Evolv Technologies Holdings Inc

Other than as set forth below, there have been no material changes to the risk factors described in our 2023 Form 10-K. For a discussion of potential risks and uncertainties related to us, see Part I, Item 1A, “Risk Factors” of our 2023 Form 10-K.

We are subject to government regulation and other legal obligations, particularly related to privacy, data protection, information security, and product marketing and our actual or perceived failure to comply with such obligations could harm our business.

We, our reseller partners, and our customers are subject to a number of domestic and international laws and regulations that apply to cloud services and the internet generally. These laws, rules, and regulations address a range of issues including data privacy and cyber security, breach notification and restrictions or technological requirements regarding the collection, use, storage, protection, disclosure, retention, transfer, or other processing of data. The regulatory framework for online services, data privacy and cyber security issues worldwide can vary substantially from jurisdiction to jurisdiction, is rapidly evolving and is likely to remain uncertain for the foreseeable future. Many federal, state, local, and foreign government bodies and agencies have adopted or are considering adopting laws, rules and regulations regarding the collection, use, storage, disclosure and other processing of information, web browsing and geolocation data collection, data analytics, facial recognition, cyber security, and breach response and notification procedures. Furthermore, new laws and regulations that apply to our business are being introduced at every level of government in the United States, as well as internationally. As we seek to expand our business, we are, and may increasingly become subject to various laws, regulations, and standards, and may be subject to contractual obligations relating to data privacy and security in the jurisdictions in which we operate.

For example, in the United States, there are numerous federal and state data privacy and security laws, rules, and regulations governing the collection, use, disclosure, retention, security, transfer, storage, and other processing of personal information, including federal and state data privacy laws, data breach notification laws, and consumer protection laws. The FTC and many state attorneys general are interpreting federal and state consumer protection laws to impose standards for the online collection, use, dissemination, and security of data. Such standards require us to publish statements that describe how we handle personal data and choices individuals may have about the way we handle their personal data. If such information that we publish is considered untrue or inaccurate, we may be subject to government claims of unfair or deceptive trade practices, which could lead to significant liabilities and consequences. Moreover, according to the FTC, violating consumers’ privacy rights or failing to take appropriate steps to keep consumers’ personal data secure may constitute unfair acts or practices in or affecting commerce in violation of Section 5(a) of the Federal Trade Commission Act. State consumer protection laws provide similar causes of action for unfair or deceptive practices.

There are also laws and regulations governing the collection and use of biometric information, such as fingerprints and face prints. For example, the Illinois' Biometric Information Privacy Act (“BIPA”) applies to the collection and use of “biometric identifiers” and “biometric information” which include finger and face prints. Several class action lawsuits have been brought under BIPA, as the statute is broad and still being interpreted by the courts.

In addition, the California Consumer Privacy Act, or the CCPA, as amended by the California Privacy Rights Act, and the data protection and security laws of other states impose requirements with respect to disclosure and deletion of personal information of their residents, imposing penalties for violations and, in some cases, private right of action for data breaches. These laws, and similar legislation in other states that are developing or have been recently enacted, impose transparency and other obligations with respect to personal data of their respective residents and provide residents with similar rights for certain types of data breaches.

This legislation may add additional complexity, variation in requirements, restrictions, and potential legal risk, require additional investment in resources to compliance programs, could impact strategies and availability of previously useful data, and could result in increased compliance costs and/or changes in business practices and policies.

Further, some laws may require us to notify governmental authorities and/or affected individuals of data breaches involving certain personal information or other unauthorized or inadvertent access to or disclosure of such information. We may need to notify governmental authorities and affected individuals with respect to such incidents. For example, laws in all 50 U.S. states may require businesses to provide notice to consumers whose personal information has been disclosed as a result of a data breach. These laws are not consistent, and compliance in the event of a widespread data breach may be difficult and costly. We also may be contractually required to notify consumers or other counterparties of a security breach. Regardless of our contractual protections, any actual or perceived security breach or breach of our contractual obligations could harm our reputation and brand, expose us to potential liability or require us to expend significant resources on data security and in responding to any such actual or perceived breach.

Internationally, virtually every jurisdiction in which we operate has customers and/or have prospective customers to which we market has established its own data security and privacy legal frameworks with which we, our reseller partners or our customers must comply.

For example, in the European Union, the General Data Protection Regulation 2016/679 (“GDPR”) imposes requirements on controllers and processors of personal data, including, for example, higher standards for obtaining consent from individuals to process their personal data, more robust disclosures to individuals, a strong individual rights regime, shortened timelines for data breach notifications and restrictions on the transfer of personal data outside of the European Economic Area. Following its departure from the European Union, the United Kingdom has adopted a separate regime based on the GDPR (“UK GDPR”) that imposes similarly onerous requirements. Companies that violate the EU or UK regime can face regulatory investigations, private litigation, prohibitions on data processing, and fines of up to the greater of 4% of their worldwide annual revenue or 20 million Euros (for the EU) or £17.5 million (for the U.K.). Other EU and UK data protection laws and evolving regulatory guidance restrict the ability of companies to market electronically, including through the use of cookies and similar technologies, and companies are increasingly subject to strict enforcement action including fines for noncompliance.

Certain data privacy legislation restricts the cross-border transfer of personal data and some countries introduced data localization into their laws. Specifically, the GDPR, the UK GDPR and other European and UK data protection laws generally prohibit the transfer of personal data from Europe, including the European Economic Area, United Kingdom and Switzerland, to third countries, unless the transfer is to a country deemed to provide adequate protection or the parties to the transfer have implemented specific safeguards to protect the transferred personal data. European case law and guidance have imposed additional onerous requirements in relation to data transfers, and we expect the existing legal complexity and uncertainty regarding international personal data transfers to continue in Europe and globally. If we do not implement the relevant transfer mechanism to transfer personal data, we may violate or infringe data privacy legislation requirements, and we may be exposed to regulatory proceedings or litigation and increased exposure to fines, penalties, or commercial liabilities, as well as reputational damages.

Further, many federal, state, and foreign government bodies and agencies have introduced, and are currently considering, additional laws and regulations, including related to the development and integration of artificial intelligence (“AI”), machine learning, and additional emerging data technologies while mitigating or controlling for bias and discrimination in the context of AI and machine learning. For example, in the United States, an executive order was issued in October 2023 on the Safe, Secure and Trustworthy Development and Use of AI, emphasizing the need for transparency, accountability and fairness in the development and use of AI. The order seeks to balance innovation with addressing risks associated with AI by providing eight guiding principles and priorities, such as ensuring that consumers are protected from fraud, discrimination and privacy risks related to AI. Legislation has also been promulgated on the state level. For example, the California Privacy Protection Agency is currently in the process of finalizing regulations under the CCPA regarding the use of automated decision making. In addition, in Europe the European Commission proposed a regulation seeking to establish a comprehensive, risk-based governance framework for AI in the EU market, the EU AI Act, which was politically agreed to in December 2023. It is intended to apply to companies that develop, use and/or provide AI in the EU and includes requirements around transparency, conformity assessments and monitoring, risk assessments, human oversight, security and accuracy and introduces significant fines for noncompliance. There are also specific rules on the use of automated decision making under the GDPR that provide the data subject the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her. Additionally, the existence of automated decision making must be disclosed to the data subject with a meaningful explanation of the logic used in such decision making in certain circumstances and safeguards must be implemented to safeguard individual rights, including the right to obtain human intervention and to contest any decision. If passed, we will likely incur additional expenses and costs associated with complying with such laws, as well as face heightened potential liability if we are unable to comply with these laws. While we minimize any physical bias in our product’s identification of threats because the product’s AI does not process or analyze an individual's physical characteristics, we may not be able to identify such issues in advance, or if identified, we may not be able to identify mechanisms for effectively mitigating such issues.

We strive to comply with all applicable laws, policies, legal obligations, and industry codes of conduct relating to privacy and data protection to the extent possible. Because the interpretation and application of privacy and data protection laws are still uncertain, it is possible that these laws may be interpreted and applied in a manner that is inconsistent from one jurisdiction to another or with our existing practices or the features of our products and may conflict with other rules or regulations, making enforcement, and thus compliance requirements, ambiguous, uncertain, and potentially inconsistent. Any significant change to applicable laws, regulations or industry practices, or how each is interpreted, regarding the use or disclosure of personal information, or regarding the manner in which the express or implied consent of customers for the use and disclosure of personal information is obtained, could require us to modify our products and features, possibly in a material manner and subject to increased compliance costs, which may limit our ability to develop new products and features that make use of the personal information that our customers voluntarily share. Any failure or perceived failure by us to comply with our privacy policies, privacy-related obligations to customers or other third parties, or our privacy-related legal obligations, or any compromise of security that results in the unauthorized access to or unintended release of personally identifiable information or other customer data, may result in governmental enforcement actions, litigation, or public statements against us by consumer advocacy groups or others. Any of these events could cause us to incur significant costs in investigating and defending such claims and, if found liable, pay significant damages. Further, these proceedings and any subsequent adverse outcomes may cause our customers to lose trust in us, which could have an adverse effect on our reputation and business.

We may also be subject to claims of liability or responsibility for the actions of third parties with whom we interact or upon whom it relies in relation to various products, including but not limited to vendors and business partners. If so, in addition to the possibility of fines, lawsuits and other claims, we could be required to fundamentally change our business activities and practices or modify our products, which could have an adverse effect on our business. Any inability to adequately address privacy and/or data concerns, even if unfounded, or comply with applicable privacy or data protection laws, regulations, and policies, could result in additional cost and liability to us, damage our reputation, inhibit sales and adversely affect our business.

The costs of compliance with, and other burdens imposed by, the laws, rules, regulations, and policies that are applicable to the businesses of our customers may limit the use and adoption of, and reduce the overall demand for, our software. Even the perception of privacy or discrimination concerns, whether or not valid, may harm our reputation, inhibit adoption of our products by current and future customers, or adversely impact our ability to attract and retain workforce talent. Our failure to comply with applicable laws and regulations, or to protect such data, could result in enforcement action against us, including fines, imprisonment of company officials and public censure, claims for damages by customers and other affected individuals, damage to our reputation and loss of goodwill (both in relation to existing customers and prospective customers), any of which could have a material adverse effect on our operations, financial performance and business. We may also have costs associated with engaging with stakeholders, including investors, insurance providers, and other capital providers, on such issues.

The marketing and sale of our products are also subject to extensive regulation by various federal agencies, including the FTC, as well as various other federal, state, provincial, local, and international regulatory authorities in the countries in which our products are distributed or sold and industry codes of conduct. From time to time, we receive government regulatory inquiries and requests for information and our approach is to be cooperative and educate them about our company and products. For example, the FTC has requested information about certain aspects of our marketing practices. We are complying with the FTC's requests and have been cooperating with them to answer their questions and educate them about our mission. In February 2024, we received a subpoena from the SEC, Division of Enforcement, requesting that we produce certain documents and information. The Company is cooperating with the FTC and SEC with respect to the investigations. We can offer no assurances as to the outcome of these investigations or their potential effect, if any, on us or our results of operations. Any inability to adequately address the FTC’s or SEC's concerns or comply with applicable laws, regulations, and policies, could result in litigation, enforcement actions or significant penalties or claims, which could, in turn, divert financial and management resources, damage our reputation, inhibit sales, and otherwise adversely affect our business. Any resolution or litigation with the FTC, SEC or other parties could ultimately result in monetary and/or injunctive relief that may impose costs on us and/or require us to make changes to our business practices and marketing activities and could adversely impact our customer relationships.

In addition to the possibility of fines, injunctive relief, lawsuits and other claims, as a result of any pending or any future regulatory enforcement proceedings or inquiries we could be required to fundamentally change our business practices. Responding to these or other investigations alone can be costly and time-consuming. Any of these events could materially adversely affect our operating results and financial condition. See also Note 14 (Commitments and Contingencies) to our condensed consolidated financial statements for the six months ended June 30, 2024 for additional information.

We are and may in the future be subject to legal proceedings, claims and investigations in or outside the ordinary course of business. Such proceedings, claims and investigations could be costly and time-consuming to defend and could result in unfavorable outcomes, which may have a material adverse effect on our business, operating results and financial condition, and negatively affect the price of our common stock.

We are, and may in the future become, subject to various legal proceedings, claims and investigations that arise in or outside the ordinary course of business. For example, in March 2024, an Evolv shareholder filed in the U.S. District Court for the District of Massachusetts a putative class action lawsuit, captioned Raby v. Evolv Technologies Holdings, Inc., et al. case number 1:24-cv-10761, alleging that Evolv and certain of its current and former executives and other individuals violated Sections 10(b) and 20(a) of the Securities Exchange Act of 1934 based on alleged misstatements concerning the Company’s products. We are also cooperating with ongoing investigations by the FTC and SEC. The above-captioned proceeding, as well as any pending or future government investigation or proceeding may result in substantial costs or liabilities, as well as a diversion of management’s attention and resources, which could harm our business, result in a decline in the market price of our common stock and impact our financing efforts.

The potential costs and liabilities associated with legal proceedings, claims and investigations involving us or members of our leadership team is uncertain, and the results of such legal proceedings, claims and investigations cannot be predicted with certainty. Lawsuits and other administrative or legal proceedings that may arise can involve substantial costs, including the costs associated with investigation, litigation and possible settlement, judgment, penalty or fine. In addition, lawsuits and other legal proceedings may be time consuming to defend or prosecute and may require a commitment of management and personnel resources that will be diverted from our normal business operations. Also, our insurance coverage may be insufficient, our assets may be insufficient to cover any amounts that exceed our insurance coverage, and we may have to pay damage awards or otherwise may enter into settlement arrangements in connection with such claims. Moreover, we may be unable to continue to maintain our existing insurance at a reasonable cost, if at all, or to secure additional coverage, which may result in costs associated with lawsuits and other legal proceedings being uninsured. Any such payments or settlement arrangements in current or future litigation could have a material adverse effect on our business, operating results or financial condition. Even if the plaintiffs’ claims are not successful, current or future litigation could result in substantial costs and significantly and adversely impact our reputation and divert management’s attention and resources, which could have a material adverse effect on our business, operating results and financial condition, and negatively affect the price of our common stock. In addition, such lawsuits may make it more difficult to finance our operations.