C3ai Inc

Previous wording

You should consider carefully the risks and uncertainties described below, together with all of the other information in this Quarterly Report on Form 10-Q, including the section titled “Item 2. Management’s Discussion and Analysis of Financial Condition and Results of Operations” and our condensed consolidated financial statements and related notes. Our business, results of operations, financial condition and prospects could also be harmed by risks and uncertainties that are not presently known to us or that we currently believe are not material. If any of the risks actually occur, our business, results of operations, financial condition, and prospects could be materially and adversely affected. Unless otherwise indicated, references to our business being harmed in these risk factors will include harm to our business, C3 AI Software (which includes our C3 AI Platform, C3 AI Applications and C3 Generative AI Product Suite), reputation, brand, financial condition, results of operations, and prospects. In such event, the market price of our Class A common stock could decline, and you could lose all or part of your investment.

Current wording

You should consider carefully the risks and uncertainties described below, together with all of the other information in this Quarterly Report on Form 10-Q, including the section titled “Item 2. Management’s Discussion and Analysis of Financial Condition and Results of Operations” and our condensed consolidated financial statements and related notes. Our business, results of operations, financial condition and prospects could also be harmed by risks and uncertainties that are not presently known to us or that we currently believe are not material. If any of the risks actually occur, our business, results of operations, financial condition, and prospects could be materially and adversely affected. Unless otherwise indicated, references to our business being harmed in these risk factors will include harm to our business, C3 AI Software (which includes our C3 AI Platform, C3 AI Applications and C3 Generative AI), reputation, brand, financial condition, results of operations, and prospects. In such event, the market price of our Class A common stock could decline, and you could lose all or part of your investment.

Previous wording

We incurred net losses in each period since our founding in 2009. We generated net losses of approximately $72.6 million and $63.2 million for the three months ended January 31, 2024 and 2023, respectively, and $206.8 million and $203.9 million for the nine months ended January 31, 2024 and 2023, respectively. As a result, we had an accumulated deficit of $1.0 billion as of January 31, 2024. We expect to continue to incur net losses for the foreseeable future. These losses and accumulated deficit reflect the substantial investments we made to acquire new customers, commercialize our C3 AI Software, and continue to develop our C3 AI Software. While we have experienced revenue growth in recent periods, we do not know whether or when we will generate sufficient revenue to sustain or increase our growth or achieve or maintain profitability in the future. We also expect our costs and expenses to increase in future periods, which could negatively affect our future results of operations if our revenue does not increase. In particular, we intend to continue to expend significant funds to further develop our C3 AI Software and business, including:

Current wording

We incurred net losses in each period since our founding in 2009. We generated net losses of approximately $62.8 million and $64.4 million for the three months ended July 31, 2024 and 2023, respectively. As a result, we had an accumulated deficit of $1.2 billion as of July 31, 2024. We expect to continue to incur net losses for the foreseeable future. These losses and accumulated deficit reflect the substantial investments we made to acquire new customers, commercialize our C3 AI Software, and continue to develop our C3 AI Software. While we have experienced revenue growth in recent periods, we do not know whether or when we will generate sufficient revenue to sustain or increase our growth or achieve or maintain profitability in the future. We also expect our costs and expenses to increase in future periods, which could negatively affect our future results of operations if our revenue does not increase. In particular, we intend to continue to expend significant funds to further develop our C3 AI Software and business, including:

Previous wording

In addition, our future success depends on our ability to sell additional subscriptions for our C3 AI Software to our existing customers, and our customers renewing their subscriptions when the contract term expires. Our customers generally have no contractual obligation to renew, upgrade, or expand their subscriptions after the terms of their existing subscriptions expire. In addition, our customers may opt to decrease their usage of our C3 AI Software. Given our limited experience with customer renewals of our AI products and services, we may not be able to accurately predict customer renewal rates. Our customers’ renewal and expansion commitments may decline or fluctuate as a result of a number of factors, including, but not limited to, their satisfaction with our C3 AI Software and our customer support, the frequency and severity of software and implementation errors or other reliability issues, the pricing of our subscriptions or competing solutions, changes in their IT budget, the effects of global economic conditions, and our customers’ financial circumstances, including their ability to maintain or expand their spending levels. In order for us to maintain or improve our results of operations, it is important that our customers renew or expand their subscriptions with us. If our customers do not purchase additional subscriptions, increase their usage of our software, or renew their subscriptions with us, our business, financial condition, and results of operations may be harmed.

Current wording

In addition, our future success depends on our ability to sell additional subscriptions for our C3 AI Software to our existing customers, and our customers renewing their subscriptions when the contract term expires. Our customers generally have no contractual obligation to renew, upgrade, or expand their subscriptions after the terms of their existing subscriptions expire. Similarly, after completing a pilot or trial, customers do not have an obligation to continue to license our products, and we may not be able to convert pilot or trial customers into customers purchasing ongoing subscriptions or continue with a monthly consumption-based fee. In addition, our customers may opt to decrease their usage of our C3 AI Software. Given our limited experience with customer renewals of our AI products and services, we may not be able to accurately predict customer renewal rates. Our customers’ renewal and expansion commitments may decline or fluctuate as a result of a number of factors, including, but not limited to, their satisfaction with our C3 AI Software and our customer support, the frequency and severity of software and implementation errors or other reliability issues, the pricing of our subscriptions or competing solutions, changes in their IT budget, the effects of global economic conditions, and our customers’ financial circumstances, including their ability to maintain or expand their spending levels. In order for us to maintain or improve our results of operations, it is important that our customers renew or expand their subscriptions with us. If our customers do not purchase additional subscriptions, increase their usage of our software, or renew their subscriptions with us, our business, financial condition, and results of operations may be harmed.

Previous wording

Because we derive substantially all of our revenue from subscriptions to our C3 AI Software and COE support services, failure of Enterprise AI solutions in general and our C3 AI Software in particular to satisfy customer demands or to achieve increased market acceptance would adversely affect our business, results of operations, financial condition, and growth prospects.

Current wording

Because we derive substantially all of our revenue from subscriptions to our C3 AI Software and Center of Excellence support services, failure of Enterprise AI solutions in general and our C3 AI Software in particular to satisfy customer demands or to achieve increased market acceptance would adversely affect our business, results of operations, financial condition, and growth prospects.

Previous wording

We derive and expect to continue for the foreseeable future to derive substantially all of our revenue from subscriptions to our C3 AI Software and COE support services. As such, the market acceptance of Enterprise AI solutions in general, and our C3 AI Software in particular, are critical to our continued success. Market acceptance of an Enterprise AI solution depends in part on market awareness of the benefits that Enterprise AI can provide over legacy products, emerging point products, and manual processes. In addition, in order for cloud-based Enterprise AI solutions to be widely accepted, organizations must overcome any concerns with placing sensitive information on a cloud-based platform. Demand for our C3 AI Software in particular is affected by a number of other factors, some of which are beyond our control. These factors include continued market acceptance of our C3 AI Software, the pace at which existing customers realize benefits from the use of our C3 AI Software and decide to expand deployment of our C3 AI Software across their business, the timing of development and release of new products by our competitors, technological change, reliability and security, the pace at which enterprises undergo digital transformation, and developments in data privacy regulations. We expect that the needs of our customers will continue to rapidly change and increase in complexity. We will need to improve the functionality and performance of our C3 AI Software continually to meet those rapidly changing, complex demands. If we are unable to continue to meet customer demands or to achieve more widespread market acceptance of Enterprise AI solutions in general or our C3 AI Software in particular, our business operations, financial results, and growth prospects will be materially and adversely affected.

Current wording

We derive and expect to continue for the foreseeable future to derive substantially all of our revenue from subscriptions to our C3 AI Software and Center of Excellence support services. As such, the market acceptance of Enterprise AI solutions in general, and our C3 AI Software in particular, are critical to our continued success. Market acceptance of an Enterprise AI solution depends in part on market awareness of the benefits that Enterprise AI can provide over legacy products, emerging point products, and manual processes. In addition, in order for cloud-based Enterprise AI solutions to be widely accepted, organizations must overcome any concerns with placing sensitive information on a cloud-based platform. Demand for our C3 AI Software in particular is affected by a number of other factors, some of which are beyond our control. These factors include continued market acceptance of our C3 AI Software, the pace at which existing customers realize benefits from the use of our C3 AI Software and decide to expand deployment of our C3 AI Software across their business, the timing of development and release of new products by our competitors, technological change, reliability and security, the pace at which enterprises undergo digital transformation, and developments in data privacy regulations. We expect that the needs of our customers will continue to rapidly change and increase in complexity. We will need to improve the functionality and performance of our C3 AI Software continually to meet those rapidly changing, complex demands. If we are unable to continue to meet customer demands or to achieve more widespread market acceptance of Enterprise AI solutions in general or our C3 AI Software in particular, our business operations, financial results, and growth prospects will be materially and adversely affected.

Previous wording

Given our limited operating history and limited experience with our current pricing models, we may not be able to accurately predict customer renewal or retention rates. As a result, we may be required or choose to reduce our prices or change our pricing model, which could harm our business, results of operations, and financial condition.

Current wording

Given our limited experience with our current pricing models, we may not be able to accurately predict customer renewal or retention rates. As a result, we may be required or choose to reduce our prices or change our pricing model, which could harm our business, results of operations, and financial condition.

Previous wording

It is difficult to predict customer adoption rates and demand for our C3 AI Software, the entry of competitive platforms, or the future growth rate and size of the cloud-based software and software-as-a-service, or SaaS, business software markets. A substantial majority of our revenue has come from sales of our subscription-based software products, which we expect to continue for the foreseeable future. Although demand for data management, ML, and analytics platforms and applications has grown in recent years, the market for these platforms and applications continues to evolve. We cannot be sure that this market will continue to grow or, even if it does grow, that businesses will adopt our C3 AI Software. Our future success will depend in large part on our ability to further penetrate the existing market for Enterprise AI software, as well as the continued growth and expansion of what we believe to be an emerging market for Enterprise AI platforms and applications that are faster, easier to adopt, and easier to use. Our ability to further penetrate the Enterprise AI market depends on a number of factors, including the cost, performance, and perceived value associated with our C3 AI Software, as well as customers’ willingness to adopt a different approach to data analysis. We have spent, and intend to keep spending, considerable resources to educate potential customers about digital transformation, AI, and ML in general and our C3 AI Software in particular. However, we cannot be sure that these expenditures will help our C3 AI Software achieve any additional market acceptance. Furthermore, potential customers may have made significant investments in legacy analytics software systems and may be unwilling to invest in new platforms and applications. If the market fails to grow or grows more slowly than we currently expect or businesses fail to adopt our C3 AI Software, our business, operating results, and financial condition could be adversely affected.

Current wording

It is difficult to predict customer adoption rates and demand for our C3 AI Software, the entry of competitive platforms, or the future growth rate and size of the cloud-based software and software-as-a-service business software markets. A substantial majority of our revenue has come from sales of our subscription-based software products, which we expect to continue for the foreseeable future. Although demand for data management, ML, and analytics platforms and applications has grown in recent years, the market for these platforms and applications continues to evolve. We cannot be sure that this market will continue to grow or, even if it does grow, that businesses will adopt our C3 AI Software. Our future success will depend in large part on our ability to further penetrate the existing market for Enterprise AI software, as well as the continued growth and expansion of what we believe to be an emerging market for Enterprise AI platforms and applications that are faster, easier to adopt, and easier to use. Our ability to further penetrate the Enterprise AI market depends on a number of factors, including the cost, performance, and perceived value associated with our C3 AI Software, as well as customers’ willingness to adopt a different approach to data analysis. We have spent, and intend to keep spending, considerable resources to educate potential customers about digital transformation, AI, and ML in general and our C3 AI Software in particular. However, we cannot be sure that these expenditures will help our C3 AI Software achieve any additional market acceptance. Furthermore, potential customers may have made significant investments in legacy analytics software systems and may be unwilling to invest in new platforms and applications. If the market fails to grow or grows more slowly than we currently expect or businesses fail to adopt our C3 AI Software, our business, operating results, and financial condition could be adversely affected.

Previous wording

Global economic and business activities continue to face widespread macroeconomic uncertainties, including labor shortages and supply chain disruptions, inflation, interest rate fluctuations, or the existence of pandemics (such as the COVID-19 pandemic), bank failures and monetary supply shifts, as well as recession risks, which may continue for an extended period and which could result in our customer prospects and our existing customers experiencing slowdowns in their businesses, which in turn may result in reduced demand for our C3 AI Software, lengthening of sales cycles, loss of customers, and difficulties in collections. Our vendors and suppliers may experience, or may continue to experience, disruptions in their supply chains, which may result in service interruptions or additional operating expenses, and may increase the price at which our vendors and suppliers are willing to sell their products to us.

Current wording

Global economic and business activities continue to face widespread macroeconomic uncertainties, including labor shortages and supply chain disruptions, inflation, interest rate fluctuations, bank failures and monetary supply shifts, as well as recession risks, which may continue for an extended period and which could result in our customer prospects and our existing customers experiencing slowdowns in their businesses, which in turn may result in reduced demand for our C3 AI Software, lengthening of sales cycles, loss of customers, and difficulties in collections. Our vendors and suppliers may experience, or may continue to experience, disruptions in their supply chains, which may result in service interruptions or additional operating expenses, and may increase the price at which our vendors and suppliers are willing to sell their products to us.

Previous wording

We are subject to stringent and evolving U.S. and foreign laws, regulations and rules, contractual obligations, industry standards, policies, self-regulatory schemes, standards and other obligations related to data privacy and security. Our actual or perceived failure to comply with such obligations could lead to regulatory investigations or actions; litigation (including class claims) and mass arbitration demands; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; loss of customers or sales; and other adverse business consequences.

Current wording

We and the third parties with whom we work are subject to stringent and evolving U.S. and foreign laws, regulations and rules, contractual obligations, industry standards, policies, self-regulatory schemes, standards and other obligations related to data privacy and security. Our actual or perceived failure to comply with such obligations could lead, and have in the past led, to regulatory investigations or actions; litigation (including class claims) and mass arbitration demands, as well as potential fines and penalties, disruptions of our business operations, reputational harm; loss of revenue or profits, loss of customers or sales, and other adverse business consequences.

Previous wording

In the United States, federal, state, and local governments have enacted numerous data privacy and security laws, including data breach notification laws, personal data privacy laws, consumer protection laws (e.g., Section 5 of the Federal Trade Commission Act), and other similar laws (e.g., wiretapping laws). For example, the federal Health Insurance Portability and Accountability Act of 1996, or HIPAA, as amended by the Health Information Technology for Economic and Clinical Health Act, or HITECH, imposes specific requirements relating to the privacy, security and transmission of individually identifiable health information. In the past few years, numerous U.S. states—including California, Virginia, Colorado, Connecticut, and Utah—have enacted comprehensive privacy laws that impose certain obligations on covered businesses, including providing specific disclosures in privacy notices and affording residents with certain rights concerning their personal data. As applicable, such rights may include the right to access, correct, or delete certain personal data, and to opt-out of certain data processing activities, such as targeted advertising, profiling, and automated decision-making. The exercise of these rights may impact our business and ability to provide our products and services. Certain states also impose stricter requirements for processing certain personal data, including sensitive information, such as conducting data privacy impact assessments. These state laws allow for statutory fines for noncompliance. For example, the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (CPRA), (collectively, CCPA), applies to personal data of consumers, business representatives and employees who are California residents, and imposes obligations on covered businesses, including, but not limited to, providing specific disclosures in privacy notices and honoring requests of such individuals to exercise certain privacy rights related to their personal data. The CCPA provides for statutory fines for noncompliance (up to $7,500 per intentional violation) and allows private litigants affected by certain data breaches to recover significant statutory damages. Similar laws are being considered in several other states and at the federal level and local levels, and we expect more states to pass similar laws in the future, reflecting a trend toward more stringent privacy legislation in the United States. These new laws could further complicate compliance efforts and increase legal risk and compliance costs for us, the third parties upon whom we rely, and our customers.

Current wording

In the United States, federal, state, and local governments have enacted numerous data privacy and security laws, including data breach notification laws, personal data privacy laws, consumer protection laws (e.g., Section 5 of the Federal Trade Commission Act), and other similar laws (e.g., wiretapping laws). For example, the federal Health Insurance Portability and Accountability Act of 1996, or HIPAA, as amended by the Health Information Technology for Economic and Clinical Health Act, or HITECH, imposes specific requirements relating to the privacy, security and transmission of individually identifiable health information. In the past few years, numerous U.S. states - including California, Virginia, Colorado, Connecticut, and Utah - have enacted comprehensive privacy laws that impose certain obligations on covered businesses, including providing specific disclosures in privacy notices and affording residents with certain rights concerning their personal data. As applicable, such rights may include the right to access, correct, or delete certain personal data, and to opt-out of certain data processing activities, such as targeted advertising, profiling, and automated decision-making. The exercise of these rights may impact our business and ability to provide our products and services. Certain states also impose strict requirements for processing certain personal data, including sensitive information, such as conducting data privacy impact assessments. These state laws allow for statutory fines for noncompliance. For example, the California Consumer Privacy Act of 2018 (CCPA), applies to personal data of consumers, business representatives and employees who are California residents, and imposes obligations on covered businesses, including, but not limited to, providing specific disclosures in privacy notices and honoring requests of such individuals to exercise certain privacy rights related to their personal data. The CCPA provides for statutory fines for noncompliance (up to $7,500 per intentional violation) and allows private litigants affected by certain data breaches to recover significant statutory damages. Similar laws are being considered in several other states and at the federal level and local levels, and we expect more states to pass similar laws in the future, reflecting a trend toward more stringent privacy legislation in the United States. These new laws could further complicate compliance efforts and increase legal risk and compliance costs for us, the third parties with whom we work, and our customers.

Previous wording

As such, we, or our vendors, may be unable to implement measures sufficient to lawfully transfer personal data in a manner necessary to provide our services in certain regions without incurring significant cost, or at all. If we cannot implement a valid compliance mechanism for cross-border data transfers, we may face significant adverse consequences, including the interruption or degradation of our operations, increased exposure to regulatory actions, substantial fines and penalties, and injunctions against processing or transferring personal data from Europe or other foreign jurisdictions. The inability to import personal data to the United States could significantly and negatively impact our business operations, including by limiting our ability to collaborate with parties that are subject to such cross-border data transfer or localization laws; or requiring us to increase our personal data processing capabilities and infrastructure in foreign jurisdictions at significant expense. Some European regulators have significantly restricted some companies’ data processing activities from transferring certain personal data out of Europe allegedly violating the GDPR’s cross-border data transfer limitations, which has materially impacted companies’ operations revenues. Additionally, companies that transfer personal data outside of the EEA and UK to other jurisdictions, particularly the United States, are subject to increased scrutiny form regulators, individual litigants and activist groups.

Current wording

As such, we, or our vendors, may be unable to implement measures sufficient to lawfully transfer personal data in a manner necessary to provide our services in certain regions without incurring significant cost, or at all. If we cannot implement a valid compliance mechanism for cross-border data transfers, we may face significant adverse consequences, including the interruption or degradation of our operations, increased exposure to regulatory actions, substantial fines and penalties, and injunctions against processing or transferring personal data from Europe or other foreign jurisdictions. The inability to import personal data to the United States could significantly and negatively impact our business operations, including by limiting our ability to collaborate with parties that are subject to such cross-border data transfer or localization laws; or requiring us to increase our personal data processing capabilities and infrastructure in foreign jurisdictions at significant expense. Additionally, companies that transfer personal data outside of the EEA and UK to other jurisdictions, particularly the United States, are subject to increased scrutiny from regulators, individual litigants and activist groups. Some European regulators have significantly restricted some companies’ data processing activities, including ordering certain companies to suspend or permanently cease the transfer of certain personal data out of Europe for allegedly violating the GDPR’s cross-border data transfer limitations, which has materially impacted companies’ operations revenues. For example, in May 2023, the Irish Data Protection Commission determined that a major social media company’s use of the standard contractual clauses to transfer personal data from Europe to the United States was insufficient and levied a 1.2 billion Euro fine against the company and prohibited the company from transferring personal data to the United States. Regulators in the United States are also increasingly scrutinizing personal data transfers and may also impose certain data localization requirements, particularly if we transfer personal data to, or process personal data of residents of, high risk or sanctioned jurisdictions, pursuant to, for example, the Biden Administration’s executive order Preventing Access to Americans’ Bulk Sensitive Personal Data and United States Government-Related Data by Countries of Concern.

Previous wording

Other data protection laws in the EEA and the UK, such as those implementing the ePrivacy Directive, restrict the use of cookies and similar technologies on which our website and product rely. Regulators are increasingly focused on compliance with requirements in the online tracking ecosystem, and current national laws implementing the ePrivacy Directive are likely to be replaced in the EU by a regulation known as the ePrivacy Regulation, which will significantly increase fines for non-compliance. Other countries outside of Europe increasingly emulate European data protection laws. As a result, operating our business or offering our services in Europe or other countries with similar data protection laws would subject us to substantial compliance costs and potential liability and may require changes to the ways we collect and use personal data. We may also become subject to new laws in the EEA that regulate cybersecurity and non-personal data, such as the European Data Act. Depending on how these laws are interpreted, we may have to adapt our business practices and products to comply with such obligations.

Current wording

Other data protection laws in the EEA and the UK, such as those implementing the ePrivacy Directive, restrict the use of cookies and similar technologies on which our website and product rely. Regulators are increasingly focused on compliance with requirements in the online tracking ecosystem, and current national laws implementing the ePrivacy Directive are likely to be replaced in the EU by a regulation known as the ePrivacy Regulation, which will significantly increase fines for non-compliance. Other countries outside of Europe increasingly emulate European data protection laws. As a result, operating our business or offering our services in Europe or other countries with similar data protection laws would subject us to substantial compliance costs and potential liability and may require changes to the ways we collect and use personal data. We may also become subject to new laws that regulate non-personal data. For example, the European Union’s Data Act imposes certain data and cloud service interoperability and switching obligations to enable users to switch between cloud service providers without undue delay or cost, as well as certain requirements concerning cross-border international transfers of, and governmental access to, non-personal data outside the EEA. Depending on how this Act and any similar laws are implemented and interpreted, we may have to adapt our business practices, contractual arrangements, and C3 AI Software to comply with such obligations.

Previous wording

Our use of artificial intelligence, or AI, and machine learning, or ML, technologies (collectively, “AI/ML technologies”) may also subject us to certain privacy obligations. There is increasing U.S. and foreign activity in the regulation of AI and other similar uses of technology. In Europe, there is a proposed regulation related to AI that, if adopted, could impose onerous obligations related to the use of AI-related systems. We expect other jurisdictions will adopt similar laws. In the United States, several states and localities have enacted measures related to the use of AI and ML in products and services. We may have to change our business practices to comply with such obligations. For example, our employees and personnel use generative AI technologies to perform their work. Our use of this technology could result in additional compliance costs, regulatory investigations and actions, and lawsuits. If we are unable to use generative AI, it could make our business less efficient and result in competitive disadvantages. We also use AI and ML technologies in our products and services. Our use of this technology could result in additional compliance costs, regulatory investigations and actions, and consumer lawsuits. Depending on how these AI laws and regulations are interpreted, we may have to make changes to our business practices and products, including our C3 AI Software, to comply with such obligations. These obligations may make it harder for us to conduct our business using AI/ML, lead to regulatory fines or penalties, require us retrain our AI/ML, or prevent or limit our use of AI/ML. Additionally, certain privacy laws extend rights to consumers (such as the right to delete certain personal data) and regulate automated decision making, which may be incompatible with our use of AI/ML. Further, under privacy laws and other obligations, we may be required to obtain certain consents to process personal data and our inability or failure to do so could result in adverse consequences. For example, the FTC has required other companies to turn over (or disgorge) valuable insights or trainings generated through the use of AI/ML where they allege the company has violated privacy and consumer protection laws. If we cannot use AI/ML or that use is restricted, our business may be less efficient, or we may be at a competitive disadvantage.

Current wording

Our use of artificial intelligence, or AI, and machine learning, or ML, technologies, collectively, AI/ML technologies, may also subject us to certain privacy obligations. There is increasing U.S. and foreign activity in the regulation of AI and other similar uses of technology. In Europe, the EU AI Act entered into force on August 1, 2024 and will become fully applicable on August 2, 2026, with some provisions already applying from February 2025. Although we do not engage in developing or providing AI systems that would qualify as “prohibited AI practices”, restrictions and obligations under this regulation, to the extent applicable to us, could increase the costs and burdens to us and our customers, delay or halt deployment of new products and services, and may reduce the number of new customers, negatively impacting our business and financial results. We expect other jurisdictions will adopt similar laws. In the United States, several states and localities have enacted measures related to the use of AI and ML in products and services. We may have to change our business practices to comply with such obligations. For example, our employees and personnel use generative AI technologies to perform their work. Our use of this technology could result in additional compliance costs, regulatory investigations and actions, and lawsuits. If we are unable to use generative AI, it could make our business less efficient and result in competitive disadvantages. We also use AI and ML technologies in our products and services. Our use of this technology could result in additional compliance costs, regulatory investigations and actions, and consumer lawsuits. Depending on how these AI laws and regulations are interpreted, we may have to make changes to our business practices and products, including our C3 AI Software, to comply with such obligations. These obligations may make it harder for us to conduct our business using AI/ML, lead to regulatory fines or penalties, require us retrain our AI/ML, or prevent or limit our use of AI/ML. Additionally, certain privacy laws extend rights to consumers (such as the right to delete certain personal data) and regulate automated decision making, which may be incompatible with our use of AI/ML. Further, under privacy laws and other obligations, we may be required to obtain certain consents to process personal data and our inability or failure to do so could result in adverse consequences. For example, the FTC has required other companies to turn over (or disgorge) valuable insights or trainings generated through the use of AI/ML where they allege the company has violated privacy and consumer protection laws. If we cannot use AI/ML or that use is restricted, our business may be less efficient, or we may be at a competitive disadvantage.

Previous wording

Obligations related to data privacy and security (and consumers’ data privacy expectations) are quickly changing in an increasingly stringent fashion, creating some uncertainty as to the effective future legal framework. Additionally, these obligations may be subject to differing applications and interpretations, which may be inconsistent or conflict among jurisdictions. Preparing for and complying with these obligations requires significant resources, which may necessitate changes to our information technologies, systems, and practices, including our C3 AI Software, possibly limiting our ability to develop new applications and features, and to those of any third parties that process personal data on our behalf. Although we endeavor to comply with all applicable data privacy and security obligations, we may at times fail (or be perceived to have failed) to do so. Moreover, despite our efforts, our personnel or third parties upon whom we rely may fail to comply with such obligations, which could negatively impact our business operations and compliance posture. For example, any failure by a third-party processor to comply with applicable law, regulations, or contractual obligations could result in adverse effects, including inability to or interruption in our ability to operate our business and proceedings against us by governmental entities or others. If we fail, or are perceived to have failed, to address or comply with data privacy and security obligations, we could face significant consequences. These consequences may include, but are not limited to, government enforcement actions (e.g., investigations, fines, penalties, audits, inspections, and similar); litigation (including class action claims) and mass arbitration demands; additional reporting requirements and/or oversight; bans on processing personal data; orders to destroy or not use personal data; and imprisonment of company officials. In particular, plaintiffs have become increasingly more active in bringing privacy-related claims against companies, including class claims and mass arbitration demands. Some of these claims allow for the recovery of statutory damages on a per violation basis, and, if viable, carry the potential for monumental statutory damages, depending on the volume of data and the number of violations. Any of these events could have a material adverse effect on our reputation, business, or financial condition, including but not limited to: loss of customers; interruptions or stoppages in our business operations; interruptions or stoppages of data collection needed to train our algorithms; inability to process personal data or to operate in certain jurisdictions; limited ability to develop or commercialize our product; expenditure of time and resources to defend any claim or inquiry; adverse publicity; revision or restructuring of our operations; or reduced demand for our C3 AI Software. Governments and regulators in certain jurisdictions, including Europe, are increasi…

Excerpt shortened here; the source contains the full paragraph.

Current wording

Obligations related to data privacy and security (and consumers’ data privacy expectations) are quickly changing in an increasingly stringent fashion, creating some uncertainty as to the effective future legal framework. Additionally, these obligations may be subject to differing applications and interpretations, which may be inconsistent or conflict among jurisdictions. Preparing for and complying with these obligations requires significant resources, which may necessitate changes to our information technologies, systems, and practices, including our C3 AI Software, possibly limiting our ability to develop new applications and features, and to those of any third parties with whom we work. Although we endeavor to comply with all applicable data privacy and security obligations, we may at times fail (or be perceived to have failed) to do so. Moreover, despite our efforts, our personnel or that of the third parties with whom we work may fail to comply with such obligations, which could negatively impact our business operations and compliance posture. For example, any failure by a third-party processor to comply with applicable law, regulations, or contractual obligations could result in adverse effects, including inability to or interruption in our ability to operate our business and proceedings against us by governmental entities or others. If we fail, or are perceived to have failed, to address or comply with data privacy and security obligations, we could face significant consequences. These consequences may include, but are not limited to, government enforcement actions (e.g., investigations, fines, penalties, audits, inspections, and similar); litigation (including class action claims) and mass arbitration demands; additional reporting requirements and/or oversight; bans or restrictions on processing personal data; orders to destroy or not use personal data; and imprisonment of company officials. In particular, plaintiffs have become increasingly more active in bringing privacy-related claims against companies, including class claims and mass arbitration demands. Some of these claims allow for the recovery of statutory damages on a per violation basis, and, if viable, carry the potential for monumental statutory damages, depending on the volume of data and the number of violations. Any of these events could have a material adverse effect on our reputation, business, or financial condition, including but not limited to: loss of customers; interruptions or stoppages in our business operations; interruptions or stoppages of data collection needed to train our algorithms; inability to process personal data or to operate in certain jurisdictions; limited ability to develop or commercialize our product; expenditure of time and resources to defend any claim or inquiry; adverse publicity; revision or restructuring of our operations; or reduced demand for our C3 AI Software. Governments and regulators in certain jurisdictions, including Europe, are inc…

Excerpt shortened here; the source contains the full paragraph.

Previous wording

Our C3 AI Software processes our customers’ proprietary and sensitive data, potentially including personal information, confidential information, protected health information, financial data, intellectual property, and trade secrets. Our C3 AI Software is built to be available on the infrastructure of third-party public cloud providers such as AWS, Microsoft Azure, and Google Cloud. We also use service providers to help us deliver services to our customers. These service providers may process personal information, protected health information, or other confidential information of our employees, partners or customers in a variety of contexts, including, without limitation, third-party providers of cloud-based infrastructure, encryption and authentication technology, employee email and payroll, content delivery to customers, and other functions. We collect such information from individuals located both in the United States and abroad and may process such information outside the country in which it was collected. Our ability to monitor these third parties’ information security practices is limited, and these third parties may not have adequate information security measures in place. We may share or receive sensitive information with or from third parties.

Current wording

Our C3 AI Software processes our customers’ proprietary and sensitive data, potentially including personal information, confidential information, protected health information, financial data, intellectual property, and trade secrets. Our C3 AI Software is built to be available on the infrastructure of third-party public cloud providers such as AWS, Microsoft Azure, and Google Cloud. We also use third parties to help us deliver services to our customers. These third parties may process personal information, protected health information, or other confidential information of our employees, partners or customers in a variety of contexts, including, without limitation, third-party providers of cloud-based infrastructure, encryption and authentication technology, employee email and payroll, content delivery to customers, and other functions. We collect such information from individuals located both in the United States and abroad and may process such information outside the country in which it was collected. Our ability to monitor these third parties’ information security practices is limited, and these third parties may not have adequate information security measures in place. We may share or receive sensitive information with or from third parties.

Previous wording

Cyber-attacks, denial-of-service attacks, ransomware attacks, business email compromises, computer malware, viruses, social engineering (including phishing), online and offline fraud and other malicious internet-based activity are prevalent in our industry and our customers’ industries and such attacks continue to increase. Some actors now engage and are expected to continue to engage in cyber-attacks, including without limitation nation-state actors for geopolitical reasons and in conjunction with military conflicts and defense activities. During times of war and other major conflicts, we and the third parties upon which we rely may be vulnerable to a heightened risk of these attacks, including retaliatory and other cyber-attacks, that could materially disrupt our systems and operations, supply chain, and ability to produce, sell and distribute our goods and services. We also utilize third-party providers to host, transmit, or otherwise process electronic data in connection with our business activities. We or our vendors and business partners may experience social-engineering attacks (including through deep fakes, which may be increasingly more difficult to identify as fake, and phishing attacks), malicious code (such as viruses and worms), malware (including as a result of advanced persistent threat intrusions), denial-of-service attacks, credential stuffing, credential harvesting, unavailable systems, unauthorized access or disclosure due to employee or other theft or misuse, denial-of-service attacks, sophisticated attacks by nation-state and nation-state supported actors, ransomware attacks, supply-chain attacks, software bugs, server malfunctions, software or hardware failures, loss of data or other information technology assets, adware, telecommunications failures, attacks enhanced or facilitated by AI, and other similar threats. Ransomware attacks, including by organized criminal threat actors, nation-states, nation-state-supported actors, and “hacktivists,” are becoming increasingly prevalent and severe and can lead to significant interruptions in our operations, ability to provide our products or services, loss of data and income, reputational harm, and diversion of funds. Extortion payments may alleviate the negative impact of a ransomware attack, but we may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting such payments. Similarly, supply-chain attacks have increased in frequency and severity, and we cannot guarantee that third parties and infrastructure in our supply chain or our third-party partners’ supply chains have not been compromised or that they do not contain exploitable defects or bugs that could result in a breach of or disruption to our information technology systems (including our product) or the third-party information technology systems that support us and our services. Remote work has also become more common and has increased risks to our information technolog…

Excerpt shortened here; the source contains the full paragraph.

Current wording

Cyber-attacks, denial-of-service attacks, ransomware attacks, business email compromises, computer malware, viruses, social engineering (including phishing), online and offline fraud and other malicious internet-based activity are prevalent in our industry and our customers’ industries and such attacks continue to increase. Some actors now engage and are expected to continue to engage in cyber-attacks, including without limitation nation-state actors for geopolitical reasons and in conjunction with military conflicts and defense activities. During times of war and other major conflicts, we and the third parties with whom we work may be vulnerable to a heightened risk of these attacks, including retaliatory and other cyber-attacks, that could materially disrupt our systems and operations, supply chain, and ability to produce, sell and distribute our goods and services. We also utilize third-party providers to host, transmit, or otherwise process electronic data in connection with our business activities. We or our vendors and business partners may experience social-engineering attacks (including through deep fakes, which may be increasingly more difficult to identify as fake, and phishing attacks), malicious code (such as viruses and worms), malware (including as a result of advanced persistent threat intrusions), denial-of-service attacks, credential stuffing, credential harvesting, unavailable systems, unauthorized access or disclosure due to employee or other theft or misuse, denial-of-service attacks, sophisticated attacks by nation-state and nation-state supported actors, ransomware attacks, supply-chain attacks, software bugs, server malfunctions, software or hardware failures, loss of data or other information technology assets, adware, telecommunications failures, attacks enhanced or facilitated by AI, and other similar threats. Ransomware attacks, including by organized criminal threat actors, nation-states, nation-state-supported actors, and “hacktivists,” are becoming increasingly prevalent and severe and can lead to significant interruptions in our operations, ability to provide our products or services, loss of data and income, reputational harm, and diversion of funds. Extortion payments may alleviate the negative impact of a ransomware attack, but we may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting such payments. Similarly, supply-chain attacks have increased in frequency and severity, and we cannot guarantee that third parties and infrastructure in our supply chain or our third-party partners’ supply chains have not been compromised or that they do not contain exploitable defects or bugs that could result in a breach of or disruption to our information technology systems (including our product) or the third-party information technology systems that support us and our services. Remote work has also become more common and has increased risks to our information technology…

Excerpt shortened here; the source contains the full paragraph.

Previous wording

Any of the previously identified or similar threats could cause a security incident or other interruption that could result in unauthorized, unlawful, or accidental acquisition, modification, destruction, loss, alteration, encryption, disclosure of, or access to our sensitive information, or our technology systems, or those of the third parties upon whom we rely. A security incident or other interruption could disrupt our ability (and that of third parties upon whom we rely) to provide our platform. Any actual or potential security breach of our C3 AI Software, our operational systems, our physical facilities, or the systems or facilities of our partners, or the perception that one has occurred, could result in adverse consequences, such as litigation, indemnity obligations, regulatory enforcement actions, investigations, fines, penalties, mitigation and remediation costs, disputes, reputational harm, diversion of management’s attention, and other liabilities and damage to our business. Even though we do not control the security measures of third parties, we may be perceived or asserted to be responsible for any breach of such measures or suffer reputational harm even where we do not have recourse to the third party that caused the breach. In addition, any failure by our partners to comply with applicable law or regulations could result in proceedings against us by governmental entities or others, with further financial, operational, and reputational damage. While we may be entitled to damages if our third-party service providers fail to satisfy their privacy or security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such award. In addition to experiencing a security incident, third parties may gather, collect, or infer sensitive information about us from public sources, data brokers, or other means that reveals competitively sensitive details about our organization and could be used to undermine our competitive advantage or market position.

Current wording

Any of the previously identified or similar threats could cause a security incident or other interruption that could result in unauthorized, unlawful, or accidental acquisition, modification, destruction, loss, alteration, encryption, disclosure of, or access to our sensitive information, or our technology systems, or those of the third parties with whom we work. A security incident or other interruption could disrupt our ability (and that of third parties with whom we work) to provide our platform. Any actual or potential security breach of our C3 AI Software, our operational systems, our physical facilities, or the systems or facilities of our partners, or the perception that one has occurred, could result in adverse consequences, such as litigation, indemnity obligations, regulatory enforcement actions, investigations, fines, penalties, mitigation and remediation costs, disputes, reputational harm, diversion of management’s attention, and other liabilities and damage to our business. Even though we do not control the security measures of third parties, we may be perceived or asserted to be responsible for any breach of such measures or suffer reputational harm even where we do not have recourse to the third party that caused the breach. In addition, any failure by our partners to comply with applicable law or regulations could result in proceedings against us by governmental entities or others, with further financial, operational, and reputational damage. While we may be entitled to damages if the third parties with whom we work fail to satisfy their privacy or security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such award. In addition to experiencing a security incident, third parties may gather, collect, or infer sensitive information about us from public sources, data brokers, or other means that reveals competitively sensitive details about our organization and could be used to undermine our competitive advantage or market position.

Previous wording

The costs to respond to a security breach and/or to mitigate any security vulnerabilities that may be identified could be significant, our efforts to address these problems may not be successful, and these problems could result in unexpected interruptions, delays, cessation of service, negative publicity, and other harm to our business and our competitive position. We could be required to fundamentally change our business activities and practices in response to a security breach or related regulatory actions or litigation, which could have an adverse effect on our business. In addition, laws, regulations, government guidance, and industry standards and practices in the United States and elsewhere are rapidly evolving to combat these threats. We may face increased compliance burdens regarding such requirements from regulators and customers regarding our products and services and also incur additional costs for oversight and monitoring of security risks relating to our own supply chain. For example, we have contractual and legal obligations to notify relevant stakeholders, including affected individuals, customers, regulators, and investors, of security breaches. Most jurisdictions have enacted laws requiring companies to notify individuals, regulatory authorities, and others of security breaches involving certain types of data, and the disclosure or the failure to comply with such requirements could lead to adverse consequences. In addition, our agreements with certain customers and partners may require us to notify them in the event of a security breach involving customer or partner data on our systems or those of subcontractors processing customer or partner data on our behalf. Such mandatory disclosures are costly, could lead to negative publicity, may cause our customers to lose confidence in the effectiveness of our security measures, and require us to expend significant capital and other resources to respond to or alleviate problems caused by the actual or perceived security breach and may cause us to breach customer contracts. Our agreements with certain customers may require us to use industry-standard, reasonable, or other specified measures to safeguard sensitive personal information or confidential information, and any actual or perceived breach of such measures may increase the likelihood and frequency of customer audits under our agreements, which is likely to increase the costs of doing business. An actual or perceived security breach could lead to claims by our customers, or other relevant stakeholders that we have failed to comply with such legal or contractual obligations. As a result, we could be subject to legal action or our customers could end their relationships with us. There can be no assurance that any limitations of liability in our contracts, which we have in certain agreements, would be enforceable or adequate or would otherwise protect us from liabilities, damages, or claims related to our data privacy and security obl…

Excerpt shortened here; the source contains the full paragraph.

Current wording

The costs to respond to a security breach and/or to mitigate any security vulnerabilities that may be identified could be significant, our efforts to address these problems may not be successful, and these problems could result in unexpected interruptions, delays, cessation of service, negative publicity, and other harm to our business and our competitive position. We could be required to fundamentally change our business activities and practices in response to a security breach or related regulatory actions or litigation, which could have an adverse effect on our business. In addition, laws, regulations, government guidance, and industry standards and practices in the United States and elsewhere are rapidly evolving to combat these threats. We may face increased compliance burdens regarding such requirements from regulators and customers regarding our products and services and also incur additional costs for oversight and monitoring of security risks relating to our own supply chain. For example, we have contractual and legal obligations, or we may voluntarily choose, to notify relevant stakeholders, including affected individuals, customers, regulators, and investors, of security breaches. Most jurisdictions have enacted laws requiring companies to notify individuals, regulatory authorities, and others of security breaches involving certain types of data, and implement other requirements, such as providing credit monitoring and identifying theft protection services. Such disclosures and related actions can be costly, and the disclosures or the failure to comply with such applicable requirements could lead to adverse consequences. In addition, our agreements with certain customers and partners may require us to notify them in the event of a security breach involving customer or partner data on our systems or those of subcontractors processing customer or partner data on our behalf. Such mandatory disclosures are costly, could lead to negative publicity, may cause our customers to lose confidence in the effectiveness of our security measures, and require us to expend significant capital and other resources to respond to or alleviate problems caused by the actual or perceived security breach and may cause us to breach customer contracts. Our agreements with certain customers may require us to use industry-standard, reasonable, or other specified measures to safeguard sensitive personal information or confidential information, and any actual or perceived breach of such measures may increase the likelihood and frequency of customer audits under our agreements, which is likely to increase the costs of doing business. An actual or perceived security breach could lead to claims by our customers, or other relevant stakeholders that we have failed to comply with such legal or contractual obligations. As a result, we could be subject to legal action or our customers could end their relationships with us. There can be no assurance that any limitations of l…

Excerpt shortened here; the source contains the full paragraph.

Previous wording

While we and a number of our vendors and business partners have implemented security measures and designed to protect against security incidents, there can be no assurance that these measures will be effective. We take steps to detect and remediate vulnerabilities in our information security systems (such as our hardware and/ or software, including that of third parties upon which we rely), and ensure the security, privacy, integrity, confidentiality, availability, and authenticity of our information technology networks and systems, processing and information, but we may not be able to anticipate or to implement effective preventive and remedial measures against all data security and privacy threats or detect, mitigate and remediate all vulnerabilities on a timely basis. We cannot guarantee that the recovery systems, security protocols, network protection mechanisms and other security measures that we have integrated into our systems, networks and physical facilities, which are designed to protect against, detect and minimize security breaches and vulnerabilities, or those of our vendors and business partners, will be adequate to prevent or detect service interruption, system failure data loss or theft, or other material adverse consequences. No security solution, strategy, or measures can address all possible security threats or block all methods of penetrating a network or otherwise perpetrating a security incident. The risk of unauthorized circumvention of our security measures or those of our third-party providers, clients and partners has been heightened by advances in computer and software capabilities and the increasing sophistication of hackers who employ complex techniques, including without limitation, the theft or misuse of personal and financial information, counterfeiting, “phishing” or social engineering incidents, ransomware, extortion, publicly announcing security breaches, account takeover attacks, denial or degradation of service attacks, malware, fraudulent payment and identity theft. The techniques used to sabotage, disrupt or to obtain unauthorized access to our C3 AI Software, systems, networks, or physical facilities in which data is stored or through which data is transmitted change frequently, and we may be unable to implement adequate preventative measures or stop security breaches while they are occurring. Unremediated high risk or critical vulnerabilities pose material risks to our business. Further, we may experience delays in developing and deploying remedial measures designed to address any such identified vulnerabilities.

Current wording

While we and a number of our vendors and business partners have implemented security measures and designed to protect against security incidents, there can be no assurance that these measures will be effective. We take steps to detect and remediate vulnerabilities in our information security systems (such as our hardware and/ or software, including that of third parties with whom we work), and ensure the security, privacy, integrity, confidentiality, availability, and authenticity of our information technology networks and systems, processing and information, but we may not be able to anticipate or to implement effective preventive and remedial measures against all data security and privacy threats or detect, mitigate and remediate all vulnerabilities on a timely basis. We cannot guarantee that the recovery systems, security protocols, network protection mechanisms and other security measures that we have integrated into our systems, networks and physical facilities, which are designed to protect against, detect and minimize security breaches and vulnerabilities, or those of our vendors and business partners, will be adequate to prevent or detect service interruption, system failure data loss or theft, or other material adverse consequences. Actions taken by us or the third parties with whom we work to detect, investigate, mitigate, contain, and remediate a security incident could result in outages, data losses, and disruptions of our business. Threat actors may also gain access to other networks and systems after a compromise of our networks and systems. No security solution, strategy, or measures can address all possible security threats or block all methods of penetrating a network or otherwise perpetrating a security incident. The risk of unauthorized circumvention of our security measures or those of the third parties with whom we work, has been heightened by advances in computer and software capabilities and the increasing sophistication of hackers who employ complex techniques, including without limitation, the theft or misuse of personal and financial information, counterfeiting, “phishing” or social engineering incidents, ransomware, extortion, publicly announcing security breaches, account takeover attacks, denial or degradation of service attacks, malware, fraudulent payment and identity theft. The techniques used to sabotage, disrupt or to obtain unauthorized access to our C3 AI Software, systems, networks, or physical facilities in which data is stored or through which data is transmitted change frequently, and we may be unable to implement adequate preventative measures or stop security breaches while they are occurring. Unremediated high risk or critical vulnerabilities pose material risks to our business. It may also be costly to detect, investigate, mitigate, contain, and remediate a security incident. Further, we may experience delays in developing and deploying remedial measures designed to address any such identified vulnerabi…

Excerpt shortened here; the source contains the full paragraph.

Previous wording

If we (or a third party upon whom we rely) experience a security incident or are perceived to have experienced a security incident, we may experience adverse consequences such as government enforcement actions (for example, investigations, fines, penalties, audits, and inspections); additional reporting requirements and/or oversight; restrictions on processing sensitive information (including personal data); litigation (including class claims); indemnification obligations; negative publicity; reputational harm; monetary fund diversions; diversion of management attention; interruptions in our operations (including availability of data); financial loss; and other similar harms. Litigation resulting from security breaches may adversely affect our business. Unauthorized access to our C3 AI Software, systems, networks, or physical facilities could result in litigation with our customers or other relevant stakeholders. These proceedings could force us to spend money in defense or settlement, divert management’s time and attention, increase our costs of doing business, or adversely affect our reputation. We could be required to fundamentally change our business activities and practices or modify our C3 AI Software capabilities in response to such litigation, which could have an adverse effect on our business. If a security breach were to occur, and the confidentiality, integrity or availability of our data or the data of our partners or our customers was disrupted, we could incur significant liability, or our C3 AI Software, systems, or networks may be perceived as less desirable, which could negatively affect our business and damage our reputation.

Current wording

If we (or a third party with whom we work) experience a security incident or are perceived to have experienced a security incident, we may experience adverse consequences such as government enforcement actions (for example, investigations, fines, penalties, audits, and inspections); additional reporting requirements and/or oversight; restrictions on processing sensitive information (including personal data); litigation (including class claims); indemnification obligations; negative publicity; reputational harm; monetary fund diversions; diversion of management attention; interruptions in our operations (including availability of data); financial loss; and other similar harms. Litigation resulting from security breaches may adversely affect our business. Unauthorized access to our C3 AI Software, systems, networks, or physical facilities could result in litigation with our customers or other relevant stakeholders. These proceedings could force us to spend money in defense or settlement, divert management’s time and attention, increase our costs of doing business, or adversely affect our reputation. We could be required to fundamentally change our business activities and practices or modify our C3 AI Software capabilities in response to such litigation, which could have an adverse effect on our business. If a security breach were to occur, and the confidentiality, integrity or availability of our data or the data of our partners or our customers was disrupted, we could incur significant liability, or our C3 AI Software, systems, or networks may be perceived as less desirable, which could negatively affect our business and damage our reputation.

Previous wording

Our business depends on our C3 AI Software to be available without disruption. We have experienced, and may in the future experience, disruptions, outages, defects, and other performance and quality problems with our C3 AI Software. We have also experienced, and may in the future experience, disruptions, outages, defects, and other performance and quality problems with the public cloud and internet infrastructure on which our C3 AI Software relies. These problems can be caused by a variety of factors, including introductions of new functionality, vulnerabilities and defects in proprietary and open source software, human error or misconduct, capacity constraints, design limitations, as well as from internal and external security breaches, malware and viruses, ransomware, cyber events, denial or degradation of service attacks or other security-related incidents.

Current wording

Our business depends on our C3 AI Software to be available without disruption. We and the third parties with whom we work have experienced, or may in the future experience, disruptions, outages, defects, and other performance and quality problems related to our C3 AI Software. We have also experienced, and may in the future experience, disruptions, outages, defects, and other performance and quality problems with the public cloud and internet infrastructure on which our C3 AI Software relies. These problems can be caused by a variety of factors, including introductions of new functionality, vulnerabilities, coding errors, software defects and defects in proprietary and open source software, human error or misconduct, capacity constraints, design limitations, as well as from internal and external security breaches, malware and viruses, ransomware, cyber events, denial or degradation of service attacks or other security-related incidents.

Previous wording

Any disruptions, outages, defects, and other security performance and quality problems with our C3 AI Software or with the public cloud and internet infrastructure on which it relies, or any material change in our contractual and other business relationships with our public cloud providers, could result in reduced use of our C3 AI Software, increased expenses, including significant, unplanned capital investments and/or service credit obligations, and harm to our brand and reputation, any of which could have a material adverse effect on our business, financial condition, reputation and results of operations.

Current wording

Any disruptions, outages, defects, and other security performance and quality problems with our C3 AI Software or with the public cloud, internet infrastructure, or other technology on which it relies, or any material change in our contractual and other business relationships with our public cloud providers, could result in reduced use of our C3 AI Software, increased expenses, including significant, unplanned capital investments and/or service credit obligations, and harm to our brand and reputation, any of which could have a material adverse effect on our business, financial condition, reputation and results of operations.

Previous wording

We rely on third-party service providers to host and deliver our C3 AI Software, and any interruptions or delays in these services could impair our C3 AI Software and harm our business.

Current wording

We utilize third-party service providers to host and deliver our C3 AI Software, and any interruptions or delays in these services could impair our C3 AI Software and harm our business.

Previous wording

We sell to customers globally and have international operations primarily in Europe. As we continue to expand our international operations, we will become more exposed to the effects of fluctuations in currency exchange rates. Although the majority of our cash generated from revenue is denominated in U.S. dollars, a small amount is denominated in foreign currencies, and our expenses are generally denominated in the currencies of the jurisdictions in which we conduct our operations. For the three months ended January 31, 2024 and 2023, 8% and 8% of our revenue, respectively, and for the nine months ended January 31, 2024 and 2023, 6% and 9% of our revenue, respectively, were denominated in currencies other than U.S. dollars. For the three months ended January 31, 2024 and 2023, 8% and 6% of our expenses, respectively, and for the nine months ended January 31, 2024 and 2023, 6% and 5% of our expenses, respectively, were denominated in currencies other than U.S. dollars. Because we conduct business in currencies other than U.S. dollars but report our results of operations in U.S. dollars, we also face remeasurement exposure to fluctuations in currency exchange rates, which could hinder our ability to predict our future results and earnings and could materially impact our results of operations. Therefore, increases in the value of the U.S. dollar and decreases in the value of foreign currencies could result in the dollar equivalent of our revenue being lower. We do not currently maintain a program to hedge exposures to non-U.S. dollar currencies.

Current wording

We sell to customers globally and have international operations primarily in Europe. As we continue to expand our international operations, we will become more exposed to the effects of fluctuations in currency exchange rates. Although the majority of our cash generated from revenue is denominated in U.S. dollars, a small amount is denominated in foreign currencies, and our expenses are generally denominated in the currencies of the jurisdictions in which we conduct our operations. For the three months ended July 31, 2024 and 2023, 8% and 5% of our revenue, respectively were denominated in currencies other than U.S. dollars. For the three months ended July 31, 2024 and 2023, 5% and 5% of our expenses, respectively, were denominated in currencies other than U.S. dollars. Because we conduct business in currencies other than U.S. dollars but report our results of operations in U.S. dollars, we also face remeasurement exposure to fluctuations in currency exchange rates, which could hinder our ability to predict our future results and earnings and could materially impact our results of operations. Therefore, increases in the value of the U.S. dollar and decreases in the value of foreign currencies could result in the dollar equivalent of our revenue being lower. We do not currently maintain a program to hedge exposures to non-U.S. dollar currencies.

Previous wording

AI is enabled by or integrated into some of the C3 AI Platform, including the C3 Generative AI Product, and is a significant and growing element of our business. As with many developing technologies, AI presents risks and challenges that could affect its further development, adoption, and use, and therefore our business. AI algorithms may be flawed. Datasets in AI training, development, or operations may be insufficient, of poor quality, or reflect unwanted forms of bias. Inappropriate or controversial data practices by, or practices reflecting inherent biases of, data scientists, engineers, and end-users of our systems could impair the acceptance of AI solutions. Third-party AI capabilities that can be integrated with our platforms could also produce false or “hallucinatory” inferences about customer data or enterprises, or other information or subject matter. If the recommendations, forecasts, or analyses that AI applications assist in producing are deficient or inaccurate, we could be subjected to competitive harm, potential legal liability, and brand or reputational harm. Some AI scenarios present ethical issues, and the enablement or integration of AI into our platforms may subject us to new or heightened legal, regulatory, ethical, or other challenges.

Current wording

AI is enabled by or integrated into some of the C3 AI Platform, including C3 Generative AI, and is a significant and growing element of our business. As with many developing technologies, AI presents risks and challenges that could affect its further development, adoption, and use, and therefore our business. AI algorithms may be flawed. Datasets in AI training, development, or operations may be insufficient, of poor quality, or reflect unwanted forms of bias. Inappropriate or controversial data practices by, or practices reflecting inherent biases of, data scientists, engineers, and end users of our systems could impair the acceptance of AI solutions. Third-party AI capabilities that can be integrated with our platforms could also produce false or “hallucinatory” inferences about customer data or enterprises, or other information or subject matter. If the recommendations, forecasts, or analyses that AI applications assist in producing are deficient or inaccurate, we could be subjected to competitive harm, potential legal liability, and brand or reputational harm. Some AI scenarios present ethical issues, and the enablement or integration of AI into our platforms may subject us to new or heightened legal, regulatory, ethical, or other challenges.

Previous wording

We have Customer-Entities in more than 15 countries, and 15% of our revenue for the nine months ended January 31, 2024 was generated from customers outside of North America. As of January 31, 2024, we had ten international sales locations, and we plan to add local sales support in further select international markets over time. We expect to continue to expand our international operations, which may include opening offices in new jurisdictions and providing our C3 AI Software in additional languages. Any new markets or countries into which we attempt to sell subscriptions to our C3 AI Software may not be receptive. For example, we may not be able to expand further in some markets if we are not able to satisfy certain government- and industry-specific requirements. In addition, our ability to manage our business and conduct our operations internationally in the future may require considerable management attention and resources and is subject to the particular challenges of supporting a rapidly growing business in an environment of multiple languages, cultures, customs, legal and regulatory systems, alternative dispute systems, and commercial markets. Future international expansion will require investment of significant funds and other resources. Operating internationally subjects us to new risks and may increase risks that we currently face, including risks associated with:

Current wording

We have Customer-Entities in more than 15 countries, and 12% of our revenue for the three months ended July 31, 2024 was generated from customers outside of North America. As of July 31, 2024, we had ten international sales locations, and we plan to add local sales support in further select international markets over time. We expect to continue to expand our international operations, which may include opening offices in new jurisdictions and providing our C3 AI Software in additional languages. Any new markets or countries into which we attempt to sell subscriptions to our C3 AI Software may not be receptive. For example, we may not be able to expand further in some markets if we are not able to satisfy certain government- and industry-specific requirements. In addition, our ability to manage our business and conduct our operations internationally in the future may require considerable management attention and resources and is subject to the particular challenges of supporting a rapidly growing business in an environment of multiple languages, cultures, customs, legal and regulatory systems, alternative dispute systems, and commercial markets. Future international expansion will require investment of significant funds and other resources. Operating internationally subjects us to new risks and may increase risks that we currently face, including risks associated with:

Previous wording

•pandemics, like the COVID-19 pandemic, or epidemics that could result in decreased economic activity in certain markets, decreased use of our C3 AI Software, or in our decreased ability to import, export, or sell our C3 AI Software to existing or new customers in international markets;

Current wording

•pandemics or epidemics that could result in decreased economic activity in certain markets, decreased use of our C3 AI Software, or in our decreased ability to import, export, or sell our C3 AI Software to existing or new customers in international markets;

Previous wording

Further, due to political uncertainty and military actions involving Russia, Ukraine, and surrounding regions, we and the third parties upon which we rely may be vulnerable to a heightened risk of security breaches, computer malware, social-engineering attacks, supply-chain attacks, software bugs, server malfunctions, software or hardware failures, loss of data or other information technology assets, and other cyber-attacks, including attacks that could materially disrupt our systems and operations, supply chain, and ability to produce, sell and distribute our C3 AI Software. These attacks are expected to occur in the future.

Current wording

Further, due to political uncertainty and military actions involving Russia, Ukraine, and surrounding regions, we and the third parties with whom we work may be vulnerable to a heightened risk of security breaches, computer malware, social-engineering attacks, supply-chain attacks, software bugs, server malfunctions, software or hardware failures, loss of data or other information technology assets, and other cyber-attacks, including attacks that could materially disrupt our systems and operations, supply chain, and ability to produce, sell and distribute our C3 AI Software. These attacks are expected to occur in the future.

Previous wording

As of April 30, 2023, we had net operating loss carryforwards, or NOLs, for U.S. federal and state purposes of $487.6 million and $187.8 million, respectively, which may be available to offset taxable income in the future, and portions of which expire in various years beginning in 2029. A lack of future taxable income would adversely affect our ability to utilize these NOLs before they expire. Under the Tax Cuts and Jobs Act of 2017, or the Tax Act, as modified by the Coronavirus Aid, Relief, and Economic Security Act, or CARES Act, federal NOLs incurred in tax years beginning after December 31, 2017 may be carried forward indefinitely, but the deductibility of such federal NOLs in tax years beginning after December 31, 2020 is limited to 80% of taxable income. It is uncertain if and to what extent various states will conform to the Tax Act or the CARES Act. In addition, under Section 382 of the Internal Revenue Code of 1986, as amended, or the Code, a corporation that undergoes an “ownership change” (as defined under Sections 382 and 383 of the Code and applicable Treasury Regulations) is subject to limitations on its ability to utilize its pre-change NOLs and certain other tax attributes to offset post-change taxable income or taxes. We may experience a future ownership change under Section 382 of the Code that could affect our ability to utilize our NOLs to offset our income. Furthermore, our ability to utilize NOLs of companies that we have acquired or may acquire in the future may be subject to limitations. In addition, at the state level, there may be periods during which the use of NOLs is suspended or otherwise limited, which could accelerate or permanently increase state taxes owed. For example, on June 29, 2020, the Governor of California signed into law the 2020 Budget Act which temporarily suspended the utilization of NOLs and limits the utilization of research credits to $5.0 million annually for 2020, 2021, and 2022. For these reasons, we may not be able to utilize a material portion of the NOLs reflected on our balance sheet, even if we attain profitability, which could potentially result in increased future tax liability to us and could adversely affect our operating results and financial condition.

Current wording

As of April 30, 2024, we had net operating loss carryforwards, or NOLs, for U.S. federal and state purposes of $599.3 million and $249.3 million, respectively, which may be available to offset taxable income in the future, and portions of which expire in various years beginning in 2029. A lack of future taxable income would adversely affect our ability to utilize these NOLs before they expire. Under the Tax Cuts and Jobs Act of 2017, or the Tax Act, as modified by the Coronavirus Aid, Relief, and Economic Security Act, or CARES Act, federal NOLs incurred in tax years beginning after December 31, 2017 may be carried forward indefinitely, but the deductibility of such federal NOLs in tax years beginning after December 31, 2020 is limited to 80% of taxable income. It is uncertain if and to what extent various states will conform to the Tax Act or the CARES Act. In addition, under Section 382 of the Internal Revenue Code of 1986, as amended, or the Code, a corporation that undergoes an “ownership change” (as defined under Sections 382 and 383 of the Code and applicable Treasury Regulations) is subject to limitations on its ability to utilize its pre-change NOLs and certain other tax attributes to offset post-change taxable income or taxes. We may experience a future ownership change under Section 382 of the Code that could affect our ability to utilize our NOLs to offset our income. Furthermore, our ability to utilize NOLs of companies that we have acquired or may acquire in the future may be subject to limitations. In addition, at the state level, there may be periods during which the use of NOLs is suspended or otherwise limited, which could accelerate or permanently increase state taxes owed. For example, on June 29, 2020, the Governor of California signed into law the 2020 Budget Act which temporarily suspended the utilization of NOLs and limits the utilization of research credits to $5.0 million annually for 2020, 2021, and 2022. For these reasons, we may not be able to utilize a material portion of the NOLs reflected on our balance sheet, even if we attain profitability, which could potentially result in increased future tax liability to us and could adversely affect our operating results and financial condition.

Previous wording

As of January 31, 2024, our technology is protected by a broad patent portfolio, with 22 issued patents in the United States, 12 issued counterpart patents in a number of international jurisdictions, over 50 patent applications pending in the United States, and 85 patent applications pending internationally. Our issued patents expire beginning in 2033 through 2040. We continually review our development efforts to assess the existence and patentability of new intellectual property. The pending patent applications are presently undergoing examination or expected to undergo examination in the near future. These patents and patent applications seek to protect our proprietary inventions relevant to our business, in addition to other proprietary technologies which are maintained as trade secrets. We intend to pursue additional intellectual property protection to the extent we believe it would be beneficial and cost-effective. We make business decisions about when to seek patent protection for a particular technology and when to rely upon copyright or trade secret protection, and the approach we select may ultimately prove to be inadequate. Even in cases where we seek patent protection, there is no assurance that the resulting patents will effectively protect every significant feature of our C3 AI Software. In addition, we believe that the protection of our trademark rights is an important factor in AI platform and application recognition, protecting our brand and maintaining goodwill. If we do not adequately protect our rights in our trademarks from infringement and unauthorized use, any goodwill that we have developed in those trademarks could be lost or impaired, which could harm our brand and our business. Third parties may knowingly or unknowingly infringe our proprietary rights, third parties may challenge our proprietary rights, pending and future patent, trademark and copyright applications may not be approved, and we may not be able to defend against or prevent infringement without incurring substantial expense. We have also devoted substantial resources to the development of our proprietary technologies and related processes. In order to protect our proprietary technologies and processes, we rely in part on trade secret laws and confidentiality agreements with our employees, consultants, and third parties. These agreements may not effectively prevent unauthorized disclosure of confidential information and may not provide an adequate remedy in the event of unauthorized disclosure of confidential information. In addition, others may independently discover our trade secrets, in which case we would not be able to assert trade secret rights or develop similar technologies and processes. Further, laws in certain jurisdictions may afford little or no trade secret protection, and any changes in, or unexpected interpretations of, the intellectual property laws in any country in which we operate may compromise our ability to enforce our intellectual pro…

Excerpt shortened here; the source contains the full paragraph.

Current wording

As of July 31, 2024, our technology is protected by a broad patent portfolio, with 23 issued patents in the United States, 12 issued counterpart patents in a number of international jurisdictions, over 50 patent applications pending in the United States, and 90 patent applications pending internationally. Our issued patents expire beginning in 2033 through 2040. We continually review our development efforts to assess the existence and patentability of new intellectual property. The pending patent applications are presently undergoing examination or expected to undergo examination in the near future. These patents and patent applications seek to protect our proprietary inventions relevant to our business, in addition to other proprietary technologies which are maintained as trade secrets. We intend to pursue additional intellectual property protection to the extent we believe it would be beneficial and cost-effective. We make business decisions about when to seek patent protection for a particular technology and when to rely upon copyright or trade secret protection, and the approach we select may ultimately prove to be inadequate. Even in cases where we seek patent protection, there is no assurance that the resulting patents will effectively protect every significant feature of our C3 AI Software. In addition, we believe that the protection of our trademark rights is an important factor in AI platform and application recognition, protecting our brand and maintaining goodwill. If we do not adequately protect our rights in our trademarks from infringement and unauthorized use, any goodwill that we have developed in those trademarks could be lost or impaired, which could harm our brand and our business. Third parties may knowingly or unknowingly infringe our proprietary rights, third parties may challenge our proprietary rights, pending and future patent, trademark and copyright applications may not be approved, and we may not be able to defend against or prevent infringement without incurring substantial expense. We have also devoted substantial resources to the development of our proprietary technologies and related processes. In order to protect our proprietary technologies and processes, we rely in part on trade secret laws and confidentiality agreements with our employees, consultants, and third parties. These agreements may not effectively prevent unauthorized disclosure of confidential information and may not provide an adequate remedy in the event of unauthorized disclosure of confidential information. In addition, others may independently discover our trade secrets, in which case we would not be able to assert trade secret rights or develop similar technologies and processes. Further, laws in certain jurisdictions may afford little or no trade secret protection, and any changes in, or unexpected interpretations of, the intellectual property laws in any country in which we operate may compromise our ability to enforce our intellectual proper…

Excerpt shortened here; the source contains the full paragraph.

Previous wording

Components of our C3 AI Software have been provided under the Apache License 2.0. This license states that any work of authorship licensed under it, and any derivative work thereof, may be reproduced and distributed provided that certain conditions are met. It is possible that a court would hold this license to be unenforceable or that someone could assert a claim for proprietary rights in a program developed and distributed under it. Any ruling by a court that this license is not enforceable, or that we may not reproduce or distribute those open source software components as part of our C3 AI Software, may negatively impact our distribution or development of all or a portion of our solutions. In addition, at some time in the future it is possible that the license terms under which important components of the open source projects in our C3 AI Software is distributed may be modified, which could, among other consequences, negatively impact our continuing development or distribution of the software code subject to the new or modified license.

Current wording

Components of our C3 AI Software have been provided under the Apache License 2.0. This license states that any work of authorship licensed under it, and any derivative work thereof, may be reproduced and distributed provided that certain conditions are met. It is possible that a court would hold this license to be unenforceable or that someone could assert a claim for proprietary rights in a program developed and distributed under it. Any ruling by a court that this license is not enforceable, or that we may not reproduce or distribute those open source software components as part of our C3 AI Software, may negatively impact our distribution or development of all or a portion of our solutions. In addition, at some time in the future it is possible that the license terms under which important components of the open source projects in our C3 AI Software are distributed may be modified, which could, among other consequences, negatively impact our continuing development or distribution of the software code subject to the new or modified license.

Previous wording

Short selling is the practice of selling securities that the seller does not own but rather has borrowed or intends to borrow from a third party with the intention of later buying lower priced identical securities to return to the lender. Accordingly, it is in the interest of a short seller of our Class A common stock for the price to decline. At any time, short sellers may publish, or arrange for the publication of, opinions or characterizations that are intended to create negative market momentum. Issuers, like us, whose securities have historically had limited trading history or volumes and/or have been susceptible to relatively high volatility levels can be vulnerable to such short seller attacks. Short selling reports can cause increased volatility in an issuer’s stock price, and result in regulatory and governmental inquiries. On April 4, 2023, a short seller report was published which contained certain allegations against us. Any inquiry or formal investigation from a governmental organization or other regulatory body, including any inquiry from the SEC or the U.S. Department of Justice, could result in a material diversion of our management’s time and could have a material adverse effect on our business and results of operations.

Current wording

Short selling is the practice of selling securities that the seller does not own but rather has borrowed or intends to borrow from a third party with the intention of later buying lower priced identical securities to return to the lender. Accordingly, it is in the interest of a short seller of our Class A common stock for the price to decline. At any time, short sellers may publish, or arrange for the publication of, opinions or characterizations that are intended to create negative market momentum. Issuers, like us, whose securities have historically had limited trading history or volumes and/or have been susceptible to relatively high volatility levels can be vulnerable to such short seller attacks. Short selling reports can cause increased volatility in an issuer’s stock price, and result in regulatory and governmental inquiries. For example, on April 4, 2023, a short seller report was published which contained certain allegations against us. Any inquiry or formal investigation from a governmental organization or other regulatory body, including any inquiry from the SEC or the U.S. Department of Justice, could result in a material diversion of our management’s time and could have a material adverse effect on our business and results of operations.

Previous wording

Our Class B common stock has 50 votes per share, and our Class A common stock has one vote per share. As of January 31, 2024, Mr. Siebel and related entities beneficially owned approximately 87.8% of our Class B common stock and approximately 21.5% of our outstanding Class A common stock, resulting in beneficial ownership of capital stock representing approximately 54.8% of the voting power of our outstanding capital stock. Therefore, Mr. Siebel has control over our management and affairs and over all matters requiring stockholder approval, including election of directors and significant corporate transactions, such as a merger or other sale of us or our assets. This concentrated control will limit your ability to influence corporate matters for the foreseeable future, and, as a result, the market price of our Class A common stock could be adversely affected.

Current wording

Our Class B common stock has 50 votes per share, and our Class A common stock has one vote per share. As of July 31, 2024, Mr. Siebel and related entities beneficially owned approximately 87.8% of our Class B common stock and approximately 20.9% of our outstanding Class A common stock, resulting in beneficial ownership of capital stock representing approximately 54.0% of the voting power of our outstanding capital stock. Therefore, Mr. Siebel has control over our management and affairs and over all matters requiring stockholder approval, including election of directors and significant corporate transactions, such as a merger or other sale of us or our assets. This concentrated control will limit your ability to influence corporate matters for the foreseeable future, and, as a result, the market price of our Class A common stock could be adversely affected.

Previous wording

As of January 31, 2024, there were outstanding options to purchase an aggregate of approximately 32,000,000 shares of our Class A common stock, and approximately 21,000,000 shares of our Class A common stock subject to restricted stock unit awards. We have registered all of the shares of Class A common stock issuable upon exercise of outstanding options and upon exercise or settlement of any options or other equity incentives we may grant in the future for public resale under the Securities Act. Accordingly, these shares will become eligible for sale in the public market to the extent any such equity awards are exercised or settled for shares of Class A common stock, subject to compliance with applicable securities laws. In addition, certain of our stockholders have registration rights that would require us to register shares owned by them for public sale in the United States.

Current wording

As of July 31, 2024, there were outstanding options to purchase an aggregate of approximately 30,614,000 shares of our Class A common stock, and approximately 20,464,000 shares of our Class A common stock subject to restricted stock unit awards. We have registered all of the shares of Class A common stock issuable upon exercise of outstanding options and upon exercise or settlement of any options or other equity incentives we may grant in the future for public resale under the Securities Act. Accordingly, these shares will become eligible for sale in the public market to the extent any such equity awards are exercised or settled for shares of Class A common stock, subject to compliance with applicable securities laws. In addition, certain of our stockholders have registration rights that would require us to register shares owned by them for public sale in the United States.

Previous wording

From time to time, we are involved in legal proceedings and claims that arise in the ordinary course of business, such as claims brought by our customers in connection with commercial or intellectual property disputes or employment claims made by our current or former employees. Litigation might result in substantial costs and may divert management’s attention and resources, which might seriously harm our business, financial condition, and results of operations. Insurance might not cover such claims, might not provide sufficient payments to cover all the costs to resolve one or more such claims, and might not continue to be available on terms acceptable to us (including premium increases or the imposition of large deductible or co-insurance requirements). A claim brought against us that is uninsured or underinsured could result in unanticipated costs, potentially harming our business, financial position, and results of operations. In addition, we cannot be sure that our existing insurance coverage and coverage for errors and omissions will continue to be available on acceptable terms or that our insurers will not deny coverage as to any future claim.

Current wording

From time to time, we are involved in legal proceedings and claims that arise in the ordinary course of business, such as claims brought by our customers in connection with commercial or intellectual property disputes or employment claims made by our current or former employees. Litigation might result in substantial costs and may divert management’s attention and resources, which might seriously harm our business, financial condition, and results of operations. Insurance might not cover such claims, might not provide sufficient payments to cover all the costs to resolve one or more such claims, and might not continue to be available on terms acceptable to us (including premium increases or the imposition of large deductible or co-insurance requirements). A claim brought against us that is uninsured or under insured could result in unanticipated costs, potentially harming our business, financial position, and results of operations. In addition, we cannot be sure that our existing insurance coverage and coverage for errors and omissions will continue to be available on acceptable terms or that our insurers will not deny coverage as to any future claim.

Previous wording

Occurrence of any catastrophic event, including earthquake, fire, flood, tsunami, or other weather event (many of which are becoming more acute and frequent as a result of global climate change), power loss, telecommunications failure, software or hardware malfunctions, pandemics (such as the COVID-19 pandemic), political unrest, geopolitical instability, cyberattack, war, or terrorist attack, could result in lengthy interruptions in our service. In particular, our U.S. headquarters are located in the San Francisco Bay Area, a region known for seismic activity and wildfires, and our insurance coverage may not compensate us for losses that may occur in the event of an earthquake or other significant natural disaster. In addition, acts of terrorism could cause disruptions to the internet or the economy as a whole. Even with our disaster recovery arrangements, our service could be interrupted. If our systems were to fail or be negatively impacted as a result of a natural disaster or other event, our ability to deliver our C3 AI Software to our customers would be impaired, or we could lose critical data. If we are unable to develop adequate plans to ensure that our business functions continue to operate during and after a disaster and to execute successfully on those plans in the event of a disaster or emergency, our business would be harmed.

Current wording

Occurrence of any catastrophic event, including earthquake, fire, flood, tsunami, or other weather event (many of which are becoming more acute and frequent as a result of global climate change), power loss, telecommunications failure, software or hardware malfunctions, political unrest, geopolitical instability, cyberattack, war, or terrorist attack, could result in lengthy interruptions in our service. In particular, our U.S. headquarters are located in the San Francisco Bay Area, a region known for seismic activity and wildfires, and our insurance coverage may not compensate us for losses that may occur in the event of an earthquake or other significant natural disaster. In addition, acts of terrorism could cause disruptions to the internet or the economy as a whole. Even with our disaster recovery arrangements, our service could be interrupted. If our systems were to fail or be negatively impacted as a result of a natural disaster or other event, our ability to deliver our C3 AI Software to our customers would be impaired, or we could lose critical data. If we are unable to develop adequate plans to ensure that our business functions continue to operate during and after a disaster and to execute successfully on those plans in the event of a disaster or emergency, our business would be harmed.