C3ai Inc

Previous wording

You should consider carefully the risks and uncertainties described below, together with all of the other information in this Annual Report on Form 10-K, including the section titled “Item 7. Management’s Discussion and Analysis of Financial Condition and Results of Operations” and our consolidated financial statements and related notes. Our business, results of operations, financial condition and prospects could also be harmed by risks and uncertainties that are not presently known to us or that we currently believe are not material. If any of the risks actually occur, our business, results of operations, financial condition, and prospects could be materially and adversely affected. Unless otherwise indicated, references to our business being harmed in these risk factors will include harm to our business, C3 AI Software (which includes our C3 AI Platform, C3 AI Applications and C3 Generative AI), reputation, brand, financial condition, results of operations, and prospects. In such event, the market price of our Class A common stock could decline, and you could lose all or part of your investment.

Current wording

You should consider carefully the risks and uncertainties described below, together with all of the other information in this Annual Report on Form 10-K, including the section titled “Item 7. Management’s Discussion and Analysis of Financial Condition and Results of Operations” and our consolidated financial statements and related notes. Our business, results of operations, financial condition and prospects could also be harmed by risks and uncertainties that are not presently known to us or that we currently believe are not material. If any of the risks actually occur, our business, results of operations, financial condition, and prospects could be materially and adversely affected. Unless otherwise indicated, references to our business being harmed in these risk factors will include harm to our business, C3 AI Software (which includes our C3 Agentic AI Platform, C3 AI Applications and C3 Generative AI), reputation, brand, financial condition, results of operations, and prospects. In such event, the market price of our Class A common stock could decline, and you could lose all or part of your investment.

Previous wording

We incurred net losses in each period since our founding in 2009. We generated net losses of approximately $279.7 million, $268.8 million, and $192.1 million for the fiscal years ended April 30, 2024, 2023, and 2022 respectively. As a result, we had an accumulated deficit of $1,089.9 million as of April 30, 2024. We expect to continue to incur net losses for the foreseeable future. These losses and accumulated deficit reflect the substantial investments we made to acquire new customers, commercialize our C3 AI Software, and continue to develop our C3 AI Software. While we have experienced revenue growth in recent periods, we do not know whether or when we will generate sufficient revenue to sustain or increase our growth or achieve or maintain profitability in the future. We also expect our costs and expenses to increase in future periods, which could negatively affect our future results of operations if our revenue does not increase. In particular, we intend to continue to expend significant funds to further develop our C3 AI Software and business, including:

Current wording

We incurred net losses in each period since our founding in 2009. We generated net losses of approximately $288.7 million, $279.7 million, and $268.8 million for the fiscal years ended April 30, 2025, 2024, and 2023 respectively. As a result, we had an accumulated deficit of $1.4 billion as of April 30, 2025. We expect to continue to incur net losses for the foreseeable future. These losses and accumulated deficit reflect the substantial investments we made to acquire new customers, commercialize our C3 AI Software, and continue to develop our C3 AI Software. While we have experienced revenue growth in recent periods, we do not know whether or when we will generate sufficient revenue to sustain or increase our growth or achieve or maintain profitability in the future. We also expect our costs and expenses to increase in future periods, which could negatively affect our future results of operations if our revenue does not increase. In particular, we intend to continue to expend significant funds to further develop our C3 AI Software and business, including:

Previous wording

Historically, a limited number of customers have accounted for a substantial portion of our revenue. If existing customers do not renew their contracts with us, or if our relationships with our largest customers are impaired or terminated, our revenue could decline, and our results of operations would be adversely impacted.

Current wording

Historically, a limited number of customers have accounted for a substantial portion of our revenue. If existing customers do not renew their contracts with us, or if our relationships with our largest customers are impaired or terminated, our revenue and remaining performance obligations could decline, and our results of operations would be adversely impacted.

Previous wording

Our customers generally have no obligation to renew, upgrade, or expand their subscriptions with us after the terms of their existing subscriptions expire. In addition, our customers may opt to decrease their usage of our C3 AI Software. As a result, we cannot provide assurance that our customers will renew, upgrade, or expand their subscriptions with us, if they renew at all. If one or more of our customers elect not to renew their subscriptions with us, or if our customers renew their subscriptions with us for shorter time periods, or if our customers decrease their usage of our C3 AI Software, or if our customers otherwise seek to renegotiate terms of their existing agreements on terms less favorable to us, our business and results of operations would be adversely affected. This adverse impact would be even more pronounced for customers that represent a material portion of our revenue or business operations.

Current wording

Our customers generally have no obligation to renew, upgrade, or expand their subscriptions with us after the terms of their existing subscriptions expire. In addition, our customers may opt to decrease their usage of our C3 AI Software. As a result, we cannot provide assurance that our customers will renew, upgrade, or expand their subscriptions with us, if they renew at all. If one or more of our customers elect not to renew their subscriptions with us, or if our customers renew their subscriptions with us for shorter time periods, or if our customers decrease their usage of our C3 AI Software, or if our customers otherwise seek to renegotiate terms of their existing agreements on terms less favorable to us, our business and results of operations would be adversely affected and our revenue and remaining performance obligations could decline. This adverse impact would be even more pronounced for customers that represent a material portion of our revenue or business operations.

Previous wording

In addition, our future success depends on our ability to sell additional subscriptions for our C3 AI Software to our existing customers, and our customers renewing their subscriptions when the contract term expires. Our customers generally have no contractual obligation to renew, upgrade, or expand their subscriptions after the terms of their existing subscriptions expire. Similarly, after completing a pilot or trial, customers do not have an obligation to continue to license our products, and we may not be able to convert pilot or trial customers into customers purchasing ongoing subscriptions or continue with a monthly consumption-based fee. In addition, our customers may opt to decrease their usage of our C3 AI Software. Given our limited experience with customer renewals of our AI products and services, we may not be able to accurately predict customer renewal rates. Our customers’ renewal and expansion commitments may decline or fluctuate as a result of a number of factors, including, but not limited to, their satisfaction with our C3 AI Software and our customer support, the frequency and severity of software and implementation errors or other reliability issues, the pricing of our subscriptions or competing solutions, changes in their IT budget, the effects of global economic conditions, and our customers’ financial circumstances, including their ability to maintain or expand their spending levels. In order for us to maintain or improve our results of operations, it is important that our customers renew or expand their subscriptions with us. If our customers do not purchase additional subscriptions, increase their usage of our software, or renew their subscriptions with us, our business, financial condition, and results of operations may be harmed.

Current wording

In addition, our future success depends on our ability to sell additional subscriptions for our C3 AI Software to our existing customers, and our customers renewing their subscriptions when the contract term expires. Our customers generally have no contractual obligation to renew, upgrade, or expand their subscriptions after the terms of their existing subscriptions expire. Similarly, after completing an initial production deployment, customers do not have an obligation to continue to license our products, and we may not be able to convert initial production deployment customers into customers purchasing ongoing subscriptions or continue with a monthly consumption-based fee. In addition, our customers may opt to decrease their usage of our C3 AI Software. Given our limited experience with customer renewals of our AI products and services, we may not be able to accurately predict customer renewal rates. Our customers’ renewal and expansion commitments may decline or fluctuate as a result of a number of factors, including, but not limited to, their satisfaction with our C3 AI Software and our customer support, the frequency and severity of software and implementation errors or other reliability issues, the pricing of our subscriptions or competing solutions, changes in their IT budget, the effects of global economic conditions, and our customers’ financial circumstances, including their ability to maintain or expand their spending levels. In order for us to maintain or improve our results of operations, it is important that our customers renew or expand their subscriptions with us. If our customers do not purchase additional subscriptions, increase their usage of our software, or renew their subscriptions with us, our business, financial condition, and results of operations may be harmed.

Previous wording

We have limited historical experience with supporting or selling to smaller, non-enterprise customers. We intend to grow our customer base and further contribute to our overall growth by introducing product offerings with a lower entry price point, such as our no-code offering C3 AI Ex Machina. However, by broadening our customer base to include smaller or mid-size customers, we will be faced with risks that may not be present or that are present to a lesser extent with respect to sales to large organizations. Because of our limited experience in supporting or selling to smaller, non-enterprise customers, we may be unsuccessful in our efforts to get future smaller customers to renew or expand their subscriptions to our offerings. If such customers do not renew their agreements or renew on less favorable terms or for less usage, our revenue may grow more slowly than expected or decline, and our business, financial condition, and results of operations may be harmed.

Current wording

We have limited historical experience with supporting or selling to smaller, non-enterprise customers. We intend to grow our customer base and further contribute to our overall growth by introducing product offerings with a lower entry price point. However, by broadening our customer base to include smaller or mid-size customers, we will be faced with risks that may not be present or that are present to a lesser extent with respect to sales to large organizations. Because of our limited experience in supporting or selling to smaller, non-enterprise customers, we may be unsuccessful in our efforts to get future smaller customers to renew or expand their subscriptions to our offerings. If such customers do not renew their agreements or renew on less favorable terms or for less usage, our revenue may grow more slowly than expected or decline, and our business, financial condition, and results of operations may be harmed.

Previous wording

We seek to grow our partner ecosystem as a way to grow our business. We anticipate that we will continue to establish and maintain relationships with third parties, such as channel partners, resellers, OEMs, system integrators, independent software and hardware vendors, and platform and cloud service providers. For example, in June 2019, we entered into a strategic collaboration with Baker Hughes whereby Baker Hughes operates as the exclusive channel partner and reseller of our C3 AI Software in the oil and gas industry and a non-exclusive reseller in other industries. This arrangement was most recently revised in January 2023 and continues until April 30, 2025, with options to renew. We also have strategic relationships with AWS, FIS, Google Cloud, Microsoft, and Raytheon.

Current wording

We seek to grow our partner ecosystem as a way to grow our business. We anticipate that we will continue to establish and maintain relationships with third parties, such as channel partners, resellers, OEMs, system integrators, independent software and hardware vendors, and platform and cloud service providers. For example, in June 2019, we entered into a strategic collaboration with Baker Hughes whereby Baker Hughes operates as the exclusive channel partner and reseller of our C3 AI Software in the oil and gas industry and a non-exclusive reseller in other industries. This arrangement was most recently revised in January 2023 and again in April 30, 2025. Baker Hughes is no longer C3 AI’s exclusive reseller. We also have strategic relationships with AWS, FIS, Google Cloud, Microsoft, and Raytheon.

Previous wording

It is difficult to predict customer adoption rates and demand for our C3 AI Software, the entry of competitive platforms, or the future growth rate and size of the cloud-based software and software-as-a-service, or SaaS, business software markets. A substantial majority of our revenue has come from sales of our subscription-based software products, which we expect to continue for the foreseeable future. Although demand for data management, ML, and analytics platforms and applications has grown in recent years, the market for these platforms and applications continues to evolve. We cannot be sure that this market will continue to grow or, even if it does grow, that businesses will adopt our C3 AI Software. Our future success will depend in large part on our ability to further penetrate the existing market for Enterprise AI software, as well as the continued growth and expansion of what we believe to be an emerging market for Enterprise AI platforms and applications that are faster, easier to adopt, and easier to use. Our ability to further penetrate the Enterprise AI market depends on a number of factors, including the cost, performance, and perceived value associated with our C3 AI Software, as well as customers’ willingness to adopt a different approach to data analysis. We have spent, and intend to keep spending, considerable resources to educate potential customers about digital transformation, AI, and ML in general and our C3 AI Software in particular. However, we cannot be sure that these expenditures will help our C3 AI Software achieve any additional market acceptance. Furthermore, potential customers may have made significant investments in legacy analytics software systems and may be unwilling to invest in new platforms and applications. If the market fails to grow or grows more slowly than we currently expect or businesses fail to adopt our C3 AI Software, our business, operating results, and financial condition could be adversely affected.

Current wording

It is difficult to predict customer adoption rates and demand for our C3 AI Software, the entry of competitive platforms, or the future growth rate and size of the cloud-based software and software-as-a-service business software markets. A substantial majority of our revenue has come from sales of our subscription-based software products, which we expect to continue for the foreseeable future. Although demand for data management, ML, and analytics platforms and applications has grown in recent years, the market for these platforms and applications continues to evolve. We cannot be sure that this market will continue to grow or, even if it does grow, that businesses will adopt our C3 AI Software. Our future success will depend in large part on our ability to further penetrate the existing market for Enterprise AI software, as well as the continued growth and expansion of what we believe to be an emerging market for Enterprise AI platforms and applications that are faster, easier to adopt, and easier to use. Our ability to further penetrate the Enterprise AI market depends on a number of factors, including the cost, performance, and perceived value associated with our C3 AI Software, as well as customers’ willingness to adopt a different approach to data analysis. We have spent, and intend to keep spending, considerable resources to educate potential customers about digital transformation, AI, and ML in general and our C3 AI Software in particular. However, we cannot be sure that these expenditures will help our C3 AI Software achieve any additional market acceptance. Furthermore, potential customers may have made significant investments in legacy analytics software systems and may be unwilling to invest in new platforms and applications. If the market fails to grow or grows more slowly than we currently expect or businesses fail to adopt our C3 AI Software, our business, operating results, and financial condition could be adversely affected.

Previous wording

Our success depends in a large part upon the continued service of key members of our senior management team. In particular, our founder and CEO, Thomas M. Siebel, is critical to our overall management, sales strategy, culture, strategic direction, engineering, and operations. In addition, Mr. Siebel is a recognized leader in information technology and is critical to the continued development of our C3 AI Software. All of our executive officers are at-will employees, and we do not maintain any key person life insurance policies. The loss of any member of our senior management team could make it more difficult to execute our business strategy and, therefore, harm our business.

Current wording

Our success depends in a large part upon the continued service of key members of our senior management team. In particular, our founder and CEO, Thomas M. Siebel, is critical to our overall management, sales strategy, culture, strategic direction, engineering, and operations. In addition, Mr. Siebel is a recognized leader in information technology and is critical to the continued development of our C3 AI Software. On February 18, 2025, Mr. Siebel informed the Company that he had contracted an autoimmune disease and was experiencing significant vision impairment. In that communication, Mr. Siebel also stated that this health setback was not impacting his ability to manage the business in a hands-on manner, and that Jim H. Snabe, a member of our Board of Directors, had assumed the interim role of Special Advisor to the CEO to assist where and as needed. In addition, all of our executive officers are at-will employees, and we do not maintain any key person life insurance policies. The loss of any member of our senior management team could make it more difficult to execute our business strategy and, therefore, harm our business.

Previous wording

Our performance metrics, data regarding customer engagement and certain other operational data in this report are subject to assumptions and limitations and may not provide an accurate indication of our future or expected results.

Current wording

Our performance metrics and certain other operational data in this report are subject to assumptions and limitations and may not provide an accurate indication of our future or expected results.

Previous wording

Our performance metrics, including data regarding customer engagement, and other operational data may involve judgment and therefore may not reflect our actual performance, and investors should consider these metrics in light of the assumptions used in calculating such metrics and limitations as a result thereof. Our methodologies for tracking these metrics may change over time, which could result in unexpected changes to our metrics, including the metrics we report. In addition, investors should not place undue reliance on these metrics as an indicator of our future or expected results. Moreover, these metrics may differ from similarly titled metrics presented by other companies and may not be comparable to such other metrics. We regularly review and may adjust our processes for calculating our metrics to improve their accuracy. If our metrics are not accurate representations of our business; if we discover material inaccuracies in our metrics or if the metrics we rely on to track our performance do not provide an accurate measurement of our business, our reputation may be harmed, we may be subject to legal or regulatory actions, and our operating and financial results could be adversely affected.

Current wording

Our performance metrics and other operational data may involve judgment and therefore may not reflect our actual performance, and investors should consider these metrics in light of the assumptions used in calculating such metrics and limitations as a result thereof. Our methodologies for tracking these metrics may change over time, which could result in unexpected changes to our metrics, including the metrics we report. In addition, investors should not place undue reliance on these metrics as an indicator of our future or expected results. Moreover, these metrics may differ from similarly titled metrics presented by other companies and may not be comparable to such other metrics. We regularly review and may adjust our processes for calculating our metrics to improve their accuracy. If our metrics are not accurate representations of our business; if we discover material inaccuracies in our metrics; or if the metrics we rely on to track our performance do not provide an accurate measurement of our business, our reputation may be harmed, we may be subject to legal or regulatory actions, and our operating and financial results could be adversely affected.

Previous wording

Global economic and business activities continue to face widespread macroeconomic uncertainties, including labor shortages and supply chain disruptions, inflation, interest rate fluctuations, bank failures and monetary supply shifts, as well as recession risks, which may continue for an extended period and which could result in our customer prospects and our existing customers experiencing slowdowns in their businesses, which in turn may result in reduced demand for our C3 AI Software, lengthening of sales cycles, loss of customers, and difficulties in collections. Our vendors and suppliers may experience, or may continue to experience, disruptions in their supply chains, which may result in service interruptions or additional operating expenses, and may increase the price at which our vendors and suppliers are willing to sell their products to us.

Current wording

Global economic and business activities continue to face widespread macroeconomic uncertainties, including labor shortages and supply chain disruptions, inflation, interest rate fluctuations, bank failures, monetary supply shifts, and the imposition of tariffs or other impacts on trade relations, as well as recession risks, which may continue for an extended period and which could result in our customer prospects and our existing customers experiencing slowdowns in their businesses, which in turn may result in reduced demand for our C3 AI Software, lengthening of sales cycles, loss of customers, and difficulties in collections. Our vendors and suppliers may experience, or may continue to experience, disruptions in their supply chains, which may result in service interruptions or additional operating expenses, and may increase the price at which our vendors and suppliers are willing to sell their products to us.

Previous wording

We and the third parties with whom we work are subject to stringent and evolving U.S. and foreign laws, regulations and rules, contractual obligations, industry standards, policies, self-regulatory schemes, standards and other obligations related to data privacy and security. Our actual or perceived failure to comply with such obligations could lead to regulatory investigations or actions; litigation (including class claims) and mass arbitration demands; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; loss of customers or sales; and other adverse business consequences.

Current wording

We and the third parties with whom we work are subject to stringent and evolving U.S. and foreign laws, regulations and rules, contractual obligations, industry standards, policies, self-regulatory schemes, standards and other obligations related to data privacy and security. Our actual or perceived failure to comply with such obligations could lead to regulatory investigations or actions, litigation (including class claims) and mass arbitration demands, as well as potential fines and penalties, disruptions of our business operations, reputational harm; loss of revenue or profits, loss of customers or sales, and other adverse business consequences.

Previous wording

In the United States, federal, state, and local governments have enacted numerous data privacy and security laws, including data breach notification laws, personal data privacy laws, consumer protection laws (e.g., Section 5 of the Federal Trade Commission Act), and other similar laws (e.g., wiretapping laws). For example, the federal Health Insurance Portability and Accountability Act of 1996, or HIPAA, as amended by the Health Information Technology for Economic and Clinical Health Act, or HITECH, imposes specific requirements relating to the privacy, security and transmission of individually identifiable health information. In the past few years, numerous U.S. states - including California, Virginia, Colorado, Connecticut, and Utah - have enacted comprehensive privacy laws that impose certain obligations on covered businesses, including providing specific disclosures in privacy notices and affording residents with certain rights concerning their personal data. As applicable, such rights may include the right to access, correct, or delete certain personal data, and to opt-out of certain data processing activities, such as targeted advertising, profiling, and automated decision-making. The exercise of these rights may impact our business and ability to provide our products and services. Certain states also impose strict requirements for processing certain personal data, including sensitive information, such as conducting data privacy impact assessments. These state laws allow for statutory fines for noncompliance. For example, the California Consumer Privacy Act of 2018 (CCPA), applies to personal data of consumers, business representatives and employees who are California residents, and imposes obligations on covered businesses, including, but not limited to, providing specific disclosures in privacy notices and honoring requests of such individuals to exercise certain privacy rights related to their personal data. The CCPA provides for statutory fines for noncompliance (up to $7,500 per intentional violation) and allows private litigants affected by certain data breaches to recover significant statutory damages. Similar laws are being considered in several other states and at the federal level and local levels, and we expect more states to pass similar laws in the future, reflecting a trend toward more stringent privacy legislation in the United States. These new laws could further complicate compliance efforts and increase legal risk and compliance costs for us, the third parties with whom we work, and our customers.

Current wording

In the United States, federal, state, and local governments have enacted numerous data privacy and security laws, including data breach notification laws, personal data privacy laws, consumer protection laws (e.g., Section 5 of the Federal Trade Commission Act), and other similar laws (e.g., wiretapping laws). For example, the federal Health Insurance Portability and Accountability Act of 1996, or HIPAA, as amended by the Health Information Technology for Economic and Clinical Health Act, or HITECH, imposes specific requirements relating to the privacy, security and transmission of individually identifiable health information. In the past few years, numerous U.S. states - including California, Virginia, Colorado, Connecticut, and Utah - have enacted comprehensive privacy laws that impose certain obligations on covered businesses, including providing specific disclosures in privacy notices and affording residents with certain rights concerning their personal data. As applicable, such rights may include the right to access, correct, or delete certain personal data, and to opt-out of certain data processing activities, such as targeted advertising, profiling, and automated decision-making. The exercise of these rights may impact our business and ability to provide our products and services. Certain states also impose strict requirements for processing certain personal data, including sensitive information, such as conducting data privacy impact assessments. These state laws allow for statutory fines for noncompliance. For example, the California Consumer Privacy Act of 2018 (CCPA), applies to personal data of consumers, business representatives and employees who are California residents, and imposes obligations on covered businesses, including, but not limited to, providing specific disclosures in privacy notices and honoring requests of such individuals to exercise certain privacy rights related to their personal data. The CCPA provides for statutory fines for noncompliance and allows private litigants affected by certain data breaches to recover significant statutory damages. Similar laws are being considered in several other states and at the federal level and local levels, and we expect more states to pass similar laws in the future, reflecting a trend toward more stringent privacy legislation in the United States. These new laws could further complicate compliance efforts and increase legal risk and compliance costs for us, the third parties with whom we work, and our customers.

Previous wording

Outside the United States, an increasing number of laws, regulations, and industry standards apply to data privacy and security. In Canada, the Personal Information Protection and Electronic Documents Act, or PIPEDA, and various related provincial laws, as well as Canada’s Anti-Spam Legislation, or CASL, may apply to our operations. We also target customers in Asia and have operations in Japan and Singapore and may be subject to new and emerging data privacy regimes in Asia, including Singapore’s Personal Data Protection Act. In the European Economic Area, or EEA, we are subject to the European General Data Protection Regulation, or GDPR, and in the United Kingdom, or UK, we are subject to the UK data protection regime, or UK GDPR (EU GDPR and UK GDPR, collectively GDPR). Companies that must comply with the GDPR face increased compliance obligations and risk, including more robust regulatory enforcement of data protection requirements, with violations potentially resulting in an order prohibiting the processing of personal data and/or fines of up to the greater of €20 million or 4% of the annual global revenues of the noncompliant company in the European Union, and up to the greater of GBP 17.5 million or 4% of the annual global revenues in the UK; or private litigation related to processing of personal data brought by classes of data subjects or consumer protection organizations authorized at law to represent their interests.

Current wording

Outside the United States, an increasing number of laws, regulations, and industry standards apply to data privacy and security. In Canada, the Personal Information Protection and Electronic Documents Act, or PIPEDA, and various related provincial laws, as well as Canada’s Anti-Spam Legislation, or CASL, may apply to our operations. We also target customers in Asia and have operations in Japan and Singapore and may be subject to new and emerging data privacy regimes in Asia, including Japan’s Act on the Protection of Personal Information and Singapore’s Personal Data Protection Act. In the European Economic Area, or EEA, we are subject to the European General Data Protection Regulation, or GDPR, and in the United Kingdom, or UK, we are subject to the UK data protection regime, or UK GDPR (EU GDPR and UK GDPR, collectively GDPR). Companies that must comply with the GDPR face increased compliance obligations and risk, including more robust regulatory enforcement of data protection requirements, with violations potentially resulting in an order prohibiting the processing of personal data and/or fines of up to the greater of €20 million or 4% of the annual global revenues of the noncompliant company in the European Union, and up to the greater of GBP 17.5 million or 4% of the annual global revenues in the UK; or private litigation related to processing of personal data brought by classes of data subjects or consumer protection organizations authorized at law to represent their interests.

Previous wording

As such, we, or our vendors, may be unable to implement measures sufficient to lawfully transfer personal data in a manner necessary to provide our services in certain regions without incurring significant cost, or at all. If we cannot implement a valid compliance mechanism for cross-border data transfers, we may face significant adverse consequences, including the interruption or degradation of our operations, increased exposure to regulatory actions, substantial fines and penalties, and injunctions against processing or transferring personal data from Europe or other foreign jurisdictions. The inability to import personal data to the United States could significantly and negatively impact our business operations, including by limiting our ability to collaborate with parties that are subject to such cross-border data transfer or localization laws; or requiring us to increase our personal data processing capabilities and infrastructure in foreign jurisdictions at significant expense. Additionally, companies that transfer personal data outside of the EEA and UK to other jurisdictions, particularly the United States, are subject to increased scrutiny from regulators, individual litigants and activist groups. Some European regulators have significantly restricted some companies’ data processing activities, including ordering certain companies to suspend or permanently cease the transfer of certain personal data out of Europe for allegedly violating the GDPR’s cross-border data transfer limitations, which has materially impacted companies’ operations revenues. For example, in May 2023, the Irish Data Protection Commission determined that a major social media company’s use of the standard contractual clauses to transfer personal data from Europe to the United States was insufficient and levied a 1.2 billion Euro fine against the company and prohibited the company from transferring personal data to the United States. The United States is also increasingly scrutinizing certain data transfers and may also impose certain data localization requirements, particularly if we transfer personal data to, or process personal data of residents of, high risk or sanctioned jurisdictions.

Current wording

As such, we, or our vendors, may be unable to implement measures sufficient to lawfully transfer personal data in a manner necessary to provide our services in certain regions without incurring significant cost, or at all. If we cannot implement a valid compliance mechanism for cross-border data transfers, we may face significant adverse consequences, including the interruption or degradation of our operations, increased exposure to regulatory actions, substantial fines and penalties, and injunctions against processing or transferring personal data from Europe or other foreign jurisdictions. The inability to import personal data to the United States could significantly and negatively impact our business operations, including by limiting our ability to collaborate with parties that are subject to such cross-border data transfer or localization laws; or requiring us to increase our personal data processing capabilities and infrastructure in foreign jurisdictions at significant expense. Additionally, companies that transfer personal data outside of the EEA and UK to other jurisdictions, particularly the United States, are subject to increased scrutiny from regulators, individual litigants and activist groups. Some European regulators have significantly restricted some companies’ data processing activities, including ordering certain companies to suspend or permanently cease the transfer of certain personal data out of Europe for allegedly violating the GDPR’s cross-border data transfer limitations, which has materially impacted companies’ operations revenues. For example, in May 2023, the Irish Data Protection Commission determined that a major social media company’s use of the standard contractual clauses to transfer personal data from Europe to the United States was insufficient and levied a 1.2 billion Euro fine against the company and prohibited the company from transferring personal data to the United States. Additionally, the U.S. Department of Justice issued a rule entitled the Preventing Access to U.S. Sensitive Personal Data and Government-Related Data by Countries of Concern or Covered Persons, which places additional restriction on certain data transactions involving countries of concern (e.g., China, Russia, Iran) and covered individuals (i.e., individuals and entities located in or controlled by individuals or entities located in those jurisdictions) that may impact certain business activities such as vendor engagements, sale or sharing of data, employment of certain individuals, and investor agreements. Violations of the rule could lead to significant civil and criminal fines and penalties.

Previous wording

Our use of artificial intelligence, or AI, and machine learning, or ML, technologies (collectively, “AI/ML technologies”) may also subject us to certain privacy obligations. There is increasing U.S. and foreign activity in the regulation of AI and other similar uses of technology. In Europe, there is a proposed regulation related to AI that, if adopted, could impose onerous obligations related to the use of AI-related systems. We expect other jurisdictions will adopt similar laws. In the United States, several states and localities have enacted measures related to the use of AI and ML in products and services. We may have to change our business practices to comply with such obligations. For example, our employees and personnel use generative AI technologies to perform their work. Our use of this technology could result in additional compliance costs, regulatory investigations and actions, and lawsuits. If we are unable to use generative AI, it could make our business less efficient and result in competitive disadvantages. We also use AI and ML technologies in our products and services. Our use of this technology could result in additional compliance costs, regulatory investigations and actions, and consumer lawsuits. Depending on how these AI laws and regulations are interpreted, we may have to make changes to our business practices and products, including our C3 AI Software, to comply with such obligations. These obligations may make it harder for us to conduct our business using AI/ML, lead to regulatory fines or penalties, require us retrain our AI/ML, or prevent or limit our use of AI/ML. Additionally, certain privacy laws extend rights to consumers (such as the right to delete certain personal data) and regulate automated decision making, which may be incompatible with our use of AI/ML. Further, under privacy laws and other obligations, we may be required to obtain certain consents to process personal data and our inability or failure to do so could result in adverse consequences. For example, the FTC has required other companies to turn over (or disgorge) valuable insights or trainings generated through the use of AI/ML where they allege the company has violated privacy and consumer protection laws. If we cannot use AI/ML or that use is restricted, our business may be less efficient, or we may be at a competitive disadvantage.

Current wording

Our use of artificial intelligence, or AI, and machine learning, or ML, technologies, collectively, AI/ML technologies, may also subject us to certain privacy and data security laws, as well as increasing regulation and scrutiny. There is increasing U.S. and foreign activity in the regulation of AI and other similar uses of technology. In Europe, the EU AI Act entered into force on August 1, 2024 and will become fully applicable on August 2, 2026, with some provisions already applying from February 2025. We do not engage in developing or providing AI systems or general-purpose AI models that would qualify as “prohibited AI practices”. However, if we or our customers are classified as developing or using "high-risk" AI systems, or general-purpose AI models, including general-purpose AI models with systemic risk, the EU AI Act could impose more restrictions and obligations. This could increase the costs and burdens to us and our customers, delay or halt deployment of new products and services, and may reduce the number of new customers, negatively impacting our business and financial results. Under the EU AI Act, non-compliant companies may be subject to administrative fines of up to 35 million Euros or 7% of a company’s total worldwide annual turnover for the preceding financial year, whichever is the higher. Moreover, in the United Kingdom, the government has confirmed its position that existing regulators are to implement certain specific principles (safety, security and robustness; transparency and explainability; fairness; accountability and governance; contestability and redress), within those regulators’ existing remits, to guide and inform the responsible development and use of AI / ML within their relevant sectors / competences. We expect other jurisdictions will adopt similar laws. In the United States, several states and localities have enacted measures related to the use of AI and ML in products and services. We may have to change our business practices to comply with such obligations. For example, our employees and personnel use generative AI technologies to perform their work. Our use of this technology could result in additional compliance costs, regulatory investigations and actions, and lawsuits. If we are unable to use generative AI, it could make our business less efficient and result in competitive disadvantages. We also use AI and ML technologies in our products and services. Our use of this technology could result in additional compliance costs, regulatory investigations and actions, and consumer lawsuits. Depending on how these AI laws and regulations are interpreted, we may have to make changes to our business practices and products, including our C3 AI Software, to comply with such obligations. These obligations may make it harder for us to conduct our business using AI/ML, lead to regulatory fines or penalties, require us retrain our AI/ML, or prevent or limit our use of AI/ML. Additionally, certain privacy laws extend rig…

Excerpt shortened here; the source contains the full paragraph.

Previous wording

Any of the previously identified or similar threats could cause a security incident or other interruption that could result in unauthorized, unlawful, or accidental acquisition, modification, destruction, loss, alteration, encryption, disclosure of, or access to our sensitive information, or our technology systems, or those of the third parties with whom we work. A security incident or other interruption could disrupt our ability (and that of third parties with whom we work) to provide our platform. Any actual or potential security breach of our C3 AI Software, our operational systems, our physical facilities, or the systems or facilities of our partners, or the perception that one has occurred, could result in adverse consequences, such as litigation, indemnity obligations, regulatory enforcement actions, investigations, fines, penalties, mitigation and remediation costs, disputes, reputational harm, diversion of management’s attention, and other liabilities and damage to our business. Even though we do not control the security measures of third parties, we may be perceived or asserted to be responsible for any breach of such measures or suffer reputational harm even where we do not have recourse to the third party that caused the breach. In addition, any failure by our partners to comply with applicable law or regulations could result in proceedings against us by governmental entities or others, with further financial, operational, and reputational damage. While we may be entitled to damages if the third parties with whom we work fail to satisfy their privacy or security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such award. In addition to experiencing a security incident, third parties may gather, collect, or infer sensitive information about us from public sources, data brokers, or other means that reveals competitively sensitive details about our organization and could be used to undermine our competitive advantage or market position.

Current wording

Any of the previously identified or similar threats could cause a security incident or other interruption that could result in unauthorized, unlawful, or accidental acquisition, modification, destruction, loss, alteration, encryption, disclosure of, or access to our sensitive information, or our technology systems, or those of the third parties with whom we work. A security incident or other interruption could disrupt our ability (and that of third parties with whom we work) to provide our platform. Any actual or potential security breach of our C3 AI Software, our operational systems, our physical facilities, or the systems or facilities of our partners, or the perception that one has occurred, could result in material adverse consequences, such as litigation, indemnity obligations, regulatory enforcement actions, investigations, fines, penalties, mitigation and remediation costs, disputes, reputational harm, diversion of management’s attention, and other liabilities and damage to our business. Even though we do not control the security measures of third parties, we may be perceived or asserted to be responsible for any breach of such measures or suffer reputational harm even where we do not have recourse to the third party that caused the breach. In addition, any failure by our partners to comply with applicable law or regulations could result in proceedings against us by governmental entities or others, with further financial, operational, and reputational damage. While we may be entitled to damages if the third parties with whom we work fail to satisfy their privacy or security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such award. In addition to experiencing a security incident, third parties may gather, collect, or infer sensitive information about us from public sources, data brokers, or other means that reveals competitively sensitive details about our organization and could be used to undermine our competitive advantage or market position.

Previous wording

The costs to respond to a security breach and/or to mitigate any security vulnerabilities that may be identified could be significant, our efforts to address these problems may not be successful, and these problems could result in unexpected interruptions, delays, cessation of service, negative publicity, and other harm to our business and our competitive position. We could be required to fundamentally change our business activities and practices in response to a security breach or related regulatory actions or litigation, which could have an adverse effect on our business. In addition, laws, regulations, government guidance, and industry standards and practices in the United States and elsewhere are rapidly evolving to combat these threats. We may face increased compliance burdens regarding such requirements from regulators and customers regarding our products and services and also incur additional costs for oversight and monitoring of security risks relating to our own supply chain. For example, we have contractual and legal obligations to notify relevant stakeholders, including affected individuals, customers, regulators, and investors, of security breaches. Most jurisdictions have enacted laws requiring companies to notify individuals, regulatory authorities, and others of security breaches involving certain types of data, and implement other requirements, such as providing credit monitoring. Such disclosures and compliance with such requirements are costly, and the disclosures or the failure to comply with such requirements could lead to adverse consequences. In addition, our agreements with certain customers and partners may require us to notify them in the event of a security breach involving customer or partner data on our systems or those of subcontractors processing customer or partner data on our behalf. Such mandatory disclosures are costly, could lead to negative publicity, may cause our customers to lose confidence in the effectiveness of our security measures, and require us to expend significant capital and other resources to respond to or alleviate problems caused by the actual or perceived security breach and may cause us to breach customer contracts. Our agreements with certain customers may require us to use industry-standard, reasonable, or other specified measures to safeguard sensitive personal information or confidential information, and any actual or perceived breach of such measures may increase the likelihood and frequency of customer audits under our agreements, which is likely to increase the costs of doing business. An actual or perceived security breach could lead to claims by our customers, or other relevant stakeholders that we have failed to comply with such legal or contractual obligations. As a result, we could be subject to legal action or our customers could end their relationships with us. There can be no assurance that any limitations of liability in our contracts, which we have in certain agreements, would…

Excerpt shortened here; the source contains the full paragraph.

Current wording

The costs to respond to a security breach and/or to mitigate any security vulnerabilities that may be identified could be significant, our efforts to address these problems may not be successful, and these problems could result in unexpected interruptions, delays, cessation of service, negative publicity, and other harm to our business and our competitive position. We could be required to fundamentally change our business activities and practices in response to a security breach or related regulatory actions or litigation, which could have an adverse effect on our business. In addition, laws, regulations, government guidance, and industry standards and practices in the United States and elsewhere are rapidly evolving to combat these threats. We may face increased compliance burdens regarding such requirements from regulators and customers regarding our products and services and also incur additional costs for oversight and monitoring of security risks relating to our own supply chain. For example, we have contractual and legal obligations, or we may voluntarily choose, to notify relevant stakeholders, including affected individuals, customers, regulators, and investors, of security breaches. Most jurisdictions have enacted laws requiring companies to notify individuals, regulatory authorities, and others of security breaches involving certain types of data, and implement other requirements, such as providing credit monitoring and identifying theft protection services. Such disclosures and related actions can be costly, and the disclosures or the failure to comply with such applicable requirements could lead to material adverse consequences. In addition, our agreements with certain customers and partners may require us to notify them in the event of a security breach involving customer or partner data on our systems or those of subcontractors processing customer or partner data on our behalf. Such mandatory disclosures are costly, could lead to negative publicity, may cause our customers to lose confidence in the effectiveness of our security measures, and require us to expend significant capital and other resources to respond to or alleviate problems caused by the actual or perceived security breach and may cause us to breach customer contracts. Our agreements with certain customers require us to use industry-standard, reasonable, or other specified measures to safeguard sensitive personal information or confidential information, and any actual or perceived breach of such measures may increase the likelihood and frequency of customer audits under our agreements, which is likely to increase the costs of doing business. An actual or perceived security breach could lead to claims by our customers, or other relevant stakeholders that we have failed to comply with such legal or contractual obligations. As a result, we could be subject to legal action or our customers could end their relationships with us. There can be no assurance that any limitations…

Excerpt shortened here; the source contains the full paragraph.

Previous wording

While we and a number of our vendors and business partners have implemented security measures and designed to protect against security incidents, there can be no assurance that these measures will be effective. We take steps to detect and remediate vulnerabilities in our information security systems (such as our hardware and/ or software, including that of third parties with whom we work), and ensure the security, privacy, integrity, confidentiality, availability, and authenticity of our information technology networks and systems, processing and information, but we may not be able to anticipate or to implement effective preventive and remedial measures against all data security and privacy threats or detect, mitigate and remediate all vulnerabilities on a timely basis. We cannot guarantee that the recovery systems, security protocols, network protection mechanisms and other security measures that we have integrated into our systems, networks and physical facilities, which are designed to protect against, detect and minimize security breaches and vulnerabilities, or those of our vendors and business partners, will be adequate to prevent or detect service interruption, system failure data loss or theft, or other material adverse consequences. No security solution, strategy, or measures can address all possible security threats or block all methods of penetrating a network or otherwise perpetrating a security incident. The risk of unauthorized circumvention of our security measures or those of the third parties with whom we work, has been heightened by advances in computer and software capabilities and the increasing sophistication of hackers who employ complex techniques, including without limitation, the theft or misuse of personal and financial information, counterfeiting, “phishing” or social engineering incidents, ransomware, extortion, publicly announcing security breaches, account takeover attacks, denial or degradation of service attacks, malware, fraudulent payment and identity theft. The techniques used to sabotage, disrupt or to obtain unauthorized access to our C3 AI Software, systems, networks, or physical facilities in which data is stored or through which data is transmitted change frequently, and we may be unable to implement adequate preventative measures or stop security breaches while they are occurring. Unremediated high risk or critical vulnerabilities pose material risks to our business. Further, we may experience delays in developing and deploying remedial measures designed to address any such identified vulnerabilities.

Current wording

While we and a number of our vendors and business partners have implemented security measures designed to protect against security incidents, there can be no assurance that these measures will be effective. We take steps designed to detect and remediate vulnerabilities in our information security systems (such as our hardware and/ or software, including that of third parties with whom we work), and ensure the security, privacy, integrity, confidentiality, availability, and authenticity of our information technology networks and systems, processing and information, but we may not be able to anticipate or to implement effective preventive and remedial measures against all data security and privacy threats or detect, mitigate and remediate all vulnerabilities on a timely basis. We cannot guarantee that the recovery systems, security protocols, network protection mechanisms and other security measures that we have integrated into our systems, networks and physical facilities, which are designed to protect against, detect and minimize security breaches and vulnerabilities, or those of our vendors and business partners, will be adequate to prevent or detect service interruption, system failure data loss or theft, or other material adverse consequences. Actions taken by us or the third parties with whom we work to detect, investigate, mitigate, contain, and remediate a security incident could result in outages, data losses, and disruptions of our business. Threat actors may also gain access to other networks and systems after a compromise of our networks and systems. No security solution, strategy, or measures can address all possible security threats or block all methods of penetrating a network or otherwise perpetrating a security incident. The risk of unauthorized circumvention of our security measures or those of the third parties with whom we work, has been heightened by advances in computer and software capabilities and the increasing sophistication of hackers who employ complex techniques, including without limitation, the theft or misuse of personal and financial information, counterfeiting, “phishing” or social engineering incidents, ransomware, extortion, publicly announcing security breaches, account takeover attacks, denial or degradation of service attacks, malware, fraudulent payment and identity theft. The techniques used to sabotage, disrupt or to obtain unauthorized access to our C3 AI Software, systems, networks, or physical facilities in which data is stored or through which data is transmitted change frequently, and we may be unable to implement adequate preventative measures or stop security breaches while they are occurring. Unremediated high risk or critical vulnerabilities pose material risks to our business. It may also be costly to detect, investigate, mitigate, contain, and remediate a security incident. Further, we may experience delays in developing and deploying remedial measures designed to address any such identified vuln…

Excerpt shortened here; the source contains the full paragraph.

Previous wording

If we (or a third party with whom we work) experience a security incident or are perceived to have experienced a security incident, we may experience adverse consequences such as government enforcement actions (for example, investigations, fines, penalties, audits, and inspections); additional reporting requirements and/or oversight; restrictions on processing sensitive information (including personal data); litigation (including class claims); indemnification obligations; negative publicity; reputational harm; monetary fund diversions; diversion of management attention; interruptions in our operations (including availability of data); financial loss; and other similar harms. Litigation resulting from security breaches may adversely affect our business. Unauthorized access to our C3 AI Software, systems, networks, or physical facilities could result in litigation with our customers or other relevant stakeholders. These proceedings could force us to spend money in defense or settlement, divert management’s time and attention, increase our costs of doing business, or adversely affect our reputation. We could be required to fundamentally change our business activities and practices or modify our C3 AI Software capabilities in response to such litigation, which could have an adverse effect on our business. If a security breach were to occur, and the confidentiality, integrity or availability of our data or the data of our partners or our customers was disrupted, we could incur significant liability, or our C3 AI Software, systems, or networks may be perceived as less desirable, which could negatively affect our business and damage our reputation.

Current wording

If we (or a third party with whom we work) experience a security incident or are perceived to have experienced a security incident, we may experience material adverse consequences such as government enforcement actions (for example, investigations, fines, penalties, audits, and inspections); additional reporting requirements and/or oversight; restrictions on processing sensitive information (including personal data); litigation (including class claims); indemnification obligations; negative publicity; reputational harm; monetary fund diversions; diversion of management attention; interruptions in our operations (including availability of data); financial loss; and other similar harms. Litigation resulting from security breaches may adversely affect our business. Unauthorized access to our C3 AI Software, systems, networks, or physical facilities could result in litigation with our customers or other relevant stakeholders. These proceedings could force us to spend money in defense or settlement, divert management’s time and attention, increase our costs of doing business, or adversely affect our reputation. We could be required to fundamentally change our business activities and practices or modify our C3 AI Software capabilities in response to such litigation, which could have an adverse effect on our business. If a security breach were to occur, and the confidentiality, integrity or availability of our data or the data of our partners or our customers was disrupted, we could incur significant liability, or our C3 AI Software, systems, or networks may be perceived as less desirable, which could negatively affect our business and damage our reputation.

Previous wording

In addition to experiencing a security incident, we may experience negative consequences from our use of AI/ML within our company and in our products and services. Sensitive information of the Company or our customers could be leaked, disclosed, or revealed as a result of or in connection with our employees’, personnel’s, or vendors’ use of generative AI technologies. Any sensitive information (including confidential, competitive, proprietary, or personal data) that we input into a third-party generative AI/ML platform could be leaked or disclosed to others, including if sensitive information is used to train the third parties’ AI/ML model. Additionally, where an AI/ML model ingests personal data and makes connections using such data, those technologies may reveal other personal or sensitive information generated by the model. Moreover, AI/ML models may create flawed, incomplete, or inaccurate outputs, some of which may appear correct. This may happen if the inputs that the model relied on were inaccurate, incomplete or flawed (including if a bad actor “poisons” the AI/ML with bad inputs or logic), or if the logic of the AI/ML is flawed (a so-called “hallucination”). We may use AI/ML outputs to make certain decisions. Due to these potential inaccuracies or flaws, the model could be biased and could lead us to make decisions that could bias certain individuals (or classes of individuals), and adversely impact their rights, employment, and ability to obtain certain pricing, products, services, or benefits, including exposure to reputational and competitive harm, customer loss, and legal liability.

Current wording

In addition to experiencing a security incident, we may experience negative consequences from our use of AI/ML within our company and in our products and services. Our or our customers’ sensitive information could be leaked, disclosed, or revealed as a result of or in connection with our employees’, personnel’s, or vendors’ use of generative AI technologies. Any sensitive information (including confidential, competitive, proprietary, or personal data) that we input into a third-party generative AI/ML platform could be leaked or disclosed to others, including if sensitive information is used to train the third parties’ AI/ML model. Additionally, where an AI/ML model ingests personal data and makes connections using such data, those technologies may reveal other personal or sensitive information generated by the model. Moreover, AI/ML models may create flawed, incomplete, or inaccurate outputs, some of which may appear correct. This may happen if the inputs that the model relied on were inaccurate, incomplete or flawed (including if a bad actor “poisons” the AI/ML with bad inputs or logic), or if the logic of the AI/ML is flawed (a so-called “hallucination”). We may use AI/ML outputs to make certain decisions. Due to these potential inaccuracies or flaws, the model could be biased and could lead us to make decisions that could bias certain individuals (or classes of individuals), and adversely impact their rights, employment, and ability to obtain certain pricing, products, services, or benefits, including exposure to reputational and competitive harm, customer loss, and legal liability.

Previous wording

Our business depends on our C3 AI Software to be available without disruption. We have experienced, and may in the future experience, disruptions, outages, defects, and other performance and quality problems with our C3 AI Software. We have also experienced, and may in the future experience, disruptions, outages, defects, and other performance and quality problems with the public cloud and internet infrastructure on which our C3 AI Software relies. These problems can be caused by a variety of factors, including introductions of new functionality, vulnerabilities and defects in proprietary and open source software, human error or misconduct, capacity constraints, design limitations, as well as from internal and external security breaches, malware and viruses, ransomware, cyber events, denial or degradation of service attacks or other security-related incidents.

Current wording

Our business depends on our C3 AI Software to be available without disruption. We and the third parties with whom we work have experienced, or may in the future experience, disruptions, outages, defects, and other performance and quality problems related to our C3 AI Software. We have also experienced, and may in the future experience, disruptions, outages, defects, and other performance and quality problems with the public cloud and internet infrastructure on which our C3 AI Software relies. These problems can be caused by a variety of factors, including introductions of new functionality, vulnerabilities, coding errors, software defects, and defects in proprietary and open source software, human error or misconduct, capacity constraints, design limitations, as well as from internal and external security breaches, malware and viruses, ransomware, cyber events, denial or degradation of service attacks or other security-related incidents.

Previous wording

Any disruptions, outages, defects, and other security performance and quality problems with our C3 AI Software or with the public cloud and internet infrastructure on which it relies, or any material change in our contractual and other business relationships with our public cloud providers, could result in reduced use of our C3 AI Software, increased expenses, including significant, unplanned capital investments and/or service credit obligations, and harm to our brand and reputation, any of which could have a material adverse effect on our business, financial condition, reputation and results of operations.

Current wording

Any disruptions, outages, defects, and other security performance and quality problems with our C3 AI Software or with the public cloud, internet infrastructure, or other technology on which it relies, or any material change in our contractual and other business relationships with our public cloud providers, could result in reduced use of our C3 AI Software, increased expenses, including significant, unplanned capital investments and/or service credit obligations, and harm to our brand and reputation, any of which could have a material adverse effect on our business, financial condition, reputation and results of operations.

Previous wording

We sell to customers globally and have international operations primarily in Europe. As we continue to expand our international operations, we will become more exposed to the effects of fluctuations in currency exchange rates. Although the majority of our cash generated from revenue is denominated in U.S. dollars, a small amount is denominated in foreign currencies, and our expenses are generally denominated in the currencies of the jurisdictions in which we conduct our operations. For the fiscal years ended April 30, 2024 and 2023, 6% and 8% of our revenue, respectively, were denominated in currencies other than U.S. dollars. For the fiscal years ended April 30, 2024 and 2023, 7% and 5% of our expenses, respectively, were denominated in currencies other than U.S. dollars. Because we conduct business in currencies other than U.S. dollars but report our results of operations in U.S. dollars, we also face remeasurement exposure to fluctuations in currency exchange rates, which could hinder our ability to predict our future results and earnings and could materially impact our results of operations. Therefore, increases in the value of the U.S. dollar and decreases in the value of foreign currencies could result in the dollar equivalent of our revenue being lower. We do not currently maintain a program to hedge exposures to non-U.S. dollar currencies.

Current wording

We sell to customers globally and have international operations primarily in Europe. As we continue to expand our international operations, we will become more exposed to the effects of fluctuations in currency exchange rates. Although the majority of our cash generated from revenue is denominated in U.S. dollars, a small amount is denominated in foreign currencies, and our expenses are generally denominated in the currencies of the jurisdictions in which we conduct our operations. For the fiscal years ended April 30, 2025 and 2024, 6% and 6% of our revenue, respectively, were denominated in currencies other than U.S. dollars. For the fiscal years ended April 30, 2025 and 2024, 7% and 7% of our expenses, respectively, were denominated in currencies other than U.S. dollars. Because we conduct business in currencies other than U.S. dollars but report our results of operations in U.S. dollars, we also face remeasurement exposure to fluctuations in currency exchange rates, which could hinder our ability to predict our future results and earnings and could materially impact our results of operations. Therefore, increases in the value of the U.S. dollar and decreases in the value of foreign currencies could result in the dollar equivalent of our revenue being lower. We do not currently maintain a program to hedge exposures to non-U.S. dollar currencies.

Previous wording

Issues raised by the use of AI, including ML, in our C3 AI Platform may result in reputational harm or liability or otherwise adversely affect our business, financial condition and results of operations.

Current wording

Issues raised by the use of AI, including ML, in our C3 Agentic AI Platform may result in reputational harm or liability or otherwise adversely affect our business, financial condition and results of operations.

Previous wording

AI is enabled by or integrated into some of the C3 AI Platform, including C3 Generative AI, and is a significant and growing element of our business. As with many developing technologies, AI presents risks and challenges that could affect its further development, adoption, and use, and therefore our business. AI algorithms may be flawed. Datasets in AI training, development, or operations may be insufficient, of poor quality, or reflect unwanted forms of bias. Inappropriate or controversial data practices by, or practices reflecting inherent biases of, data scientists, engineers, and end users of our systems could impair the acceptance of AI solutions. Third-party AI capabilities that can be integrated with our platforms could also produce false or “hallucinatory” inferences about customer data or enterprises, or other information or subject matter. If the recommendations, forecasts, or analyses that AI applications assist in producing are deficient or inaccurate, we could be subjected to competitive harm, potential legal liability, and brand or reputational harm. Some AI scenarios present ethical issues, and the enablement or integration of AI into our platforms may subject us to new or heightened legal, regulatory, ethical, or other challenges.

Current wording

AI is enabled by or integrated into some of the C3 Agentic AI Platform, including C3 Generative AI, and is a significant and growing element of our business. As with many developing technologies, AI presents risks and challenges that could affect its further development, adoption, and use, and therefore our business. AI algorithms may be flawed. Datasets in AI training, development, or operations may be insufficient, of poor quality, or reflect unwanted forms of bias. Inappropriate or controversial data practices by, or practices reflecting inherent biases of, data scientists, engineers, and end users of our systems could impair the acceptance of AI solutions. Third-party AI capabilities that can be integrated with our platforms could also produce false or “hallucinatory” inferences about customer data or enterprises, or other information or subject matter. If the recommendations, forecasts, or analyses that AI applications assist in producing are deficient or inaccurate, we could be subjected to competitive harm, potential legal liability, and brand or reputational harm. Some AI scenarios present ethical issues, and the enablement or integration of AI into our platforms may subject us to new or heightened legal, regulatory, ethical, or other challenges.

Previous wording

In addition, the regulatory framework for AI and ML technology is evolving and remains uncertain. It is possible that new laws and regulations will be adopted in the United States and other jurisdictions, or existing laws and regulations may be interpreted in new ways, that would affect the operation of our C3 AI Platform and the way in which we use AI and ML. In Europe, there is a proposed regulation related to AI that, if adopted, could impose onerous obligations related to the use of AI-related systems. Potential government regulation in the space of AI ethics may also increase the burden and cost of research and development in this area. The cost to comply with such laws or regulations could be significant and would increase our operating expenses, which could adversely affect our business, financial condition and results of operations.

Current wording

In addition, the regulatory framework for AI and ML technology is evolving and remains uncertain. It is possible that new laws and regulations will be adopted in the United States and other jurisdictions, or existing laws and regulations may be interpreted in new ways, that would affect the operation of our C3 Agentic AI Platform and the way in which we use AI and ML. In Europe, there is a proposed regulation related to AI that, if adopted, could impose onerous obligations related to the use of AI-related systems. Potential government regulation in the space of AI ethics may also increase the burden and cost of research and development in this area. The cost to comply with such laws or regulations could be significant and would increase our operating expenses, which could adversely affect our business, financial condition and results of operations.

Previous wording

We have Customer-Entities in more than 15 countries, and 14% of our revenue for the fiscal year ended April 30, 2024 was generated from customers outside of North America. As of April 30, 2024, we had ten international sales locations, and we plan to add local sales support in further select international markets over time. We expect to continue to expand our international operations, which may include opening offices in new jurisdictions and providing our C3 AI Software in additional languages. Any new markets or countries into which we attempt to sell subscriptions to our C3 AI Software may not be receptive. For example, we may not be able to expand further in some markets if we are not able to satisfy certain government- and industry-specific requirements. In addition, our ability to manage our business and conduct our operations internationally in the future may require considerable management attention and resources and is subject to the particular challenges of supporting a rapidly growing business in an environment of multiple languages, cultures, customs, legal and regulatory systems, alternative dispute systems, and commercial markets. Future international expansion will require investment of significant funds and other resources. Operating internationally subjects us to new risks and may increase risks that we currently face, including risks associated with:

Current wording

We have Customer-Entities in more than 15 countries, and 11% of our revenue for the fiscal year ended April 30, 2025 was generated from customers outside of North America. As of April 30, 2025, we had ten international sales locations, and we plan to add local sales support in further select international markets over time. We expect to continue to expand our international operations, which may include opening offices in new jurisdictions and providing our C3 AI Software in additional languages. Any new markets or countries into which we attempt to sell subscriptions to our C3 AI Software may not be receptive. For example, we may not be able to expand further in some markets if we are not able to satisfy certain government- and industry-specific requirements. In addition, our ability to manage our business and conduct our operations internationally in the future may require considerable management attention and resources and is subject to the particular challenges of supporting a rapidly growing business in an environment of multiple languages, cultures, customs, legal and regulatory systems, alternative dispute systems, and commercial markets. Future international expansion will require investment of significant funds and other resources. Operating internationally subjects us to new risks and may increase risks that we currently face, including risks associated with:

Previous wording

As of April 30, 2024, we had net operating loss carryforwards, or NOLs, for U.S. federal and state purposes of $599.3 million and $249.3 million, respectively, which may be available to offset taxable income in the future, and portions of which expire in various years beginning in 2029. A lack of future taxable income would adversely affect our ability to utilize these NOLs before they expire. Under the Tax Cuts and Jobs Act of 2017, or the Tax Act, as modified by the Coronavirus Aid, Relief, and Economic Security Act, or CARES Act, federal NOLs incurred in tax years beginning after December 31, 2017 may be carried forward indefinitely, but the deductibility of such federal NOLs in tax years beginning after December 31, 2020 is limited to 80% of taxable income. It is uncertain if and to what extent various states will conform to the Tax Act or the CARES Act. In addition, under Section 382 of the Internal Revenue Code of 1986, as amended, or the Code, a corporation that undergoes an “ownership change” (as defined under Sections 382 and 383 of the Code and applicable Treasury Regulations) is subject to limitations on its ability to utilize its pre-change NOLs and certain other tax attributes to offset post-change taxable income or taxes. We may experience a future ownership change under Section 382 of the Code that could affect our ability to utilize our NOLs to offset our income. Furthermore, our ability to utilize NOLs of companies that we have acquired or may acquire in the future may be subject to limitations. In addition, at the state level, there may be periods during which the use of NOLs is suspended or otherwise limited, which could accelerate or permanently increase state taxes owed. For example, on June 29, 2020, the Governor of California signed into law the 2020 Budget Act which temporarily suspended the utilization of NOLs and limits the utilization of research credits to $5.0 million annually for 2020, 2021, and 2022. For these reasons, we may not be able to utilize a material portion of the NOLs reflected on our balance sheet, even if we attain profitability, which could potentially result in increased future tax liability to us and could adversely affect our operating results and financial condition.

Current wording

As of April 30, 2025, we had net operating loss carryforwards, or NOLs, for U.S. federal and state purposes of $764.7 million and $310.7 million, respectively, which may be available to offset taxable income in the future, and portions of which expire in various years beginning in 2029. A lack of future taxable income would adversely affect our ability to utilize these NOLs before they expire. Under the Tax Cuts and Jobs Act of 2017, or the Tax Act, as modified by the Coronavirus Aid, Relief, and Economic Security Act, or CARES Act, federal NOLs incurred in tax years beginning after December 31, 2017 may be carried forward indefinitely, but the deductibility of such federal NOLs in tax years beginning after December 31, 2020 is limited to 80% of taxable income. It is uncertain if and to what extent various states will conform to the Tax Act or the CARES Act. In addition, under Section 382 of the Internal Revenue Code of 1986, as amended, or the Code, a corporation that undergoes an “ownership change” (as defined under Sections 382 and 383 of the Code and applicable Treasury Regulations) is subject to limitations on its ability to utilize its pre-change NOLs and certain other tax attributes to offset post-change taxable income or taxes. We may experience a future ownership change under Section 382 of the Code that could affect our ability to utilize our NOLs to offset our income. Furthermore, our ability to utilize NOLs of companies that we have acquired or may acquire in the future may be subject to limitations. In addition, at the state level, there may be periods during which the use of NOLs is suspended or otherwise limited, which could accelerate or permanently increase state taxes owed. For example, on June 29, 2020, the Governor of California signed into law the 2020 Budget Act which temporarily suspended the utilization of NOLs and limits the utilization of research credits to $5.0 million annually for 2020, 2021, and 2022. Similar legislation was signed on June 27, 2024 which temporarily suspends the utilization of NOLs and limits the utilization of credits to $5.0 million annually for 2024, 2025, and 2026 for certain taxpayers. For these reasons, we may not be able to utilize a material portion of the NOLs reflected on our balance sheet, even if we attain profitability, which could potentially result in increased future tax liability to us and could adversely affect our operating results and financial condition.

Previous wording

As of April 30, 2024, our technology is protected by a broad patent portfolio, with 23 issued patents in the United States, 15 issued counterpart patents in a number of international jurisdictions, over 45 patent applications pending in the United States, and 85 patent applications pending internationally. Our issued patents expire beginning in 2033 through 2040. We continually review our development efforts to assess the existence and patentability of new intellectual property. The pending patent applications are presently undergoing examination or expected to undergo examination in the near future. These patents and patent applications seek to protect our proprietary inventions relevant to our business, in addition to other proprietary technologies which are maintained as trade secrets. We intend to pursue additional intellectual property protection to the extent we believe it would be beneficial and cost-effective. We make business decisions about when to seek patent protection for a particular technology and when to rely upon copyright or trade secret protection, and the approach we select may ultimately prove to be inadequate. Even in cases where we seek patent protection, there is no assurance that the resulting patents will effectively protect every significant feature of our C3 AI Software. In addition, we believe that the protection of our trademark rights is an important factor in AI platform and application recognition, protecting our brand and maintaining goodwill. If we do not adequately protect our rights in our trademarks from infringement and unauthorized use, any goodwill that we have developed in those trademarks could be lost or impaired, which could harm our brand and our business. Third parties may knowingly or unknowingly infringe our proprietary rights, third parties may challenge our proprietary rights, pending and future patent, trademark and copyright applications may not be approved, and we may not be able to defend against or prevent infringement without incurring substantial expense. We have also devoted substantial resources to the development of our proprietary technologies and related processes. In order to protect our proprietary technologies and processes, we rely in part on trade secret laws and confidentiality agreements with our employees, consultants, and third parties. These agreements may not effectively prevent unauthorized disclosure of confidential information and may not provide an adequate remedy in the event of unauthorized disclosure of confidential information. In addition, others may independently discover our trade secrets, in which case we would not be able to assert trade secret rights or develop similar technologies and processes. Further, laws in certain jurisdictions may afford little or no trade secret protection, and any changes in, or unexpected interpretations of, the intellectual property laws in any country in which we operate may compromise our ability to enforce our intellectual prope…

Excerpt shortened here; the source contains the full paragraph.

Current wording

As of April 30, 2025, our technology is protected by a broad patent portfolio, with 35 issued patents in the United States, 30 issued counterpart patents in a number of international jurisdictions, over 60 patent applications pending in the United States, and 104 patent applications pending internationally. Our issued patents expire beginning in 2033 through 2043. We continually review our development efforts to assess the existence and patentability of new intellectual property. The pending patent applications are presently undergoing examination or expected to undergo examination in the near future. These patents and patent applications seek to protect our proprietary inventions relevant to our business, in addition to other proprietary technologies which are maintained as trade secrets. We intend to pursue additional intellectual property protection to the extent we believe it would be beneficial and cost-effective. We make business decisions about when to seek patent protection for a particular technology and when to rely upon copyright or trade secret protection, and the approach we select may ultimately prove to be inadequate. Even in cases where we seek patent protection, there is no assurance that the resulting patents will effectively protect every significant feature of our C3 AI Software. In addition, we believe that the protection of our trademark rights is an important factor in AI platform and application recognition, protecting our brand and maintaining goodwill. If we do not adequately protect our rights in our trademarks from infringement and unauthorized use, any goodwill that we have developed in those trademarks could be lost or impaired, which could harm our brand and our business. Third parties may knowingly or unknowingly infringe our proprietary rights, third parties may challenge our proprietary rights, pending and future patent, trademark and copyright applications may not be approved, and we may not be able to defend against or prevent infringement without incurring substantial expense. We have also devoted substantial resources to the development of our proprietary technologies and related processes. In order to protect our proprietary technologies and processes, we rely in part on trade secret laws and confidentiality agreements with our employees, consultants, and third parties. These agreements may not effectively prevent unauthorized disclosure of confidential information and may not provide an adequate remedy in the event of unauthorized disclosure of confidential information. In addition, others may independently discover our trade secrets, in which case we would not be able to assert trade secret rights or develop similar technologies and processes. Further, laws in certain jurisdictions may afford little or no trade secret protection, and any changes in, or unexpected interpretations of, the intellectual property laws in any country in which we operate may compromise our ability to enforce our intellectual prop…

Excerpt shortened here; the source contains the full paragraph.

Previous wording

Short selling is the practice of selling securities that the seller does not own but rather has borrowed or intends to borrow from a third party with the intention of later buying lower priced identical securities to return to the lender. Accordingly, it is in the interest of a short seller of our Class A common stock for the price to decline. At any time, short sellers may publish, or arrange for the publication of, opinions or characterizations that are intended to create negative market momentum. Issuers, like us, whose securities have historically had limited trading history or volumes and/or have been susceptible to relatively high volatility levels can be vulnerable to such short seller attacks. Short selling reports can cause increased volatility in an issuer’s stock price, and result in regulatory and governmental inquiries. On April 4, 2023, a short seller report was published which contained certain allegations against us. Any inquiry or formal investigation from a governmental organization or other regulatory body, including any inquiry from the SEC or the U.S. Department of Justice, could result in a material diversion of our management’s time and could have a material adverse effect on our business and results of operations.

Current wording

Short selling is the practice of selling securities that the seller does not own but rather has borrowed or intends to borrow from a third party with the intention of later buying lower priced identical securities to return to the lender. Accordingly, it is in the interest of a short seller of our Class A common stock for the price to decline. At any time, short sellers may publish, or arrange for the publication of, opinions or characterizations that are intended to create negative market momentum. Issuers, like us, whose securities have historically had limited trading history or volumes and/or have been susceptible to relatively high volatility levels can be vulnerable to such short seller attacks. Short selling reports can cause increased volatility in an issuer’s stock price, and result in regulatory and governmental inquiries. Any inquiry or formal investigation from a governmental organization or other regulatory body, including any inquiry from the SEC or the U.S. Department of Justice, could result in a material diversion of our management’s time and could have a material adverse effect on our business and results of operations.

Previous wording

Our Class B common stock has 50 votes per share, and our Class A common stock has one vote per share. As of April 30, 2024, Mr. Siebel and related entities beneficially owned approximately 87.8% of our Class B common stock and approximately 21.3% of our outstanding Class A common stock, resulting in beneficial ownership of capital stock representing approximately 54.4% of the voting power of our outstanding capital stock. Therefore, Mr. Siebel has control over our management and affairs and over all matters requiring stockholder approval, including election of directors and significant corporate transactions, such as a merger or other sale of us or our assets. This concentrated control will limit your ability to influence corporate matters for the foreseeable future, and, as a result, the market price of our Class A common stock could be adversely affected.

Current wording

Our Class B common stock has 50 votes per share, and our Class A common stock has one vote per share. As of April 30, 2025, Mr. Siebel and related entities beneficially owned approximately 87.8% of our Class B common stock and approximately 19.4% of our outstanding Class A common stock, resulting in beneficial ownership of capital stock representing approximately 52.4% of the voting power of our outstanding capital stock. Therefore, Mr. Siebel has control over our management and affairs and over all matters requiring stockholder approval, including election of directors and significant corporate transactions, such as a merger or other sale of us or our assets. This concentrated control will limit your ability to influence corporate matters for the foreseeable future, and, as a result, the market price of our Class A common stock could be adversely affected.

Previous wording

As of April 30, 2024, there were outstanding options to purchase an aggregate of approximately 31,371,094 shares of our Class A common stock, and approximately 19,283,146 shares of our Class A common stock subject to restricted stock unit awards. We have registered all of the shares of Class A common stock issuable upon exercise of outstanding options and upon exercise or settlement of any options or other equity incentives we may grant in the future for public resale under the Securities Act. Accordingly, these shares will become eligible for sale in the public market to the extent any such equity awards are exercised or settled for shares of Class A common stock, subject to compliance with applicable securities laws. In addition, certain of our stockholders have registration rights that would require us to register shares owned by them for public sale in the United States.

Current wording

As of April 30, 2025, there were outstanding options to purchase an aggregate of approximately 28,477,000 shares of our Class A common stock, and approximately 23,774,000 shares of our Class A common stock subject to restricted stock unit awards. We have registered all of the shares of Class A common stock issuable upon exercise of outstanding options and upon exercise or settlement of any options or other equity incentives we may grant in the future for public resale under the Securities Act. Accordingly, these shares will become eligible for sale in the public market to the extent any such equity awards are exercised or settled for shares of Class A common stock, subject to compliance with applicable securities laws. In addition, certain of our stockholders have registration rights that would require us to register shares owned by them for public sale in the United States.