Previous wording

Global economic and business activities continue to face widespread macroeconomic uncertainties, including labor shortages and supply chain disruptions, inflation, interest rate fluctuations, bank failures, monetary supply shifts, government shutdowns and the imposition of tariffs or other impacts on trade relations, as well as recession risks, which may continue for an extended period and which could result in our customer prospects and our existing customers experiencing slowdowns in their businesses, which in turn may result in reduced demand for our C3 AI Software, lengthening of sales cycles, loss of customers, and difficulties in collections. Our vendors and suppliers may experience, or may continue to experience, disruptions in their supply chains, which may result in service interruptions or additional operating expenses, and may increase the price at which our vendors and suppliers are willing to sell their products to us.

Current wording

Global economic and business activities continue to face widespread macroeconomic uncertainties, including labor shortages and supply chain disruptions, inflation, interest rate fluctuations, bank failures, monetary supply shifts, government shutdowns and the imposition of tariffs or other impacts on trade relations, as well as recession risks, which may continue for an extended period and which could result in our customer prospects and our existing customers experiencing slowdowns in their businesses, which in turn may result in reduced demand for our C3 AI Software, lengthening of sales cycles, loss of customers, and difficulties in collections. To the extent our C3 AI Software is perceived by customers and potential customers as discretionary, our revenue may be disproportionately affected by delays or reductions in information technology spending. Our vendors and suppliers may experience, or may continue to experience, disruptions in their supply chains, which may result in service interruptions or additional operating expenses, and may increase the price at which our vendors and suppliers are willing to sell their products to us.

Previous wording

In the United States, federal, state, and local governments have enacted numerous data privacy and security laws, including data breach notification laws, personal data privacy laws, consumer protection laws (e.g., Section 5 of the Federal Trade Commission Act), and other similar laws (e.g., wiretapping laws). For example, the federal Health Insurance Portability and Accountability Act of 1996, or HIPAA, as amended by the Health Information Technology for Economic and Clinical Health Act, or HITECH, imposes specific requirements relating to the privacy, security and transmission of individually identifiable health information. In the past few years, numerous U.S. states have enacted comprehensive privacy laws that impose certain obligations on covered businesses, including providing specific disclosures in privacy notices and affording residents with certain rights concerning their personal data. As applicable, such rights may include the right to access, correct, or delete certain personal data, and to opt-out of certain data processing activities, such as targeted advertising, profiling, and automated decision-making. The exercise of these rights may impact our business and ability to provide our products and services. Certain states also impose strict requirements for processing certain personal data, including sensitive information, such as conducting data privacy impact assessments. These state laws allow for statutory fines for noncompliance. For example, the California Consumer Privacy Act of 2018 (CCPA), applies to personal data of consumers, business representatives and employees who are California residents, and imposes obligations on covered businesses, including, but not limited to, providing specific disclosures in privacy notices and honoring requests of such individuals to exercise certain privacy rights related to their personal data. The CCPA provides for statutory fines for noncompliance and allows private litigants affected by certain data breaches to recover significant statutory damages. Similar laws are being considered in several other states and at the federal level and local levels, and we expect more states to pass similar laws in the future, reflecting a trend toward more stringent privacy legislation in the United States. These new laws could further complicate compliance efforts and increase legal risk and compliance costs for us, the third parties with whom we work, and our customers.

Current wording

In the United States, federal, state, and local governments have enacted numerous data privacy and security laws, including data breach notification laws, personal data privacy laws, consumer protection laws (e.g., Section 5 of the Federal Trade Commission Act), and other similar laws (e.g., wiretapping laws). For example, the federal Health Insurance Portability and Accountability Act of 1996, or HIPAA, as amended by the Health Information Technology for Economic and Clinical Health Act imposes specific requirements relating to the privacy, security and transmission of individually identifiable health information. In the past few years, numerous U.S. states have enacted comprehensive privacy laws that impose certain obligations on covered businesses, including providing specific disclosures in privacy notices and affording residents with certain rights concerning their personal data. As applicable, such rights may include the right to access, correct, or delete certain personal data, and to opt-out of certain data processing activities, such as targeted advertising, profiling, and automated decision-making. The exercise of these rights may impact our business and ability to provide our products and services. Certain states also impose strict requirements for processing certain personal data, including sensitive information, such as conducting data privacy impact assessments. These state laws allow for statutory fines for noncompliance. For example, the California Consumer Privacy Act of 2018 (CCPA) applies to personal data of consumers, business representatives and employees who are California residents, and imposes obligations on covered businesses, including, but not limited to, providing specific disclosures in privacy notices and honoring requests of such individuals to exercise certain privacy rights related to their personal data. The CCPA provides for statutory fines for noncompliance and allows private litigants affected by certain data breaches to recover significant statutory damages. Numerous similar laws have been considered or enacted in several other states and at the federal level and local levels, and we expect more states to pass similar laws in the future. Further, the U.S. government is contemplating federal privacy legislation, and certain local jurisdictions have enacted privacy legislation. Collectively, these reflect a trend toward more stringent privacy legislation in the United States. Evolving privacy legislation in the United States could further complicate compliance efforts and increase legal risk and compliance costs for us, the third parties with whom we work, and our customers.

Previous wording

Outside the United States, an increasing number of laws, regulations, and industry standards apply to data privacy and security. In Canada, the Personal Information Protection and Electronic Documents Act, or PIPEDA, and various related provincial laws, as well as Canada’s Anti-Spam Legislation, or CASL, may apply to our operations. We also target customers in Asia and have operations in Japan and Singapore and may be subject to new and emerging data privacy regimes in Asia, including Japan’s Act on the Protection of Personal Information and Singapore’s Personal Data Protection Act. In the European Economic Area, or EEA, we are subject to the European General Data Protection Regulation, or GDPR, and in the United Kingdom, or UK, we are subject to the UK data protection regime, or UK GDPR (EU GDPR and UK GDPR, collectively GDPR). Companies that must comply with the GDPR face increased compliance obligations and risk, including more robust regulatory enforcement of data protection requirements, with violations potentially resulting in an order prohibiting the processing of personal data and/or fines of up to the greater of €20 million or 4% of the annual global revenues of the noncompliant company in the European Union, and up to the greater of GBP 17.5 million or 4% of the annual global revenues in the UK; or private litigation related to processing of personal data brought by classes of data subjects or consumer protection organizations authorized at law to represent their interests.

Current wording

Outside the United States, an increasing number of laws, regulations, and industry standards apply to data privacy and security. In Canada, the Personal Information Protection and Electronic Documents Act and various related provincial laws, as well as Canada’s Anti-Spam Legislation, may apply to our operations. We also target customers in Asia and have operations in Japan and Singapore and may be subject to new and emerging data privacy regimes in Asia, including Japan’s Act on the Protection of Personal Information and Singapore’s Personal Data Protection Act. In the European Economic Area, or EEA, we are subject to the European General Data Protection Regulation, or GDPR, and in the United Kingdom, or UK, we are subject to the UK data protection regime, or UK GDPR (EU GDPR and UK GDPR, collectively GDPR). Companies that must comply with the GDPR face increased compliance obligations and risk, including more robust regulatory enforcement of data protection requirements, with violations potentially resulting in an order prohibiting the processing of personal data and/or fines of up to the greater of €20 million or 4% of the annual global revenues of the noncompliant company in the European Union, and up to the greater of GBP 17.5 million or 4% of the annual global revenues in the UK; or private litigation related to processing of personal data brought by classes of data subjects or consumer protection organizations authorized at law to represent their interests.

Previous wording

In the ordinary course of business, we may transfer personal data from Europe and other jurisdictions to the United States or other countries. European and other data protection laws, including the GDPR also restrict the ability of companies to transfer personal data to the United States and other countries. Although there are currently various mechanisms that may be used to transfer personal data from the EEA and the UK to the United States in compliance with law, such as the EEA’s standard contractual clauses, the UK’s International Data Transfer Agreement/Addendum, and the EU-U.S. Data Privacy Framework (and UK Extension) (which allows for transfers to relevant U.S.-based organizations who self-certify compliance and participate in the Data Privacy Framework), these mechanisms are subject to legal challenges, and there is no assurance that we can satisfy or rely on these measures to lawfully transfer personal data to the United States. It is unclear how data transfers from countries such as the EEA and UK to the United States will be regulated in the long term, which measures must be put in place for onward transfers, and whether or not the Transatlantic Data Privacy Framework will provide a long-term solution to managing flows of personal data from the EEA and the UK to the United States.

Current wording

In the ordinary course of business, we may transfer personal data from Europe and other jurisdictions to the United States or other countries. European and other data protection laws, including the GDPR, restrict the ability of companies to transfer personal data to the United States and other countries. Although there are currently various mechanisms that may be used to transfer personal data from the EEA and the UK to the United States in compliance with law, such as the EEA’s standard contractual clauses, the UK’s International Data Transfer Agreement/Addendum, and the EU-U.S. Data Privacy Framework (and UK Extension), these mechanisms are subject to legal challenges, and there is no assurance that we can satisfy or rely on these measures to lawfully transfer personal data to the United States. It is unclear how data transfers from countries such as the EEA and UK to the United States will be regulated in the long term, which measures must be put in place for onward transfers, and whether or not the Data Privacy Framework or related programs will provide a long-term solution to managing flows of personal data from the EEA and the UK to the United States.

Previous wording

Additionally, the U.S. Department of Justice issued a rule entitled the Preventing Access to U.S. Sensitive Personal Data and Government-Related Data by Countries of Concern or Covered Persons, which places additional restrictions on certain data transactions involving countries of concern (e.g., China, Russia, Iran) and covered individuals (i.e., individuals and entities who are designated as such by the U.S. Attorney General or considered “foreign persons” and are majority owned by, organized under the laws of, a primary resident in, or a contractor of, a covered person or country of concern, as applicable) that may impact certain business activities such as vendor engagements, sale or sharing of data, employment of certain individuals, and investor agreements. Violations of the rule could lead to significant civil and criminal fines and penalties.

Current wording

Additionally, the U.S. Department of Justice issued a rule that places additional restrictions on certain data transactions involving countries of concern (e.g., China, Russia, and Iran) and covered individuals (i.e., individuals and entities who are designated as such by the U.S. Attorney General or considered “foreign persons” and are majority owned by, organized under the laws of, a primary resident in, or a contractor of, a covered person or country of concern, as applicable) that may impact certain business activities such as vendor engagements, sale or sharing of data, employment of certain individuals, and investor agreements. Violations of the rule could lead to significant civil and criminal fines and penalties.

Previous wording

Other data protection laws in the EEA and the UK, such as those implementing the ePrivacy Directive, restrict the use of cookies and similar technologies on which our website and product rely. Regulators are increasingly focused on compliance with requirements in the online tracking ecosystem. Other countries outside of Europe increasingly emulate European data protection laws. As a result, operating our business or offering our services in Europe or other countries with similar data protection laws would subject us to substantial compliance costs and potential liability and may require changes to the ways we collect and use personal data. We may also become subject to new laws that regulate non-personal data. For example, the European Union’s Data Act imposes certain data and cloud service interoperability and switching obligations to enable users to switch between cloud service providers without undue delay or cost, as well as certain requirements concerning cross-border international transfers of, and governmental access to, non-personal data outside the EEA. Moreover, the European Union’s Network and Information Security Directive (“NIS2”) regulates resilience and incident response capabilities of entities operating in a number of sectors. Non-compliance with NIS2 may lead up to administrative fines of a maximum of 10 million Euros or up to 2% of the total worldwide revenue of the preceding fiscal year. Depending on how this Act and any similar laws are implemented and interpreted, we may have to adapt our business practices, contractual arrangements, and C3 AI Software to comply with such obligations.

Current wording

Other data protection laws in the EEA and the UK, such as those implementing the ePrivacy Directive, restrict the use of cookies and similar technologies on which our website and product rely. Regulators are increasingly focused on compliance with requirements in the online tracking ecosystem. Other countries outside of Europe increasingly emulate European data protection laws. As a result, operating our business or offering our services in Europe or other countries with similar data protection laws would subject us to substantial compliance costs and potential liability and may require changes to the ways we collect and use personal data. We may also become subject to new laws that regulate non-personal data. For example, the European Union’s Data Act imposes certain data and cloud service interoperability and switching obligations to enable users to switch between cloud service providers without undue delay or cost, as well as certain requirements concerning cross-border international transfers of, and governmental access to, non-personal data outside the EEA. Moreover, the European Union’s Network and Information Security Directive (“NIS2”) regulates resilience and incident response capabilities of entities operating in a number of sectors. Non-compliance with NIS2 may lead to administrative fines of a maximum of 10 million Euros or up to 2% of the total worldwide revenue of the preceding fiscal year. Depending on how this Act and any similar laws are implemented and interpreted, we may have to adapt our business practices, contractual arrangements, and C3 AI Software to comply with such obligations.

Previous wording

We may also be subject to new laws governing the privacy of consumer health data, including reproductive, sexual orientation, and gender identity privacy rights. For example, Washington’s My Health My Data Act (MHMD) broadly defines consumer health data, places restrictions on processing consumer health data (including imposing stringent requirements for consents), provides consumers certain rights with respect to their health data, and creates a private right of action to allow individuals to sue for violations of the law. Other states are considering and may adopt similar laws.

Current wording

We may also be subject to new laws governing the privacy of consumer health data. For example, Washington’s My Health My Data Act broadly defines consumer health data, places restrictions on processing consumer health data (including imposing stringent requirements for consents), provides consumers certain rights with respect to their health data, and creates a private right of action to allow individuals to sue for violations of the law. Other states are considering and may have adopted similar laws.

Previous wording

Obligations related to data privacy and security (and consumers’ data privacy expectations) are quickly changing in an increasingly stringent fashion, creating some uncertainty as to the effective future legal framework. Additionally, these obligations may be subject to differing applications and interpretations, which may be inconsistent or conflict among jurisdictions. Preparing for and complying with these obligations requires significant resources, which may necessitate changes to our information technologies, systems, and practices, including our C3 AI Software, possibly limiting our ability to develop new applications and features, and to those of any third parties with whom we work. Although we endeavor to comply with all applicable data privacy and security obligations, we may at times fail (or be perceived to have failed) to do so. Moreover, despite our efforts, our personnel or that of the third parties with whom we work may fail to comply with such obligations, which could negatively impact our business operations and compliance posture. For example, any failure by a third-party processor to comply with applicable law, regulations, or contractual obligations could result in adverse effects, including inability to or interruption in our ability to operate our business and proceedings against us by governmental entities or others. If we fail, or are perceived to have failed, to address or comply with data privacy and security obligations, we could face significant consequences. These consequences may include, but are not limited to, government enforcement actions (e.g., investigations, fines, penalties, audits, inspections, and similar); litigation (including class action claims) and mass arbitration demands; additional reporting requirements and/or oversight; bans or restrictions on processing personal data; orders to destroy or not use personal data; and imprisonment of company officials. In particular, plaintiffs have become increasingly more active in bringing privacy-related claims against companies, including class claims and mass arbitration demands. Some of these claims allow for the recovery of statutory damages on a per violation basis, and, if viable, carry the potential for monumental statutory damages, depending on the volume of data and the number of violations. Any of these events could have a material adverse effect on our reputation, business, or financial condition, including but not limited to: loss of customers; interruptions or stoppages in our business operations; interruptions or stoppages of data collection needed to train our algorithms; inability to process personal data or to operate in certain jurisdictions; limited ability to develop or commercialize our product; expenditure of time and resources to defend any claim or inquiry; adverse publicity; revision or restructuring of our operations; or reduced demand for our C3 AI Software. Governments and regulators in certain jurisdictions, including Europe, are inc…

Excerpt shortened here; the source contains the full paragraph.

Current wording

Obligations related to data privacy and security (and consumers’ data privacy expectations) are changing in an increasingly stringent fashion, creating some uncertainty as to effective legal frameworks. Additionally, these obligations may be subject to differing applications and interpretations, which may be inconsistent or conflict among jurisdictions. Preparing for and complying with these obligations requires significant resources, which may necessitate changes to our information technologies, systems, and practices, including our C3 AI Software, possibly limiting our ability to develop new applications and features, and to those of any third parties with whom we work. Although we endeavor to comply with all applicable data privacy and security obligations, we may at times fail (or be perceived to have failed) to do so. Moreover, despite our efforts, our personnel or those of the third parties with whom we work may fail to comply with such obligations, which could negatively impact our business operations and compliance posture. If we fail, or are perceived to have failed, to address or comply with data privacy and security obligations, we could face significant consequences. These consequences may include, but are not limited to, government enforcement actions (e.g., investigations, fines, penalties, audits, inspections, and similar); litigation (including class action claims) and mass arbitration demands; additional reporting requirements and/or oversight; bans or restrictions on processing personal data; orders to destroy or not use personal data; and imprisonment of company officials. In particular, plaintiffs have become increasingly active in bringing privacy-related claims against companies, including class claims and mass arbitration demands. Some of these claims allow for the recovery of statutory damages on a per violation basis, and, if viable, carry the potential for monumental statutory damages, depending on the volume of data and the number of violations. Any of these events could have a material adverse effect on our reputation, business, or financial condition, including but not limited to: loss of customers; interruptions or stoppages in our business operations; interruptions or stoppages of data collection needed to train our algorithms; inability to process personal data or to operate in certain jurisdictions; limited ability to develop or commercialize our product; expenditure of time and resources to defend any claim or inquiry; adverse publicity; revision or restructuring of our operations; or reduced demand for our C3 AI Software. Governments and regulators in certain jurisdictions, including Europe, are increasingly seeking to regulate cybersecurity and the use, transfer, and other processing of non-personal information (for example, under the European Union’s Data Act), an area which has typically been the subject of very limited or no specific regulation. This means that, if and to the extent such regulations are rele…

Excerpt shortened here; the source contains the full paragraph.

Previous wording

Cyber-attacks, denial-of-service attacks, ransomware attacks, business email compromises, computer malware, viruses, social engineering (including phishing), online and offline fraud and other malicious internet-based activity are prevalent in our industry and our customers’ industries and such attacks continue to increase. Some actors now engage and are expected to continue to engage in cyber-attacks, including without limitation nation-state actors for geopolitical reasons and in conjunction with military conflicts and defense activities. During times of war and other major conflicts, we and the third parties with whom we work may be vulnerable to a heightened risk of these attacks, including retaliatory and other cyber-attacks, that could materially disrupt our systems and operations, supply chain, and ability to produce, sell and distribute our goods and services. We also utilize third-party providers to host, transmit, or otherwise process electronic data in connection with our business activities. We or our vendors and business partners may experience social-engineering attacks (including through deep fakes, which may be increasingly more difficult to identify as fake, and phishing attacks), malicious code (such as viruses and worms), malware (including as a result of advanced persistent threat intrusions), denial-of-service attacks, credential stuffing, credential harvesting, unavailable systems, unauthorized access or disclosure due to employee or other theft or misuse, denial-of-service attacks, sophisticated attacks by nation-state and nation-state supported actors, ransomware attacks, supply-chain attacks, software bugs, server malfunctions, software or hardware failures, loss of data or other information technology assets, adware, telecommunications failures, attacks enhanced or facilitated by AI, and other similar threats. Ransomware attacks, including by organized criminal threat actors, nation-states, nation-state-supported actors, and “hacktivists,” are becoming increasingly prevalent and severe and can lead to significant interruptions in our operations, ability to provide our products or services, loss of data and income, reputational harm, and diversion of funds. Extortion payments may alleviate the negative impact of a ransomware attack, but we may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting such payments. Similarly, supply-chain attacks have increased in frequency and severity, and we cannot guarantee that third parties and infrastructure in our supply chain or our third-party partners’ supply chains have not been compromised or that they do not contain exploitable defects or bugs that could result in a breach of or disruption to our information technology systems (including our product) or the third-party information technology systems that support us and our services. Remote work has also become more common and has increased risks to our information technology…

Excerpt shortened here; the source contains the full paragraph.

Current wording

Cyber-attacks, denial-of-service attacks, ransomware attacks, business email compromises, computer malware, viruses, social engineering (including phishing), online and offline fraud and other malicious internet-based activity are prevalent in our industry and our customers’ industries and such attacks continue to increase. Some actors now engage and are expected to continue to engage in cyber-attacks, including without limitation nation-state actors for geopolitical reasons and in conjunction with military conflicts and defense activities. During times of war and other major conflicts, we and the third parties with whom we work may be vulnerable to a heightened risk of these attacks, including retaliatory and other cyber-attacks, that could materially disrupt our systems and operations, supply chain, and ability to produce, sell and distribute our goods and services. We also utilize third-party providers to host, transmit, or otherwise process electronic data in connection with our business activities. We or our vendors and business partners may experience social-engineering attacks (including through deep fakes, which may be increasingly more difficult to identify as fake, and phishing attacks), malicious code (such as viruses and worms), malware (including as a result of advanced persistent threat intrusions), denial-of-service attacks, credential stuffing, credential harvesting, unavailable systems, unauthorized access or disclosure due to employee or other theft or misuse, denial-of-service attacks, sophisticated attacks by nation-state and nation-state supported actors, ransomware attacks, supply-chain attacks, software bugs, server malfunctions, software or hardware failures, loss of data or other information technology assets, adware, telecommunications failures, attacks enhanced or facilitated by AI (including through the discovery or exploitation of vulnerabilities facilitated by AI), and other similar threats. Ransomware attacks, including by organized criminal threat actors, nation-states, nation-state-supported actors, and “hacktivists,” are becoming increasingly prevalent and severe and can lead to significant interruptions in our operations, ability to provide our products or services, loss of data and income, reputational harm, and diversion of funds. Extortion payments may alleviate the negative impact of a ransomware attack, but we may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting such payments. Similarly, supply-chain attacks have increased in frequency and severity, and we cannot guarantee that third parties and infrastructure in our supply chain or our third-party partners’ supply chains have not been compromised or that they do not contain exploitable defects or bugs that could result in a breach of, incident impacting, or disruption to our information technology systems (including our product) or the third-party information technology systems that support us and…

Excerpt shortened here; the source contains the full paragraph.

Previous wording

Any of the previously identified or similar threats could cause a security incident or other interruption that could result in unauthorized, unlawful, or accidental acquisition, modification, destruction, loss, alteration, encryption, disclosure of, or access to our sensitive information, or our technology systems, or those of the third parties with whom we work. A security incident or other interruption could disrupt our ability (and that of third parties with whom we work) to provide our platform. Any actual or potential security breach of our C3 AI Software, our operational systems, our physical facilities, or the systems or facilities of our partners, or the perception that one has occurred, could result in material adverse consequences, such as litigation, indemnity obligations, regulatory enforcement actions, investigations, fines, penalties, mitigation and remediation costs, disputes, reputational harm, diversion of management’s attention, and other liabilities and damage to our business. Even though we do not control the security measures of third parties, we may be perceived or asserted to be responsible for any breach of such measures or suffer reputational harm even where we do not have recourse to the third party that caused the breach. In addition, any failure by our partners to comply with applicable law or regulations could result in proceedings against us by governmental entities or others, with further financial, operational, and reputational damage. While we may be entitled to damages if the third parties with whom we work fail to satisfy their privacy or security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such award. In addition to experiencing a security incident, third parties may gather, collect, or infer sensitive information about us from public sources, data brokers, or other means that reveals competitively sensitive details about our organization and could be used to undermine our competitive advantage or market position.

Current wording

Any of the previously identified or similar threats could cause or lead to a security incident or other interruption that could result in unauthorized, unlawful, or accidental acquisition, modification, destruction, loss, alteration, encryption, disclosure of, or access to our sensitive information, or our technology systems, or those of the third parties with whom we work. A security incident or other interruption could disrupt our ability (and that of third parties with whom we work) to provide our platform. Any actual or potential security breach of, or incident impacting, our C3 AI Software, our operational systems, our physical facilities, or the systems or facilities of our partners, or the perception that one has occurred, could result in material adverse consequences, such as litigation, indemnity obligations, regulatory enforcement actions, investigations, fines, penalties, mitigation and remediation costs, disputes, reputational harm, diversion of management’s attention, and other liabilities and damage to our business. Even though we do not control the security measures of third parties, we may be perceived or asserted to be responsible for any security breach or incident or suffer reputational harm even where we do not have recourse to the third party that caused the breach or incident. In addition, any failure by our partners to comply with applicable law or regulations could result in proceedings against us by governmental entities or others, with further financial, operational, and reputational damage. While we may be entitled to damages if the third parties with whom we work fail to satisfy their privacy or security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such award. In addition to experiencing a security incident, third parties may gather, collect, or infer sensitive information about us from public sources, data brokers, or other means that reveals competitively sensitive details about our organization and could be used to undermine our competitive advantage or market position.

Previous wording

The costs to respond to a security breach and/or to mitigate any security vulnerabilities that may be identified could be significant, our efforts to address these problems may not be successful, and these problems could result in unexpected interruptions, delays, cessation of service, negative publicity, and other harm to our business and our competitive position. We could be required to fundamentally change our business activities and practices in response to a security breach or related regulatory actions or litigation, which could have an adverse effect on our business. In addition, laws, regulations, government guidance, and industry standards and practices in the United States and elsewhere are rapidly evolving to combat these threats. We may face increased compliance burdens regarding such requirements from regulators and customers regarding our products and services and also incur additional costs for oversight and monitoring of security risks relating to our own supply chain. For example, we have contractual and legal obligations, or we may voluntarily choose, to notify relevant stakeholders, including affected individuals, customers, regulators, and investors, of security breaches. Most jurisdictions have enacted laws requiring companies to notify individuals, regulatory authorities, and others of security breaches involving certain types of data, and implement other requirements, such as providing credit monitoring and identifying theft protection services. Such disclosures and related actions can be costly, and the disclosures or the failure to comply with such applicable requirements could lead to material adverse consequences. In addition, our agreements with certain customers and partners may require us to notify them in the event of a security breach involving customer or partner data on our systems or those of subcontractors processing customer or partner data on our behalf. Such mandatory disclosures are costly, could lead to negative publicity, may cause our customers to lose confidence in the effectiveness of our security measures, and require us to expend significant capital and other resources to respond to or alleviate problems caused by the actual or perceived security breach and may cause us to breach customer contracts. Our agreements with certain customers require us to use industry-standard, reasonable, or other specified measures to safeguard sensitive personal information or confidential information, and any actual or perceived breach of such measures may increase the likelihood and frequency of customer audits under our agreements, which is likely to increase the costs of doing business. An actual or perceived security breach could lead to claims by our customers, or other relevant stakeholders that we have failed to comply with such legal or contractual obligations. As a result, we could be subject to legal action or our customers could end their relationships with us. There can be no assurance that any limitations…

Excerpt shortened here; the source contains the full paragraph.

Current wording

The costs to respond to a security breach or incident and/or to mitigate any security vulnerabilities that may be identified could be significant, our efforts to address these problems may not be successful, and these problems could result in unexpected interruptions, delays, cessation of service, negative publicity, and other harm to our business and our competitive position. We could be required to fundamentally change our business activities and practices in response to a security breach or incident or related regulatory actions or litigation, which could have an adverse effect on our business. In addition, laws, regulations, government guidance, and industry standards and practices in the United States and elsewhere are rapidly evolving to combat these threats. We may face increased compliance burdens regarding such requirements from regulators and customers regarding our products and services and also incur additional costs for oversight and monitoring of security risks relating to our own supply chain. For example, we have contractual and legal obligations, or we may voluntarily choose, to notify relevant stakeholders, including affected individuals, customers, regulators, and investors, of security breaches or incidents. Most jurisdictions have enacted laws requiring companies to notify individuals, regulatory authorities, and others of security breaches involving certain types of data, and implement other requirements, such as providing credit monitoring and identifying theft protection services. Such disclosures and related actions can be costly, and the disclosures or any actual or alleged failure to comply with such applicable requirements could lead to material adverse consequences. In addition, our agreements with certain customers and partners may require us to notify them in the event of a security breach or incident involving customer or partner data on our systems or those of subcontractors processing customer or partner data on our behalf. The foregoing types of disclosures are costly, could lead to negative publicity, may cause our customers to lose confidence in the effectiveness of our security measures, and require us to expend significant capital and other resources to respond to or alleviate problems caused by the actual or perceived security breach or incident and may cause us to breach customer contracts. Our agreements with certain customers require us to use industry-standard, reasonable, or other specified measures to safeguard sensitive personal information or confidential information, and any actual or perceived breach by us of our obligations to maintain such measures may increase the likelihood and frequency of customer audits under our agreements, which is likely to increase the costs of doing business. An actual or perceived security breach or incident could lead to claims by our customers, or other relevant stakeholders that we have failed to comply with such legal or contractual obligations. As a result, we co…

Excerpt shortened here; the source contains the full paragraph.

Previous wording

While we and a number of our vendors and business partners have implemented security measures designed to protect against security incidents, there can be no assurance that these measures will be effective. We take steps designed to detect and remediate vulnerabilities in our information security systems (such as our hardware and/ or software, including that of third parties with whom we work), and ensure the security, privacy, integrity, confidentiality, availability, and authenticity of our information technology networks and systems, processing and information, but we may not be able to anticipate or to implement effective preventive and remedial measures against all data security and privacy threats or detect, mitigate and remediate all vulnerabilities on a timely basis. We cannot guarantee that the recovery systems, security protocols, network protection mechanisms and other security measures that we have integrated into our systems, networks and physical facilities, which are designed to protect against, detect and minimize security breaches and vulnerabilities, or those of our vendors and business partners, will be adequate to prevent or detect service interruption, system failure data loss or theft, or other material adverse consequences. Actions taken by us or the third parties with whom we work to detect, investigate, mitigate, contain, and remediate a security incident could result in outages, data losses, and disruptions of our business. Threat actors may also gain access to other networks and systems after a compromise of our networks and systems. No security solution, strategy, or measures can address all possible security threats or block all methods of penetrating a network or otherwise perpetrating a security incident. The risk of unauthorized circumvention of our security measures or those of the third parties with whom we work, has been heightened by advances in computer and software capabilities and the increasing sophistication of hackers who employ complex techniques, including without limitation, the theft or misuse of personal and financial information, counterfeiting, “phishing” or social engineering incidents, ransomware, extortion, publicly announcing security breaches, account takeover attacks, denial or degradation of service attacks, malware, fraudulent payment and identity theft. The techniques used to sabotage, disrupt or to obtain unauthorized access to our C3 AI Software, systems, networks, or physical facilities in which data is stored or through which data is transmitted change frequently, and we may be unable to implement adequate preventative measures or stop security breaches while they are occurring. Unremediated high risk or critical vulnerabilities pose material risks to our business. It may also be costly to detect, investigate, mitigate, contain, and remediate a security incident. Further, we may experience delays in developing and deploying remedial measures designed to address any such identified vuln…

Excerpt shortened here; the source contains the full paragraph.

Current wording

The techniques used to sabotage, disrupt or to obtain unauthorized access to our C3 AI Software, systems, networks, or physical facilities in which data is stored or through which data is transmitted change frequently. While we and a number of our vendors and business partners have implemented security measures designed to protect against security incidents, there can be no assurance that these measures will be effective. We take steps designed to detect and remediate vulnerabilities in our information security systems (such as our hardware and/ or software, including that of third parties with whom we work), and ensure the security, privacy, integrity, confidentiality, availability, and authenticity of our information technology networks and systems, processing and information, but we may not be able to anticipate or to implement effective preventive and remedial measures against all security and privacy threats or detect, mitigate and remediate all vulnerabilities on a timely basis. We cannot guarantee that the recovery systems, security protocols, network protection mechanisms and other security measures that we have integrated into our systems, networks and physical facilities, which are designed to protect against, detect and minimize security breaches and vulnerabilities, or those of our vendors and business partners, will be adequate to prevent or detect service interruption, unavailability or theft, or other material adverse consequences. Actions taken by us or the third parties with whom we work to detect, investigate, mitigate, contain, and remediate a security incident could result in outages, data losses, and disruptions of our business. Threat actors may also gain access to other networks and systems after a compromise of our networks and systems. No security solution, strategy, or measures can address all possible security threats or block all methods of penetrating a network or otherwise perpetrating a security breach or incident. The risk of unauthorized circumvention of our security measures or those of the third parties with whom we work, has been heightened by advances in computer and software capabilities and the increasing sophistication of hackers who employ complex techniques, including without limitation, the theft or misuse of personal and financial information, counterfeiting, “phishing” or social engineering incidents, ransomware, extortion, publicly announcing security breaches, account takeover attacks, denial or degradation of service attacks, malware, fraudulent payment and identity theft. The techniques used to sabotage, disrupt or to obtain unauthorized access to our C3 AI Software, systems, networks, or physical facilities in which data is stored or through which data is transmitted change frequently, and we may be unable to implement adequate preventative measures or stop security breaches while they are occurring. Unremediated high risk or critical vulnerabilities pose material risks to our business. It may als…

Excerpt shortened here; the source contains the full paragraph.

Previous wording

If we (or a third party with whom we work) experience a security incident or are perceived to have experienced a security incident, we may experience material adverse consequences such as government enforcement actions (for example, investigations, fines, penalties, audits, and inspections); additional reporting requirements and/or oversight; restrictions on processing sensitive information (including personal data); litigation (including class claims); indemnification obligations; negative publicity; reputational harm; monetary fund diversions; diversion of management attention; interruptions in our operations (including availability of data); financial loss; and other similar harms. Litigation resulting from security breaches may adversely affect our business. Unauthorized access to our C3 AI Software, systems, networks, or physical facilities could result in litigation with our customers or other relevant stakeholders. These proceedings could force us to spend money in defense or settlement, divert management’s time and attention, increase our costs of doing business, or adversely affect our reputation. We could be required to fundamentally change our business activities and practices or modify our C3 AI Software capabilities in response to such litigation, which could have an adverse effect on our business. If a security breach were to occur, and the confidentiality, integrity or availability of our data or the data of our partners or our customers was disrupted, we could incur significant liability, or our C3 AI Software, systems, or networks may be perceived as less desirable, which could negatively affect our business and damage our reputation.

Current wording

If we (or a third party with whom we work) experience a security incident or are perceived to have experienced a security incident, we may experience material adverse consequences such as government enforcement actions (for example, investigations, fines, penalties, audits, and inspections); additional reporting requirements and/or oversight; restrictions on processing sensitive information (including personal data); litigation (including class claims); indemnification obligations; negative publicity; reputational harm; monetary fund diversions; diversion of management attention; interruptions in our operations (including availability of data); financial loss; and other similar harms. Litigation resulting from security breaches or incidents may adversely affect our business. Unauthorized access to our C3 AI Software, systems, networks, or physical facilities could result in litigation with our customers or other relevant stakeholders. These proceedings could force us to spend money in defense or settlement, divert management’s time and attention, increase our costs of doing business, or adversely affect our reputation. We could be required to fundamentally change our business activities and practices or modify our C3 AI Software capabilities in response to such litigation, which could have an adverse effect on our business. If a security breach or incident were to occur, and the confidentiality, integrity or availability of our data or the data of our partners or our customers was disrupted or perceived to have been disrupted, we could incur significant liability, or our C3 AI Software, systems, or networks may be perceived as less desirable, which could negatively affect our business and damage our reputation.

Previous wording

We may not have adequate insurance coverage for security incidents or breaches, including fines, judgments, settlements, penalties, costs, attorney fees and other impacts that arise out of incidents or breaches. Depending on the facts and circumstances of such an incident, the damages, penalties and costs could be significant and may not be covered by insurance or could exceed our applicable insurance coverage limits. If the impacts of a security incident or breach, or the successful assertion of one or more large claims against us that exceeds our available insurance coverage, or results in changes to our insurance policies (including premium increases or the imposition of large deductible or co-insurance requirements), it could have an adverse effect on our business. In addition, we cannot be sure that our existing insurance coverage and coverage for errors and omissions will continue to be available on acceptable terms or that our insurers will not deny coverage as to all or part of any future claim or loss. Our risks are likely to increase as we continue to expand our C3 AI Software, grow our customer base, and store, transmit, and otherwise process increasingly large amounts of proprietary and sensitive data.

Current wording

We may not have adequate insurance coverage for security breaches or incidents, including fines, judgments, settlements, penalties, costs, attorney fees and other impacts that arise out of incidents or breaches. The damages, penalties and costs could be significant and may not be covered by insurance or could exceed our applicable insurance coverage limits. The successful assertion of one or more large claims against us that exceeds our available insurance coverage, or results in changes to our insurance policies (including premium increases or the imposition of large deductible or co-insurance requirements), it could have an adverse effect on our business. In addition, we cannot be sure that our insurance coverage and coverage for errors and omissions will continue to be available on acceptable terms or that our insurers will not deny coverage as to all or part of any future claim or loss. Our risks are likely to increase as we continue to expand our C3 AI Software, grow our customer base, and store, transmit, and otherwise process increasingly large amounts of proprietary and sensitive data.

Previous wording

We currently serve our customers from third-party data center hosting facilities located in the United States, Asia, and Europe. Our operations depend, in part, on our third-party facility providers’ ability to protect these facilities against damage or interruption from natural disasters, power or telecommunications failures, criminal acts, and similar events. In the event that our data center arrangements are terminated, or if there are any lapses of service or damage to a center, we could experience lengthy interruptions in our C3 AI Software as well as delays and additional expenses in making new arrangements.

Current wording

We currently serve our customers from third-party data center hosting facilities located in the United States, Asia, and Europe. Our operations depend, in part, on our third-party facility providers’ ability to protect these facilities against damage or interruption from natural disasters, power or telecommunications failures, criminal acts, and similar events. In the event that our data center arrangements are terminated, or if there are any lapses of service or damage to a center, we have and could in the future experience lengthy interruptions in our C3 AI Software as well as delays and additional expenses in making new arrangements.

Previous wording

We sell to customers globally and have international operations primarily in Europe. As we continue to invest in our international operations, we will become more exposed to the effects of fluctuations in currency exchange rates. Although the majority of our cash generated from revenue is denominated in U.S. dollars, a small amount is denominated in foreign currencies, and our expenses are generally denominated in the currencies of the jurisdictions in which we conduct our operations. For the three months ended January 31, 2026 and 2025, 7% and 5% of our revenue, respectively, and for the nine months ended January 31, 2026 and 2025, 5% and 6% of our revenue, respectively, were denominated in currencies other than U.S. dollars. For the three months ended January 31, 2026 and 2025, 11% and 9% of our expenses, respectively, and for the nine months ended January 31, 2026 and 2025, 11% and 6% of our expenses, respectively, were denominated in currencies other than U.S. dollars. Because we conduct business in currencies other than U.S. dollars but report our results of operations in U.S. dollars, we also face remeasurement exposure to fluctuations in currency exchange rates, which could hinder our ability to predict our future results and earnings and could materially impact our results of operations. Therefore, increases in the value of the U.S. dollar and decreases in the value of foreign currencies could result in the dollar equivalent of our revenue being lower. We do not currently maintain a program to hedge exposures to non-U.S. dollar currencies.

Current wording

We sell to customers globally and have international operations primarily in Europe. As we continue to invest in our international operations, we will become more exposed to the effects of fluctuations in currency exchange rates. Although the majority of our cash generated from revenue is denominated in U.S. dollars, a small amount is denominated in foreign currencies, and our expenses are generally denominated in the currencies of the jurisdictions in which we conduct our operations. For the three months ended July 31, 2026 and 2025, 9% and 6% of our revenue, respectively, were denominated in currencies other than U.S. dollars. For the three months ended July 31, 2026 and 2025, 10% and 6% of our expenses, respectively, were denominated in currencies other than U.S. dollars. Because we conduct business in currencies other than U.S. dollars but report our results of operations in U.S. dollars, we also face remeasurement exposure to fluctuations in currency exchange rates, which could hinder our ability to predict our future results and earnings and could materially impact our results of operations. Therefore, increases in the value of the U.S. dollar and decreases in the value of foreign currencies could result in the dollar equivalent of our revenue being lower. We do not currently maintain a program to hedge exposures to non-U.S. dollar currencies.

Previous wording

One of our U.S. government contracts requires our employees to maintain security clearances, and also requires us to comply with the U.S Department of War, or DoW, security rules and regulations. The DoD has strict security clearance requirements for personnel who perform work in support of classified programs. In general, access to classified information, technology, facilities, or programs are subject to additional contract oversight and potential liability. In the event of a security incident involving classified information, technology, facilities, or programs, or personnel holding clearances, we may be subject to legal, financial, operational and reputational harm. Obtaining and maintaining security clearances for employees involves a lengthy process, and it is difficult to identify, recruit, and retain employees who already hold security clearances. If our employees are unable to obtain security clearances in a timely manner, or at all, or if our employees who hold security clearances are unable to maintain their clearances or terminate employment with us, then a customer requiring classified work could terminate an existing contract or decide not to renew the contract upon its expiration. To the extent we are not able to obtain or maintain a facility security clearance, we may not be able to bid on or win new classified contracts, and our existing contract (and any future contracts we may subsequently obtain) requiring a facility security clearance could be terminated.

Current wording

One of our U.S. government contracts requires our employees to maintain security clearances, and also requires us to comply with the U.S Department of War, or DoW, security rules and regulations. The DoW has strict security clearance requirements for personnel who perform work in support of classified programs. In general, access to classified information, technology, facilities, or programs are subject to additional contract oversight and potential liability. In the event of a security incident involving classified information, technology, facilities, or programs, or personnel holding clearances, we may be subject to legal, financial, operational and reputational harm. Obtaining and maintaining security clearances for employees involves a lengthy process, and it is difficult to identify, recruit, and retain employees who already hold security clearances. If our employees are unable to obtain security clearances in a timely manner, or at all, or if our employees who hold security clearances are unable to maintain their clearances or terminate employment with us, then a customer requiring classified work could terminate an existing contract or decide not to renew the contract upon its expiration. To the extent we are not able to obtain or maintain a facility security clearance, we may not be able to bid on or win new classified contracts, and our existing contract (and any future contracts we may subsequently obtain) requiring a facility security clearance could be terminated.

Previous wording

We have in the past made, and may in the future make, acquisitions of other companies, products, and technologies. We have limited experience in acquisitions. We may not be able to find suitable acquisition candidates, and we may not be able to complete acquisitions on favorable terms, if at all. Any acquisitions we complete may not ultimately strengthen our competitive position or achieve our goals, and may be viewed negatively by customers, developers, or investors. In addition, we may not be able to integrate acquired businesses successfully or effectively manage the combined company following an acquisition. If we fail to successfully integrate our acquisitions, or the people or technologies associated with those acquisitions, into our company, the results of operations of the combined company could be adversely affected. Any integration process will require significant time and resources, require significant attention from management and disrupt the ordinary functioning of our business, and we may not be able to manage the process successfully, which could harm our business. In addition, we may not successfully evaluate or utilize the acquired technology and accurately forecast the financial impact of an acquisition transaction, including accounting charges.

Current wording

We have in the past made, and may in the future make, acquisitions of other companies, products, and technologies. We have limited experience in acquisitions. We may not be able to find suitable acquisition candidates, and we may not be able to complete acquisitions on favorable terms, if at all. Any acquisitions we complete may not ultimately strengthen our competitive position or achieve our goals, and may be viewed negatively by customers, developers, or investors. Entry into certain transactions with foreign entities now or in the future may be subject to government regulations, including review related to foreign direct investment by U.S. or foreign government entities. If a transaction with a foreign entity was subject to regulatory review, such regulatory review might limit our ability to enter into the desired strategic alliance and thus our ability to carry out our long-term business strategy. In addition, we may not be able to integrate acquired businesses successfully or effectively manage the combined company following an acquisition. If we fail to successfully integrate our acquisitions, or the people or technologies associated with those acquisitions, into our company, the results of operations of the combined company could be adversely affected. Any integration process will require significant time and resources, require significant attention from management and disrupt the ordinary functioning of our business, and we may not be able to manage the process successfully, which could harm our business. In addition, we may not successfully evaluate or utilize the acquired technology and accurately forecast the financial impact of an acquisition transaction, including accounting charges.