Evolv Technologies Holdings, Inc.

Previous wording

We are and may in the future be subject to legal proceedings, claims and investigations in or outside the ordinary course of business. Such proceedings, claims and investigations could be costly and time-consuming to defend and could result in unfavorable outcomes, which may have a material adverse effect on our business, operating results and financial condition, and negatively affect the price of our common stock.

Current wording

•We are and may in the future be subject to legal proceedings, claims and investigations.

Previous wording

Further, many federal, state, and foreign government bodies and agencies have introduced, and are currently considering, additional laws and regulations, including related to the development and integration of artificial intelligence (“AI”), machine learning, and additional emerging data technologies while mitigating or controlling for bias and discrimination in the context of AI and machine learning. For example, in the United States, an executive order was issued in October 2023 on the Safe, Secure and Trustworthy Development and Use of AI, emphasizing the need for transparency, accountability and fairness in the development and use of AI. The order seeks to balance innovation with addressing risks associated with AI by providing eight guiding principles and priorities, such as ensuring that consumers are protected from fraud, discrimination and privacy risks related to AI. Legislation has also been promulgated on the state level. For example, the California Privacy Protection Agency is currently in the process of finalizing regulations under the CCPA regarding the use of automated decision making. In addition, in Europe the European Commission proposed a regulation seeking to establish a comprehensive, risk-based governance framework for AI in the EU market, the EU AI Act, which was politically agreed to in December 2023. It is intended to apply to companies that develop, use and/or provide AI in the EU and includes requirements around transparency, conformity assessments and monitoring, risk assessments, human oversight, security and accuracy and introduces significant fines for noncompliance. There are also specific rules on the use of automated decision making under the GDPR that provide the data subject the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her. Additionally, the existence of automated decision making must be disclosed to the data subject with a meaningful explanation of the logic used in such decision making in certain circumstances and safeguards must be implemented to safeguard individual rights, including the right to obtain human intervention and to contest any decision. If passed, we will likely incur additional expenses and costs associated with complying with such laws, as well as face heightened potential liability if we are unable to comply with these laws. While we minimize any physical bias in our product’s identification of threats because the product’s AI does not process or analyze an individual's physical characteristics, we may not be able to identify such issues in advance, or if identified, we may not be able to identify mechanisms for effectively mitigating such issues.

Current wording

In particular, many U.S. federal, state, and foreign government bodies and agencies have introduced, and are currently considering, additional laws and regulations, including related to the development and integration of AI, machine learning, and additional emerging data technologies while mitigating or controlling for bias and discrimination in the context of AI and machine learning. For example, the California Privacy Protection Agency is currently in the process of finalizing regulations under the California Consumer Privacy Act (as amended by the California Privacy Rights Act) (“CCPA”), regarding the use of automated decision making, which focuses on notice and transparency requirements, opt-out and access rights and performance of risk assessments. Additionally, Colorado and California have recently passed legislation, and legislation is pending in Virginia, that, among other obligations, will require disclosure and transparency obligations with respect to certain AI systems. Furthermore, in Europe, the Artificial Intelligence Act (“EU AI Act”), which entered into force on August 1, 2024, provides rights and duties designed to ensure the safe and ethical deployment of AI. The EU AI Act categorizes AI systems based on their level of risk, prohibiting certain uses of AI (which provisions applied as of February 2, 2025), and introduces strict requirements for high-risk AI applications (which provisions apply from August 2, 2027). It is intended to apply to companies that develop, use and/or provide AI in the EU and includes requirements around transparency, conformity assessments and monitoring, risk assessments, human oversight, security and accuracy and introduces significant fines for noncompliance. There are also specific rules on the use of automated decision making under the General Data Protection Regulation (“GDPR”) that provide the data subject the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her. Additionally, the existence of automated decision making must be disclosed to the data subject with a meaningful explanation of the logic used in such decision making in certain circumstances and safeguards must be implemented to safeguard individual rights, including the right to obtain human intervention and to contest any decision. We will likely incur additional expenses and costs associated with complying with existing and evolving laws, as well as face heightened potential liability if we are unable to comply with such laws. While we strive to minimize any physical bias in our product’s identification of threats because our product’s AI does not process or analyze an individual’s physical characteristics, we may not be able to identify such issues in advance, or if identified, we may not be able to identify mechanisms for effectively mitigating such issues.

Previous wording

We, our reseller partners, and our customers are subject to a number of domestic and international laws and regulations that apply to cloud services and the internet generally. These laws, rules, and regulations address a range of issues including data privacy and cyber security, breach notification and restrictions or technological requirements regarding the collection, use, storage, protection, disclosure, retention, transfer, or other processing of data. The regulatory framework for online services, data privacy and cyber security issues worldwide can vary substantially from jurisdiction to jurisdiction, is rapidly evolving and is likely to remain uncertain for the foreseeable future. Many federal, state, local, and foreign government bodies and agencies have adopted or are considering adopting laws, rules and regulations regarding the collection, use, storage, disclosure and other processing of information, web browsing and geolocation data collection, data analytics, facial recognition, cyber security, and breach response and notification procedures. Furthermore, new laws and regulations that apply to our business are being introduced at every level of government in the United States, as well as internationally. As we seek to expand our business, we are, and may increasingly become subject to various laws, regulations, and standards, and may be subject to contractual obligations relating to data privacy and security in the jurisdictions in which we operate.

Current wording

We, our reseller partners, and our customers are subject to a number of domestic and international laws and regulations that apply to the processing of certain types of information as well as cloud services and the internet generally. These laws, rules, and regulations address a range of issues including data privacy and cyber security, breach notification and restrictions or technological requirements regarding the processing of personal data. The regulatory framework for online services, data privacy and cybersecurity issues worldwide can vary substantially from jurisdiction to jurisdiction, is rapidly evolving and is likely to remain uncertain for the foreseeable future. New laws and regulations that apply to our business are being introduced at every level of government in the United States, as well as internationally. As we seek to expand our business, we are, and may increasingly become subject to various laws, regulations, and standards in the jurisdictions in which we operate, and may be subject to contractual obligations relating to data privacy and security in the jurisdictions in which we operate.

Previous wording

For example, in the United States, there are numerous federal and state data privacy and security laws, rules, and regulations governing the collection, use, disclosure, retention, security, transfer, storage, and other processing of personal information, including federal and state data privacy laws, data breach notification laws, and consumer protection laws. The FTC and many state attorneys general are interpreting federal and state consumer protection laws to impose standards for the online collection, use, dissemination, and security of data. Such standards require us to publish statements that describe how we handle personal data and choices individuals may have about the way we handle their personal data. If such information that we publish is considered untrue or inaccurate, we may be subject to government claims of unfair or deceptive trade practices, which could lead to significant liabilities and consequences. Moreover, according to the FTC, violating consumers’ privacy rights or failing to take appropriate steps to keep consumers’ personal data secure may constitute unfair acts or practices in or affecting commerce in violation of Section 5(a) of the Federal Trade Commission Act. State consumer protection laws provide similar causes of action for unfair or deceptive practices.

Current wording

For example, in the United States, there are numerous data privacy and security laws, rules, and regulations governing the collection, use, disclosure, retention, security, transfer, storage, and other processing of personal data (as defined in such laws), including state data privacy laws, state data breach notification laws, and federal and state consumer protection laws. The U.S. Federal Trade Commission ("FTC") and many state attorneys general are interpreting federal and state consumer protection laws to impose standards for the online collection, use, dissemination, and security of data. Such standards require us to publish statements that describe how we handle personal data and choices individuals may have about the way we handle their personal data. If such information that we publish is considered untrue or inaccurate, we may be subject to claims of unfair or deceptive trade practices, which could lead to significant liabilities and consequences. Moreover, according to the FTC, violating consumers’ privacy rights or failing to take appropriate steps to keep consumers’ personal data secure may constitute unfair or deceptive acts or practices in or affecting commerce in violation of Section 5(a) of the Federal Trade Commission Act. State consumer protection laws provide similar causes of action for unfair or deceptive practices.

Previous wording

Further, some laws may require us to notify governmental authorities and/or affected individuals of data breaches involving certain personal information or other unauthorized or inadvertent access to or disclosure of such information. We may need to notify governmental authorities and affected individuals with respect to such incidents. For example, laws in all 50 U.S. states may require businesses to provide notice to consumers whose personal information has been disclosed as a result of a data breach. These laws are not consistent, and compliance in the event of a widespread data breach may be difficult and costly. We also may be contractually required to notify consumers or other counterparties of a security breach. Regardless of our contractual protections, any actual or perceived security breach or breach of our contractual obligations could harm our reputation and brand, expose us to potential liability or require us to expend significant resources on data security and in responding to any such actual or perceived breach.

Current wording

Further, some laws may require us to notify governmental authorities and/or affected individuals of data breaches involving certain personal data or other unauthorized or inadvertent access to or disclosure of such information. For example, laws in all 50 U.S. states may require businesses to provide notice to consumers whose personal data has been disclosed as a result of a data breach. These laws are not consistent, and compliance in the event of a widespread data breach may be difficult and costly. Any actual or perceived security breach could harm our reputation and brand, expose us to potential liability or require us to expend significant resources.

Previous wording

Internationally, virtually every jurisdiction in which we operate has customers and/or have prospective customers to which we market has established its own data security and privacy legal frameworks with which we, our reseller partners or our customers must comply.

Current wording

Internationally, virtually every jurisdiction in which we operate, have customers or have prospective customers has established its own data security and privacy legal frameworks with which we, our reseller partners or our customers must comply.

Previous wording

For example, in the European Union, the General Data Protection Regulation 2016/679 (“GDPR”) imposes requirements on controllers and processors of personal data, including, for example, higher standards for obtaining consent from individuals to process their personal data, more robust disclosures to individuals, a strong individual rights regime, shortened timelines for data breach notifications and restrictions on the transfer of personal data outside of the European Economic Area. Following its departure from the European Union, the United Kingdom has adopted a separate regime based on the GDPR (“UK GDPR”) that imposes similarly onerous requirements. Companies that violate the EU or UK regime can face regulatory investigations, private litigation, prohibitions on data processing, and fines of up to the greater of 4% of their worldwide annual revenue or 20 million Euros (for the EU) or £17.5 million (for the U.K.). Other EU and UK data protection laws and evolving regulatory guidance restrict the ability of companies to market electronically, including through the use of cookies and similar technologies, and companies are increasingly subject to strict enforcement action including fines for noncompliance.

Current wording

For example, in the European Union, the GDPR imposes requirements on controllers and processors of personal data, including, for example, higher standards for obtaining consent from individuals to process their personal data, more robust disclosures to individuals, a strong individual rights regime, shortened timelines for data breach notifications and restrictions on the transfer of personal data outside of the European Economic Area. Following its departure from the European Union, the United Kingdom has adopted a separate regime based on the GDPR (“UK GDPR”) that imposes similarly onerous requirements. Companies that violate the EU or UK regime can face regulatory investigations, private litigation, prohibitions on data processing, and fines. Other EU and UK data protection laws and evolving regulatory guidance restrict the ability of companies to market electronically, including through the use of cookies and similar technologies, and companies are increasingly subject to strict enforcement action including fines for noncompliance.

Previous wording

We strive to comply with all applicable laws, policies, legal obligations, and industry codes of conduct relating to privacy and data protection to the extent possible. Because the interpretation and application of privacy and data protection laws are still uncertain, it is possible that these laws may be interpreted and applied in a manner that is inconsistent from one jurisdiction to another or with our existing practices or the features of our products and may conflict with other rules or regulations, making enforcement, and thus compliance requirements, ambiguous, uncertain, and potentially inconsistent. Any significant change to applicable laws, regulations or industry practices, or how each is interpreted, regarding the use or disclosure of personal information, or regarding the manner in which the express or implied consent of customers for the use and disclosure of personal information is obtained, could require us to modify our products and features, possibly in a material manner and subject to increased compliance costs, which may limit our ability to develop new products and features that make use of the personal information that our customers voluntarily share. Any failure or perceived failure by us to comply with our privacy policies, privacy-related obligations to customers or other third parties, or our privacy-related legal obligations, or any compromise of security that results in the unauthorized access to or unintended release of personally identifiable information or other customer data, may result in governmental enforcement actions, litigation, or public statements against us by consumer advocacy groups or others. Any of these events could cause us to incur significant costs in investigating and defending such claims and, if found liable, pay significant damages. Further, these proceedings and any subsequent adverse outcomes may cause our customers to lose trust in us, which could have an adverse effect on our reputation and business.

Current wording

We strive to comply with all applicable laws, policies, legal obligations relating to privacy and data protection to the extent possible. Because the interpretation and application of privacy and data protection laws are still uncertain, it is possible that these laws may be interpreted and applied in a manner that is inconsistent from one jurisdiction to another, and which makes our compliance requirements and the enforcement of those requirements ambiguous, uncertain, and potentially inconsistent. Any significant change to applicable laws, regulations or industry practices, or how each is interpreted, regarding the use or disclosure of personal data, or regarding the manner in which the express or implied consent of customers for the use and disclosure of personal data is obtained, could require us to modify our products and features, possibly in a material manner and subject to increased compliance costs, which may limit our ability to develop new products and features that make use of the personal data that our customers voluntarily share. Any failure or perceived failure by us to comply with our privacy policies, privacy-related obligations to customers or other third parties, or our privacy-related legal obligations, or any compromise of security that results in the unauthorized access to or unintended release or access of personal data or other customer data, may result in governmental enforcement actions, litigation, or public statements against us by consumer advocacy groups or others. Any of these events could cause us to incur significant costs in investigating and defending such claims and, if found liable, pay significant fines or damages. Further, these proceedings and any subsequent adverse outcomes may cause our customers to lose trust in us, which could have an adverse effect on our reputation and business.

Previous wording

We may also be subject to claims of liability or responsibility for the actions of third parties with whom we interact or upon whom it relies in relation to various products, including but not limited to vendors and business partners. If so, in addition to the possibility of fines, lawsuits and other claims, we could be required to fundamentally change our business activities and practices or modify our products, which could have an adverse effect on our business. Any inability to adequately address privacy and/or data concerns, even if unfounded, or comply with applicable privacy or data protection laws, regulations, and policies, could result in additional cost and liability to us, damage our reputation, inhibit sales and adversely affect our business.

Current wording

We may also be subject to claims of liability or responsibility for the actions of third parties with whom we interact or upon whom we rely in relation to various products, including but not limited to vendors and business partners. If so, in addition to the possibility of fines, lawsuits and other claims, we could be required to fundamentally change our business activities and practices or modify our products, which could have an adverse effect on our business. Any inability to adequately address privacy and/or data concerns, even if unfounded, or comply with applicable privacy or data protection laws, regulations, and policies, could result in additional cost and liability to us, damage our reputation, inhibit sales and adversely affect our business.

Previous wording

The costs of compliance with, and other burdens imposed by, the laws, rules, regulations, and policies that are applicable to the businesses of our customers may limit the use and adoption of, and reduce the overall demand for, our software. Even the perception of privacy or discrimination concerns, whether or not valid, may harm our reputation, inhibit adoption of our products by current and future customers, or adversely impact our ability to attract and retain workforce talent. Our failure to comply with applicable laws and regulations, or to protect such data, could result in enforcement action against us, including fines, imprisonment of company officials and public censure, claims for damages by customers and other affected individuals, damage to our reputation and loss of goodwill (both in relation to existing customers and prospective customers), any of which could have a material adverse effect on our operations, financial performance and business. We may also have costs associated with engaging with stakeholders, including investors, insurance providers, and other capital providers, on such issues.

Current wording

The costs of compliance with, and other burdens imposed by, the laws, rules, regulations, and policies that are applicable to the businesses of our customers may limit the use and adoption of, and reduce the overall demand for, our product. Even the perception of privacy or discrimination concerns, whether or not valid, may harm our reputation, inhibit adoption of our products by current and future customers, or adversely impact our ability to attract and retain workforce talent. Our failure to comply with applicable laws and regulations, or to protect data governed by applicable laws, could result in enforcement action against us, including fines, imprisonment of company officials and public censure, claims for damages by customers and other affected individuals, damage to our reputation and loss of goodwill (both in relation to existing customers and prospective customers), any of which could have a material adverse effect on our operations, financial performance and business. We may also have costs associated with engaging with stakeholders, including investors, insurance providers, and other capital providers, on such issues.

Previous wording

We are, and may in the future become, subject to various legal proceedings, claims and investigations that arise in or outside the ordinary course of business. For example, in March 2024, an Evolv shareholder filed in the U.S. District Court for the District of Massachusetts a putative class action lawsuit, captioned Raby v. Evolv Technologies Holdings, Inc., et al. case number 1:24-cv-10761, alleging that Evolv and certain of its current and former executives and other individuals violated Sections 10(b) and 20(a) of the Securities Exchange Act of 1934 based on alleged misstatements concerning the Company’s products. We are also cooperating with ongoing investigations by the FTC and SEC. The above-captioned proceeding, as well as any pending or future government investigation or proceeding may result in substantial costs or liabilities, as well as a diversion of management’s attention and resources, which could harm our business, result in a decline in the market price of our common stock and impact our financing efforts.

Current wording

We are, and may in the future become, subject to various legal proceedings, claims and investigations that arise in or outside the ordinary course of business as discussed in Part II, Item 1, "Legal Proceedings" and Note 16 (Commitments and Contingencies) to our condensed consolidated financial statements for thenine months ended September 30, 2024. In addition, securities class action litigation has often been brought against a company following a decline in the market price of its securities or the completion of a merger. We may be the target of this type of litigation in the future. These proceedings, as well as any pending or future government investigation or proceeding may result in substantial costs or liabilities, as well as a diversion of management’s attention and resources, which could harm our business, result in a decline in the market price of our common stock and impact our financing efforts.

Previous wording

The potential costs and liabilities associated with legal proceedings, claims and investigations involving us or members of our leadership team is uncertain, and the results of such legal proceedings, claims and investigations cannot be predicted with certainty. Lawsuits and other administrative or legal proceedings that may arise can involve substantial costs, including the costs associated with investigation, litigation and possible settlement, judgment, penalty or fine. In addition, lawsuits and other legal proceedings may be time consuming to defend or prosecute and may require a commitment of management and personnel resources that will be diverted from our normal business operations. Also, our insurance coverage may be insufficient, our assets may be insufficient to cover any amounts that exceed our insurance coverage, and we may have to pay damage awards or otherwise may enter into settlement arrangements in connection with such claims. Moreover, we may be unable to continue to maintain our existing insurance at a reasonable cost, if at all, or to secure additional coverage, which may result in costs associated with lawsuits and other legal proceedings being uninsured. Any such payments or settlement arrangements in current or future litigation could have a material adverse effect on our business, operating results or financial condition. Even if the plaintiffs’ claims are not successful, current or future litigation could result in substantial costs and significantly and adversely impact our reputation and divert management’s attention and resources, which could have a material adverse effect on our business, operating results and financial condition, and negatively affect the price of our common stock. In addition, such lawsuits may make it more difficult to finance our operations.

Current wording

The potential costs and liabilities associated with legal proceedings, claims and investigations involving us or members of our leadership team is uncertain, and the results of such legal proceedings, claims and investigations cannot be predicted with certainty. Lawsuits and other administrative or legal proceedings that may arise can involve substantial costs, including the costs associated with investigation, litigation and possible settlement, judgment, penalty or fine. In addition, lawsuits and other legal proceedings may be time consuming to defend or prosecute and may require a commitment of management and personnel resources that will be diverted from our normal business operations. Also, our insurance coverage may be insufficient, our assets may be insufficient to cover any amounts that exceed our insurance coverage, and we may have to pay damage awards or otherwise may enter into settlement arrangements in connection with such claims. We may also be subject to fines or penalties that are not covered by insurance. Moreover, we may be unable to continue to maintain our existing insurance at a reasonable cost, if at all, or to secure additional coverage, which may result in costs associated with lawsuits and other legal proceedings being uninsured. Any such payments or settlement arrangements in current or future litigation could have a material adverse effect on our business, operating results or financial condition. Even if the plaintiffs’ claims are not successful, current or future litigation could result in substantial costs and significantly and adversely impact our reputation and divert management’s attention and resources, which could have a material adverse effect on our business, operating results and financial condition, and negatively affect the price of our common stock. In addition, such lawsuits may make it more difficult to finance our operations.

Previous wording

The marketing and sale of our products are also subject to extensive regulation by various federal agencies, including the FTC, as well as various other federal, state, provincial, local, and international regulatory authorities in the countries in which our products are distributed or sold and industry codes of conduct. From time to time, we receive government regulatory inquiries and requests for information and our approach is to be cooperative and educate them about our company and products. For example, the FTC has requested information about certain aspects of our marketing practices. We are complying with the FTC's requests and have been cooperating with them to answer their questions and educate them about our mission. In February 2024, we received a subpoena from the SEC, Division of Enforcement, requesting that we produce certain documents and information. The Company is cooperating with the FTC and SEC with respect to the investigations. We can offer no assurances as to the outcome of these investigations or their potential effect, if any, on us or our results of operations. Any inability to adequately address the FTC’s or SEC's concerns or comply with applicable laws, regulations, and policies, could result in litigation, enforcement actions or significant penalties or claims, which could, in turn, divert financial and management resources, damage our reputation, inhibit sales, and otherwise adversely affect our business. Any resolution or litigation with the FTC, SEC or other parties could ultimately result in monetary and/or injunctive relief that may impose costs on us and/or require us to make changes to our business practices and marketing activities and could adversely impact our customer relationships.

Current wording

We can offer no assurances as to the outcome of these inquiries or their potential effect, if any, on us or our results of operations. Any inability to adequately address the FTC or the SEC's concerns or comply with applicable laws, regulations, and policies, could result in litigation, enforcement actions or significant penalties or claims, which could, in turn, divert financial and management resources, damage our reputation, inhibit sales, and otherwise adversely affect our business. Any resolution or litigation with the SEC or other parties could ultimately result in monetary and/or injunctive relief that may impose costs on us and/or require us to make changes to our business practices and marketing activities and could adversely impact our customer relationships. In addition to the possibility of fines, injunctive relief, lawsuits and other claims, as a result of any pending or any future regulatory enforcement proceedings or inquiries we could be required to fundamentally change our business practices. Responding to these or other investigations alone can be costly and time-consuming. Any of these events could materially adversely affect our operating results and financial condition.