MITEK SYSTEMS INC

Previous wording

•Evolving domestic and international data privacy and Artificial Intelligence laws and regulations may restrict our ability, and that of our customers, to solicit, collect, process, transfer, disclose and use personal information or may increase the costs of doing so, which could harm our business.

Current wording

•Evolving domestic and international data privacy and AI laws and regulations may restrict our ability, and that of our customers, to solicit, collect, process, transfer, disclose and use personal information or may increase the costs of doing so, which could harm our business.

Previous wording

•Our business and operations are subject to a variety of regulatory requirements in the countries in which we operate or in which we offer our solutions, including, among other things, with respect to artificial intelligence (“AI”) and machine-learning (“ML”) technologies that may be difficult and expensive to comply with and that could negatively impact our business.

Current wording

•Our business and operations are subject to a variety of regulatory requirements in the countries in which we operate or in which we offer our solutions, including, among other things, with respect to AI and ML technologies that may be difficult and expensive to comply with and that could negatively impact our business.

Previous wording

•We have identified material weaknesses in our internal control over financial reporting, and if our remediation of such material weaknesses is not effective, or if we fail to develop and maintain an effective system of disclosure controls and internal control over financial reporting, our ability to produce timely and accurate financial statements or comply with applicable laws and regulations could be impaired.

Current wording

•Although we have concluded that previously identified material weaknesses in our internal control over financial reporting have been remediated, if such remediation was not effective, or if we identify additional material weaknesses in internal control over financial reporting, our ability to produce timely and accurate financial statements or comply with applicable laws and regulations could be impaired.

Previous wording

Since 2018, United Services Automobile Association (“USAA”) has filed suit against various parties alleging patent infringement concerning four USAA-owned patents related to mobile deposits, including Wells Fargo Bank, N.A. (“Wells Fargo”) and PNC Bank. While these lawsuits do not name the Company as a defendant, given (among other factors) the Company’s prior history of litigation with USAA and the continued use of the Company’s products by its customers, on November 1, 2019, the Company filed a complaint in the U.S. District Court for the Northern District of California seeking declaratory judgment that its products do not infringe certain patents held by USAA (collectively, the “Subject Patents”). On January 15, 2020, USAA filed motions requesting the dismissal of the declaratory judgement of the Subject Patents and transfer of the case to the Eastern District of Texas, both of which the Company opposed. On April 21, 2020, the Court in the Northern District of California transferred the Company’s declaratory judgement action to the Eastern District of Texas and did not rule on USAA’s motion to dismiss. On April 28, 2021, the Court in the Eastern District of Texas granted USAA’s motion to dismiss the Company’s declaratory judgment action on jurisdictional grounds. The Court’s ruling did not address the merits of the Company’s claim of non-infringement. The Company appealed the ruling on the motion to dismiss and the decision to transfer the declaratory judgment action from California to Texas to the U.S. Court of Appeals for the Federal Circuit. The Federal Circuit heard oral argument on the Company’s appeal on April 4, 2022 and on May 20 2022, issued an opinion vacating and remanding the district court’s order granting USAA’s motion to dismiss. On August 1, 2022, the parties submitted additional briefing to the district court in light of Federal Circuit’s opinion. The court held another hearing on USAA’s motion to dismiss the Company’s declaratory judgment action on jurisdictional grounds, and once again granted USAA’s motion to dismiss on February 23, 2023. The Company timely filed a notice of appeal to the U.S. Court of Appeals for the Federal Circuit. The appeal is fully briefed, and the Company is awaiting oral argument. The Company continues to believe that its products do not infringe the Subject Patents and will vigorously defend the right of its end-users to use its technology.

Current wording

Since 2018, United Services Automobile Association (“USAA”) has filed suit against various parties alleging patent infringement concerning USAA-owned patents related to mobile deposits, including Wells Fargo Bank, N.A. (“Wells Fargo”) and PNC Bank. While these lawsuits do not name the Company as a defendant, given (among other factors) the Company’s prior history of litigation with USAA and the continued use of the Company’s products by its customers, on November 1, 2019, the Company filed a complaint in the U.S. District Court for the Northern District of California seeking declaratory judgment that its products do not infringe certain patents held by USAA (collectively, the “Subject Patents”), which USAA sought to dismiss for lack of standing. Following various appeals and transfers, on June 12, 2025, the U.S. Court of Appeals for the Federal Circuit affirmed the dismissal of the action for lack of standing, but did not address the merits of the case. The Company chose not to appeal this decision. The Company continues to believe that its products do not infringe the Subject Patents and will vigorously defend the right of its end-users to use its technology.

Previous wording

Our ability to compete effectively depends upon our ability to meet changing market conditions and develop enhancements to our products on a timely basis in order to maintain our competitive advantage. The markets for products incorporating mobile imaging and voice software technology and products are characterized by rapid advancements in technology and changes in user preferences. Our continued growth will ultimately depend upon our ability to develop additional technologies and attract strategic alliances for related or separate products. There can be no assurance that we will be successful in developing and marketing product enhancements and additional technologies, that we will not experience difficulties that could delay or prevent the successful development, introduction and marketing of these products, or that our new products and product enhancements will adequately meet the requirements of the marketplace, will be of acceptable quality, or will achieve market acceptance.

Current wording

Our ability to compete effectively depends upon our ability to meet changing market conditions and develop enhancements to our products on a timely basis in order to maintain our competitive advantage. The markets for products incorporating mobile imaging and voice software technology and products are characterized by rapid advancements in technology and changes in user preferences. Our continued growth will ultimately depend upon our ability to develop additional technologies, enhance our existing applications to meet customers’ changing needs, and attract strategic alliances for related or separate products. When we develop a new offering or an enhanced version of an existing offering, we typically incur expenses and expend resources upfront to market, promote and sell the new offering. Therefore, when we develop or acquire new or enhanced offerings, their introduction must achieve high levels of market acceptance in order to justify the amount of our investment in developing and bringing them to market. There can be no assurance that we will be successful in developing and marketing product enhancements and additional technologies, that we will not experience difficulties that could delay or prevent the successful development, introduction and marketing of these products, or that our new products and product enhancements will adequately meet the requirements of the marketplace, will be of acceptable quality, or will achieve market acceptance.

Previous wording

Historically, sales of licenses to our channel partners have comprised a significant part of our revenue. This is attributable to the timing of the purchase or renewal of licenses and does not represent a dependence on any single channel partner. If we were to lose a channel partner relationship, we do not believe such a loss would adversely affect our operations because either we or another channel partner could sell our products to the end-users that had purchased products from the channel partner we lost. However, in that case, we or another channel partner must establish a relationship with the end-users, which could take time to develop, if it develops at all.

Current wording

Historically, sales of licenses to our channel partners have comprised a significant part of our revenue. This is primarily attributable to the timing of the purchase or renewal of licenses and does not represent a dependence on any single channel partner. The loss of a channel partner relationship could adversely affect our operations which we would attempt to mitigate through the assignment of such business to another channel partner or through our own licensing of our products to the end-users that had purchased products from the channel partner we lost. However, in that case, we or another channel partner must establish a relationship with the end-users, which could take time to develop, if it develops at all.

Previous wording

•lack of familiarity with, and unexpected changes in, foreign laws and legal standards, including employment laws, Artificial Intelligence, and privacy laws, which may vary widely across the countries in which we sell our products;

Current wording

•lack of familiarity with, and unexpected changes in, foreign laws and legal standards, including employment laws, AI, and privacy laws, which may vary widely across the countries in which we sell our products;

Previous wording

•compliance with differing and changing local laws and regulations in multiple domestic and international jurisdictions, including Artificial Intelligence and data privacy laws, as well as compliance with U.S. laws and regulations where applicable in these jurisdictions; and

Current wording

•compliance with differing and changing local laws and regulations in multiple domestic and international jurisdictions, including AI and data privacy laws, as well as compliance with U.S. laws and regulations where applicable in these jurisdictions; and

Previous wording

The transfer of personal data from the European Union (“EU”) to the U.S. has become a significant area of potential operational and compliance risk. In 2023, the Data Privacy Framework was introduced as a new mechanism for companies to transfer data from EU member states, the United Kingdom, or Switzerland to the U.S after its predecessor, the Data Privacy Shield, was invalidated. The EU, the United Kingdom, and Switzerland also allow the use of Standard Contractual Clauses (SCCs), but some decisions have indicated that Compliance with new transfer frameworks require significant effort for companies to review and revise their procedures and current EU-U.S. data transfer agreements. NYOB and its founder Max Schrems, the parties responsible for initiating actions to invalidate the previous Frameworks, have indicated it will bring similar challenges against the Data Privacy Framework. Because of the legal challenges presented by these court and data protection authority decisions, there is continuing uncertainty regarding the legal basis for data transfers to the U.S., which could lead to interruption of such transfers. The complex nature and shifting laws related to EU/UK/Switzerland to U.S. data transfers could cause operational interruptions, liabilities and reputational harm. These and other requirements could increase the cost of compliance for us and our customers, restrict our and our customers’ ability to store and process data, negatively impact our ability to offer our solutions in certain locations and limit our customers’ ability to deploy our solutions globally. These consequences may be more significant in countries with legislation that requires data to remain localized “in country,” as this could require us or our customers to establish data storage in other jurisdictions or apply local operational processes that are difficult and costly to integrate with global processes.

Current wording

The transfer of personal data from the European Union (“EU”) to the U.S. has become a significant area of potential operational and compliance risk. In 2023, the Data Privacy Framework was introduced as a new mechanism for companies to transfer data from EU member states, the United Kingdom, or Switzerland to the U.S after its predecessor, the Data Privacy Shield, was invalidated. We currently participate in the EU‑U.S. Data Privacy Framework and its UK Extension and Swiss‑U.S. Data Privacy Framework. The EU, the United Kingdom, and Switzerland also allow the use of Standard Contractual Clauses (SCCs), but some decisions have indicated that compliance with these transfer frameworks requires significant effort for companies to review and revise their procedures and current EU-U.S. data transfer agreements. NOYB, or the European Center for Digital Rights, and its founder Max Schrems, the parties responsible for initiating actions to invalidate the previous frameworks, have indicated it will bring similar challenges against the Data Privacy Framework. Because of the legal challenges presented by these court and data protection authority decisions, there is continuing uncertainty regarding the legal basis for data transfers to the U.S., which could require us to implement additional measures, limit or suspend certain transfers, or, in some cases, cease such transfers. The complex nature and evolving laws related to

Previous wording

If we fail to comply with such laws and regulations, we may be subject to significant fines, penalties or liabilities for noncompliance, thereby harming our business. For example, in 2016, the EU adopted the General Data Protection Regulation (“GDPR”), which establishes new requirements regarding the handling of personal data and which became effective in May 2018. Non-compliance with the GDPR may result in monetary penalties of up to 4% of worldwide revenue.

Current wording

If we fail to comply with such laws and regulations, we may be subject to significant fines, penalties or liabilities for noncompliance, thereby harming our business. For example, in 2016, the EU adopted the General Data Protection Regulation (“GDPR”), which establishes comprehensive requirements regarding the handling of personal data and which became effective in May 2018. Non-compliance with the GDPR may result in monetary penalties of up to the greater of€20 million or 4% of worldwide annual revenue, and materially similar penalties may apply under the UK GDPR.

Previous wording

Due to our international operations, we are subject to certain foreign tax regulations. Such regulations may not be clear, not consistently applied, and subject to sudden change, particularly with regard to international transfer pricing. Our earnings could be reduced by the uncertain and changing nature of such tax regulations.

Current wording

Due to our international operations, we are subject to certain foreign tax regulations. Such regulations may not be clear, not consistently applied, and be subject to sudden change, particularly with regard to international transfer pricing. Our earnings could be reduced by the uncertain and changing nature of such tax regulations.

Previous wording

A substantial portion of our total revenues in any given period may come from a relatively small number of customers. For the twelve months ended September 30, 2024, the Company derived revenue of $29.6 million from one customer, with such customer accounting for 17% of the Company’s total revenue. For the twelve months ended September 30, 2023, the Company derived revenue of $27.7 million from the same single customer, with such customer accounting for 16% of the Company's total revenue. For the twelve months ended September 30, 2022, the Company derived revenue of $25.0 million from the same single customer, with such customer accounting for 17% of the Company’s total revenue. We expect that we will continue to depend upon a relatively small number of customers for a significant portion of our total revenues for the foreseeable future. The loss of any of our significant customers or groups of customers for any reason, or a change of relationship with any of our key customers may cause a significant decrease in our total revenues. Additionally, mergers or consolidations among our customers could reduce the number of our customers and could adversely affect our revenues and sales. In particular, if our customers are acquired by entities that are not also our customers, that do not use our solutions or that have more favorable contract terms and choose to discontinue, reduce or change the terms of their use of our solutions, our business and operating results could be materially and adversely affected.

Current wording

A substantial portion of our total revenues in any given period may come from a relatively small number of customers. For the twelve months ended September 30, 2025, the Company derived revenue of $26.9 million from one customer, with such customer accounting for 15% of the Company’s total revenue. For the twelve months ended September 30, 2024, the Company derived revenue of $29.6 million from the same single customer, with such customer accounting for 17% of the Company's total revenue. For the twelve months ended September 30, 2023, the Company derived revenue of $27.7 million from the same single customer, with such customer accounting for 16% of the Company’s total revenue. We expect that we will continue to depend upon a relatively small number of customers for a significant portion of our total revenues for the foreseeable future. The loss of any of our significant customers or groups of customers for any reason, or a change of relationship with any of our key customers may cause a significant decrease in our total revenues. Additionally, mergers or consolidations among our customers could reduce the number of our customers and could adversely affect our revenues and sales. In particular, if our customers are acquired by entities that are not also our customers, that do not use our solutions or that have more favorable contract terms and choose to discontinue, reduce or change the terms of their use of our solutions, our business and operating results could be materially and adversely affected.

Previous wording

Evolving domestic and international data privacy and Artificial Intelligence laws and regulations may restrict our ability, and that of our customers, to solicit, collect, process, transfer, disclose and use personal information or may increase the costs of doing so, which could harm our business.

Current wording

Evolving domestic and international data privacy and AI laws and regulations may restrict our ability, and that of our customers, to solicit, collect, process, transfer, disclose and use personal information or may increase the costs of doing so, which could harm our business.

Previous wording

Federal, state and foreign governments and supervising authorities have enacted, and may in the future enact, laws and regulations concerning the solicitation, collection, processing, disclosure, transfer and use of personal information. Such laws and regulations require or may in the future require us or our customers to implement additional and revise existing privacy and security policies and practices; permit individuals to access, correct or delete personal information stored or maintained by us or our customers; inform individuals of security breaches that affect their personal information; and, in some cases, obtain consent to use certain personal information for certain purposes. Other proposed laws and regulations could, if enacted, impose additional requirements and prohibit the use of specific technologies, such as those that track individuals' activities on web pages or record when individuals click on a link contained in an email message and systems reliant on such technologies. Such laws and regulations could restrict our and our customers' ability to collect and use web browsing data and personal information, which may reduce our customers' demand for our solutions. The laws in this area are complex and developing rapidly.

Current wording

Federal, state and foreign governments and supervising authorities have enacted, and may in the future enact, laws and regulations concerning the solicitation, collection, processing, disclosure, transfer and use of personal information. Such laws and regulations require or may in the future require us or our customers to implement additional and revise existing privacy and security policies and practices; permit individuals to access, correct or delete personal information stored or maintained by us or our customers; inform individuals of security breaches that affect their personal information; and, in some cases, obtain consent to use certain personal information for certain purposes. Many of these laws also impose data minimization, purpose‑limitation, and security obligations; restrict certain types of automated decision‑making and profiling; and require data protection impact assessments, vendor diligence, and contractual controls. Other proposed laws and regulations could, if enacted, impose additional requirements and prohibit the use of specific technologies, such as those that track individuals' activities on web pages or record when individuals click on a link contained in an email message and systems reliant on such technologies. In addition, restrictions on cross‑border transfers of personal data (including requirements for standard contractual clauses, transfer impact assessments, or participation in certification mechanisms) may limit how we provide services across jurisdictions and increase compliance costs. Such laws and regulations could restrict our and our customers' ability to collect and use web browsing data and personal information, which may reduce our customers' demand for our solutions. The laws in this area are complex and developing rapidly. Non‑compliance can result in investigations, orders, suspension of processing, or significant administrative fines, as well as private litigation where available.

Previous wording

In the United States, many states have adopted legislation that regulates how businesses operate online, including measures relating to privacy, data security and data breaches. Laws in all states require businesses to provide notice to customers whose personal information has been disclosed as a result of a data breach. The laws are not identical, and compliance in the event of a widespread data breach is costly, as we must ensure our compliance with each individual state law. Further, states have continued adopting new laws or amending existing laws, requiring attention to frequently changing regulatory requirements. For example, California enacted the California Consumer Privacy Act (the “CCPA”) on June 28, 2018, which went into effect on January 1, 2020. The CCPA gives California residents expanded rights to access and delete their personal information, opt out of certain personal information sharing and receive detailed information about how their personal information is used by requiring covered companies to provide new disclosures to California consumers (as that term is broadly defined) and provides such consumers new ways to opt-out of certain sales of personal information. The CCPA provides for civil penalties for violations, as well as a private right of action for data breaches that is expected to increase data breach litigation. The CCPA may increase our compliance costs and potential liability. The California Privacy Rights Act (the “CPRA”) revised and expanded the CCPA, adding additional data protection obligations on covered businesses, including additional consumer rights processes, limitations on data uses, new audit requirements for higher risk data, and opt outs for certain uses of sensitive data. It also created a new California data protection agency authorized to issue substantive regulations and could result in increased privacy and information security enforcement. The CPRA was in full effect as of January 1, 2023. Similar laws passed in Virginia, Colorado, Connecticut, and Utah took effect in 2023. Additionally, Delaware, Indiana, Iowa, Montana, Oregon, Tennessee, Texas, Kentucky, Maryland, Minnesota, Nebraska, New Hampshire, New Jersey, and Rhode Island have adopted privacy laws, which take effect at different dates through 2026. Additional U.S. states have enacted, or are considering, similar data privacy laws. We cannot fully predict the impact of these state laws on our business or operations, but it may require us to modify our data processing practices and policies and to incur substantial costs and expenses in an effort to comply. We expect that new legislation proposed or enacted in various other states will continue to shape the data privacy environment nationally. Certain state laws may be more stringent or broader in scope, or offer greater individual rights, with respect to confidential, sensitive and personal information than federal, international or other state laws, and such laws may differ from each othe…

Excerpt shortened here; the source contains the full paragraph.

Current wording

In the United States, many states have adopted legislation that regulates how businesses operate online, including measures relating to privacy, data security and data breaches. Laws in all states require businesses to provide notice to customers whose personal information has been disclosed as a result of a data breach. The laws are not identical, and compliance in the event of a widespread data breach is costly, as we must ensure our compliance with each individual state law. Further, states have continued adopting new laws or amending existing laws, requiring attention to frequently changing regulatory requirements. For example, California enacted the California Consumer Privacy Act (the “CCPA”) on June 28, 2018, which went into effect on January 1, 2020. The CCPA gives California residents expanded rights to access and delete their personal information, opt out of certain personal information sharing and receive detailed information about how their personal information is used by requiring covered companies to provide new disclosures to California consumers (as that term is broadly defined) and provides such consumers new ways to opt-out of certain sales of personal information. California regulations also require recognition of certain browser‑ or device‑based opt‑out signals (such as Global Privacy Control) and impose specific obligations for targeted advertising and “sharing” of personal information. The CCPA provides for civil penalties for violations, as well as a private right of action for data breaches that is expected to increase data breach litigation. The CCPA may increase our compliance costs and potential liability. The California Privacy Rights Act (the “CPRA”) revised and expanded the CCPA, adding additional data protection obligations on covered businesses, including additional consumer rights processes, limitations on data uses, new audit requirements for higher risk data, and opt outs for certain uses of sensitive data. It also created a new California data protection agency authorized to issue substantive regulations and could result in increased privacy and information security enforcement. The CPRA was in full effect as of January 1, 2023. Similar laws passed in Virginia, Colorado, Connecticut, and Utah took effect in 2023. Additionally, Delaware, Indiana, Iowa, Montana, Oregon, Tennessee, Texas, Kentucky, Maryland, Minnesota, Nebraska, New Hampshire, New Jersey, and Rhode Island have adopted privacy laws, which take effect at different dates through 2026. Many of these state laws include requirements regarding data protection assessments, processing of sensitive data, consumer appeals of automated decision‑making, universal opt‑out mechanisms, and restrictions on targeted advertising and profiling that may require us to modify products and operational practices. Additional U.S. states have enacted, or are considering, similar data privacy laws. We cannot fully predict the impact of these state laws on our business or ope…

Excerpt shortened here; the source contains the full paragraph.

Previous wording

Changing industry standards and industry self-regulation regarding the collection, use and disclosure of data may have similar effects. Existing and future privacy and data protection laws and increasing sensitivity of consumers to unauthorized disclosures and use of personal information may also negatively affect the public's perception of our customers' sales practices. If our solutions are perceived to cause, or are otherwise unfavorably associated with, insecurity of personal information, whether or not illegal, we or our customers may be subject to public criticism. Public concerns regarding data collection, privacy and security may also cause some consumers to be less likely to visit our customers' websites or otherwise interact with our customers, which could limit the demand for our solutions and inhibit the growth of our business. Any failure on our part to comply with applicable privacy and data protection laws, regulations, policies and standards or any inability to adequately address privacy or security concerns associated with our solutions, even if unfounded, could subject us to liability, damage our reputation, impair our sales and harm our business. Furthermore, the costs to our customers of compliance with, and other burdens imposed by, such laws, regulations, policies and standards may limit adoption of and demand for our solutions.

Current wording

Changing industry standards and industry self-regulation regarding the collection, use and disclosure of data may have similar effects. Existing and future privacy and data protection laws and increasing sensitivity of consumers to unauthorized disclosures and use of personal information may also negatively affect the public's perception of our customers' sales practices. If our solutions are perceived to cause, or are otherwise unfavorably associated with, insecurity of personal information, whether or not illegal, we or our customers may be subject to public criticism. Public concerns regarding data collection, privacy and security may also cause some consumers to be less likely to visit our customers' websites or otherwise interact with our customers, which could limit the demand for our solutions and inhibit the growth of our business. Any failure on our part to comply with applicable privacy and data protection laws, regulations, policies and standards or any inability to adequately address privacy or security concerns associated with our solutions, even if unfounded, could subject us to liability, damage our reputation, impair our sales and harm our business. Furthermore, the costs to our customers of compliance with, and other burdens imposed by, such laws, regulations, policies and standards may limit adoption of and demand for our solutions. In addition, changes by major platforms and browsers including restrictions on third‑party cookies, mobile advertising identifiers, and tracking technologies, as well as evolving email and anti‑spam rules may reduce the effectiveness of certain features or require product changes, engineering workarounds, and increased costs.

Previous wording

Some of our solutions require the storage and transmission of proprietary and confidential information of our clients and their employees, including biometric data. Several jurisdictions have imposed legal and compliance requirements on biometric data that are more stringent than requirements on other classifications of personal data. For example, under GDPR, biometric data is considered “sensitive data” which requires special attention and technical and organizational measures to protect the biometric data against breaches of confidentiality, integrity, and availability. The processing of biometric data for such purposes is prohibited unless one of a very limited and specific set of conditions is satisfied (such as explicit consent of the data subject). Effective compliance in this area (including in the context of use of certain of our products) can be highly challenging, and we are reliant on our customers to ensure that such a condition is satisfied when they use our products to identify someone. We may be unable to provide certain of our products in certain jurisdictions, in particular in Europe where provision of such technologies in compliance with the GDPR is highly challenging.

Current wording

Some of our solutions require the storage and transmission of proprietary and confidential information of our clients and their employees, including biometric data. “In limited cases, we may host and retain biometric templates or identifiers as instructed by our customers, and our ability to meet applicable retention, destruction, and security requirements depends on our customers’ configurations and instructions; any failure to adhere to required retention schedules or provide timely destruction upon request could increase our legal and operational risks.” Several jurisdictions have imposed legal and compliance requirements on biometric data that are more stringent than requirements on other classifications of personal data. For example, under GDPR, biometric data is considered “sensitive data” which requires special attention and technical and organizational measures to protect the biometric data against breaches of confidentiality, integrity, and availability. The processing of biometric data for such purposes is prohibited unless one of a very limited and specific set of conditions is satisfied (such as explicit consent of the data subject). Effective compliance in this area (including in the context of use of certain of our products) can be highly challenging, and we are reliant on our customers to ensure that such a condition is satisfied when they use our products to identify someone. In certain deployments, our customers act as controllers of biometric data and are responsible for providing notices, obtaining any required consents, and defining retention and deletion schedules; we may act as a processor and are dependent on our customers’ instructions to enable compliance. We may be unable to provide certain of our products in certain jurisdictions, in particular in Europe where provision of such technologies in compliance with the GDPR is highly challenging. If we or our customers fail to obtain valid consent or satisfy another lawful basis, or fail to meet requirements relating to purpose limitation, data minimization, retention, security, or cross‑border transfers, we could face investigations, enforcement actions, private claims where available, and substantial penalties.

Previous wording

Similarly, in the United States., the Illinois Biometric Information Privacy Act (“BIPA”) regulates the collection, use, safeguarding, and storage of biometric identifiers and information, requires informed consent before collection, imposes fines for non-compliance, and grants residents a private right of action over improper collection and mishandling of biometric data. BIPA provides for substantial penalties and statutory damages and have generated significant class action activity; the cost of litigating and settling any claims that we have violated the BIPA or similar laws could be significant. Several other states have passed or are considering passing similar laws, such as the Texas Collection and Use of Biometric Information (“CUBI”) Act and the Washington Biometric Data Act. Similarly, Québec's Act respecting the protection of personal data in the private sector (“Law 25” formerly known as “Bill 64”) introduces substantial changes to the privacy landscape in Quebec, enhancing protection for personal data and introducing new obligations for transparency and accountability in data processing activities, including those involving biometric data.

Current wording

Similarly, in the United States, the Illinois Biometric Information Privacy Act (“BIPA”) regulates the collection, use, safeguarding, and storage of biometric identifiers and information, requires informed consent before collection, imposes fines for non-compliance, and grants residents a private right of action over improper collection and mishandling of biometric data. BIPA provides for substantial penalties and statutory damages and has generated significant class action activity; the cost of litigating and settling any claims that we have violated the BIPA or similar laws could be significant. Several other states have passed or are considering passing similar laws, such as the Texas Collection and Use of Biometric Information (“CUBI”) Act and the Washington Biometric Data Act. Similarly, Québec's Act respecting the protection of personal data in the private sector (“Law 25” formerly known as “Bill 64”) introduces substantial changes to the privacy landscape in Quebec, enhancing protection for personal data and introducing new obligations for transparency and accountability in data processing activities, including those involving biometric data. In addition, comprehensive state privacy laws in several U.S. jurisdictions impose obligations related to sensitive data, impact assessments, automated decision‑making, and consumer rights (such as access, deletion, and opt‑out rights) that can apply to biometric data and may require changes to our products and practices, additional contractual commitments with customers and vendors, and increased compliance costs. Evolving judicial interpretations and legislative amendments (including changes affecting the accrual of claims, available defenses, or the calculation of statutory damages) may increase or, in some cases, mitigate our exposure, but the overall legal risk environment for biometric technologies remains significant and uncertain.

Previous wording

Our business and operations are subject to a variety of regulatory requirements in the countries in which we operate or in which we offer our solutions, including, among other things, with respect to artificial intelligence (“AI”) and machine-learning (“ML”) technologies that may be difficult and expensive to comply with and that could negatively impact our business.

Current wording

Our business and operations are subject to a variety of regulatory requirements in the countries in which we operate or in which we offer our solutions, including, among other things, with respect to AI and ML technologies that may be difficult and expensive to comply with and that could negatively impact our business.

Previous wording

AI, automated decision making, and ML technologies are increasingly subject to regulatory scrutiny and oversight, for example, under the comprehensive legal framework governing the use of artificial intelligence adopted by the European Parliament in the European Union (the “EU AI Act”). The EU AI Act imposes onerous obligations related to the development, deployment and use of AI/ML-related systems. In particular, the EU AI Act is likely to designate certain AI technologies, including technologies used in an employment-related context (such as in relation to recruitment, placement of targeted job advertisements, and decision-making concerning promotion, termination and task allocation), as ‘high risk’ and subject to numerous onerous compliance obligations, including various transparency, conformity and risk assessment, monitoring and human oversight requirements. As our products and services develop, they mall fall within one or more of these categories. Under the EU AI Act, non-compliant companies may be subject to administrative fines of up to 35 million Euros or 7% of a company’s total worldwide annual turnover for the preceding financial year, whichever is the higher. The EU AI Act has a phased implementation process and is likely to be fully effective by Spring 2026. Moreover, in the United Kingdom, the government has confirmed its position that existing regulators are to implement certain specific principles (safety, security and robustness; transparency and explainability; fairness; accountability and governance; contestability and redress), within those regulators’ existing remits, to guide and inform the responsible development and use of AI/ML within their relevant sectors / competences. Additionally, several United States jurisdictions have enacted measures related to the use of AI in products and services for their potentially discriminatory effects. For example, New York City passed a law to regulate the use of automated employment decision tools by employers and employment agencies. Certain of these laws may be materially unfavorable to our interests and/or inconsistent with our existing operations, policies, practices or plans (or may be interpreted as such). We expect other jurisdictions will adopt similar laws.

Current wording

AI, automated decision making, and ML technologies are increasingly subject to regulatory scrutiny and oversight, for example, under the comprehensive legal framework governing the use of AI adopted by the European Parliament in the European Union (the “EU AI Act”). The EU AI Act imposes onerous obligations related to the development, deployment and use of AI/ML-related systems. The EU AI Act classifies certain AI systems as prohibited, imposes transparency requirements on other systems, and designates a broad set of applications as ‘high‑risk’ subject to numerous compliance obligations, including governance, transparency, conformity assessment, quality management, technical documentation, risk management, post‑market monitoring, incident reporting, and human oversight requirements. In particular, the EU AI Act is likely to designate certain AI technologies, including technologies used in an employment-related context (such as in relation to recruitment, placement of targeted job advertisements, and decision-making concerning promotion, termination and task allocation), as ‘high risk’ and subject to numerous onerous compliance obligations, including various transparency, conformity and risk assessment, monitoring and human oversight requirements. As our products and services develop, they may fall within one or more of these categories. Under the EU AI Act, non-compliant companies may be subject to administrative fines of up to 35 million Euros or 7% of a company’s total worldwide annual turnover for the preceding financial year, whichever is the higher. The EU AI Act has a phased implementation process over several years, with certain obligations taking effect earlier than others, and compliance timelines may accelerate if our products are used in contexts deemed high‑risk. The EU AI Act is likely to be fully effective by Spring 2026. Moreover, in the United Kingdom, the government has confirmed its position that existing regulators are to implement certain specific principles (safety, security and robustness; transparency and explainability; fairness; accountability and governance; contestability and redress), within those regulators’ existing remits, to guide and inform the responsible development and use of AI/ML within their relevant sectors / competences. Additionally, several United States jurisdictions have enacted measures related to the use of AI in products and services for their potentially discriminatory effects. For example, New York City passed a law to regulate the use of automated employment decision tools by employers and employment agencies. Other U.S. jurisdictions have adopted or are considering rules addressing profiling, automated decision‑making, audits or impact assessments, and transparency obligations. Certain of these laws may be materially unfavorable to our interests and/or inconsistent with our existing operations, policies, practices or plans (or may be interpreted as such). We expect other jurisdictions will adopt…

Excerpt shortened here; the source contains the full paragraph.

Previous wording

Additionally, certain privacy laws extend rights to consumers (such as the right to delete certain personal data) and regulate automated decision making, which may be incompatible with our use of AI (including generative AI) and ML technologies in our products and services. These obligations may make it harder for us to conduct our business using AI/ML, lead to regulatory fines or penalties, require us to change our business practices, retrain our AI/ML, or prevent or limit our use of AI/ML. For example, the FTC has required other companies to turn over (or disgorge) valuable insights or trainings generated through the use of AI/ML where they allege the company has violated privacy and consumer protection laws. If we cannot use AI/ML or that use is restricted, our business may be less efficient, or we may be at a competitive disadvantage.

Current wording

Additionally, certain privacy laws extend rights to consumers (such as the right to delete certain personal data) and regulate automated decision making, which may be incompatible with our use of AI (including generative AI) and ML technologies in our products and services. These obligations may make it harder for us to conduct our business using AI/ML, lead to regulatory fines or penalties, require us to change our business practices, retrain our AI/ML, or prevent or limit our use of AI/ML. For example, the FTC has required other companies to turn over (or disgorge) valuable insights or trainings generated through the use of AI/ML where they allege the company has violated privacy and consumer protection laws. If we cannot use AI/ML or that use is restricted, our business may be less efficient, or we may be at a competitive disadvantage. We may also be required to provide new disclosures, offer opt‑out rights, conduct impact assessments, or implement additional human review, which could reduce model performance, increase latency, or diminish product functionality. Some of our offerings are used in contexts that may be deemed ‘high‑risk’ under the EU AI Act, which would subject us and our customers to additional governance, documentation, testing, conformity assessment, and post‑market monitoring obligations, and could require material changes to our development and deployment processes.

Previous wording

Moreover, AI/ML models may create flawed, incomplete, or inaccurate outputs, some of which may appear correct. This may happen if the inputs that the model relied on were inaccurate, incomplete or flawed (including if a bad actor “poisons” the AI/ML with bad inputs or logic), or if the logic of the AI/ML is flawed (a so-called “hallucination”). We may use AI/ML outputs to make certain decisions. Due to these potential inaccuracies or flaws, the model could be biased and could lead us to make decisions that could bias certain individuals (or classes of individuals), and adversely impact their rights, employment, and ability to obtain certain pricing, products, services, or benefits.

Current wording

Moreover, AI/ML models may create flawed, incomplete, or inaccurate outputs, some of which may appear correct. This may happen if the inputs that the model relied on were inaccurate, incomplete or flawed (including if a bad actor “poisons” the AI/ML with bad inputs or logic), or if the logic of the AI/ML is flawed (a so-called “hallucination”). We may use AI/ML outputs to make certain decisions. Due to these potential inaccuracies or flaws, the model could be biased and could lead us to make decisions that could bias certain individuals (or classes of individuals), and adversely impact their rights, employment, and ability to obtain certain pricing, products, services, or benefits. If outputs are later deemed unfair, discriminatory, or otherwise unlawful by regulators or courts, we could be required to modify, suspend, or withdraw affected features, provide remediation, or face enforcement actions or private litigation.

Previous wording

Furthermore, any sensitive information (including confidential, competitive, proprietary, or personal data) that we input into a third-party generative AI/machine learning platform could be leaked or disclosed to others, including if sensitive information is used to train the third party’s AI/machine learning model. Additionally, where such a model ingests personal data and makes connections using such data, those technologies may reveal other personal or sensitive information generated by the model.

Current wording

Furthermore, any sensitive information (including confidential, competitive, proprietary, or personal data) that we input into a third-party generative AI/ML platform could be leaked or disclosed to others, including if sensitive information is used to train the third party’s AI/ML model. Additionally, where such a model ingests personal data and makes connections using such data, those technologies may reveal other personal or sensitive information generated by the model. Use of third‑party models may also trigger additional contractual obligations, intellectual property risks, and export control considerations.

Previous wording

Given that AI, automated decision making and ML technologies are core to our business, any increased regulation over these technologies, including the EU AI Act, could make it harder for us to conduct our business, significantly complicate our compliance efforts, increase legal risk and compliance costs for us, the third parties upon whom we rely, and our customers, increase our cost of doing business, impede or prevent our growth plans (including into Europe), require us to change our business operations at significant cost (such as retaining or rebuilding our AI/ML models), and reduce demand for our products.

Current wording

Given that AI, automated decision making and ML technologies are core to our business, any increased regulation over these technologies, including the EU AI Act, could make it harder for us to conduct our business, significantly complicate our compliance efforts, increase legal risk and compliance costs for us, the third parties upon whom we rely, and our customers, increase our cost of doing business, impede or prevent our growth plans (including into Europe), require us to change our business operations at significant cost (such as retaining or rebuilding our AI/ML models), and reduce demand for our products. We may also need to implement new governance frameworks, allocate additional engineering and compliance resources, engage third‑party auditors or notified bodies, and limit or deprecate certain features to meet evolving requirements.

Previous wording

While we endeavor to implement policies, procedures, and systems designed to achieve compliance with these regulatory requirements, we cannot assure you that these policies, procedures, or systems will be adequate or that we or our personnel will not violate these policies and procedures or applicable laws and regulations. Violations of these laws or regulations may harm our reputation and deter government agencies and other existing or potential customers or partners from purchasing our solutions. Furthermore, non-compliance with applicable laws or regulations could result in fines, damages, criminal sanctions against us, our officers, or our employees, restrictions on the conduct of our business, and damage to our reputation.

Current wording

While we endeavor to implement policies, procedures, and systems designed to achieve compliance with these regulatory requirements, we cannot assure you that these policies, procedures, or systems will be adequate or that we or our personnel will not violate these policies and procedures or applicable laws and regulations. Violations of these laws or regulations may harm our reputation and deter government agencies and other existing or potential customers or partners from purchasing our solutions. Furthermore, non-compliance with applicable laws or regulations could result in fines, damages, criminal sanctions against us, our officers, or our employees, restrictions on the conduct of our business, and damage to our reputation. Even alleged non‑compliance can result in costly investigations, audits, delayed sales cycles, contract terminations, and diversion of management time.

Previous wording

We rely on information technology networks and systems, some of which are owned and operated by third parties, to collect, process, transmit, and store electronic information on behalf of our customers. We also depend on our information technology infrastructure for a variety of functions, including worldwide financial reporting, procurement, invoicing, and email communications. These systems are susceptible to outages due hacking and cyberattacks.

Current wording

We rely on information technology networks and systems, some of which are owned and operated by third parties, to collect, process, transmit, and store electronic information on behalf of our customers. We also depend on our information technology infrastructure for a variety of functions, including worldwide financial reporting, procurement, invoicing, and email communications. These systems are susceptible to outages due to hacking and cyberattacks. They are also vulnerable to human error, power loss, natural disasters, hardware or software defects, and other business continuity risks.

Previous wording

We have implemented security measures and controls intended to protect our information technology infrastructure, data centers and other systems and data against cyber-attacks. Despite our implementation of security measures and controls, our systems and those of third parties upon whom we rely are vulnerable to attack from numerous threat actors, including sophisticated nation-state and nation-state-supported actors. Threat actors have and may in the future be able to compromise our security measures or otherwise exploit vulnerabilities in our systems, including vulnerabilities that may have been introduced through the actions of our employees or contractors or defects in the design or manufacture of our products and systems or the products and systems that we procure from third parties. Our systems, and those of our third-party providers, have and could in the future become subject to cyber-attacks, including using computer viruses, credential harvesting, dedicated denial of services attacks, malware, social engineering, and other means for obtaining unauthorized access to, or disrupting the operation of, our systems and those of our third-party providers.

Current wording

We have implemented security measures and controls intended to protect our information technology infrastructure, data centers and other systems and data against cyber-attacks. Despite our implementation of security measures and controls, our systems and those of third parties upon whom we rely are vulnerable to attack from numerous threat actors, including sophisticated nation-state and nation-state-supported actors. Threat actors have and may in the future be able to compromise our security measures or otherwise exploit vulnerabilities in our systems, including vulnerabilities that may have been introduced through the actions of our employees or contractors or defects in the design or manufacture of our products and systems or the products and systems that we procure from third parties. Our systems, and those of our third-party providers, have and could in the future become subject to cyberattacks, including using computer viruses, credential harvesting, dedicated denial of services attacks, malware, social engineering, and other means for obtaining unauthorized access to, or disrupting the operation of, our systems and those of our third-party providers. Exploits of third‑party or open‑source software components, zero‑day vulnerabilities, compromise of our software build pipeline or update mechanisms, and attacks on managed service providers or cloud infrastructure could also impact our systems or our customers.

Previous wording

In addition, threat actors are also increasingly using tools and techniques that circumvent controls, evade detection, and remove forensic evidence, which means that we and others may be unable to anticipate, detect, deflect, contain or recover from cyberattacks in a timely or effective manner. As AI capabilities improve and are increasingly adopted, we may see cyberattacks created through AI. These attacks could be crafted with an AI tool to directly attack IT systems with increased speed and/or efficiency than a human threat actor or create more effective phishing emails. Our network and storage applications, as well as those of our customers, business partners, and third-party providers, may be subject to unauthorized access by hackers or breached due to operator error, malfeasance or other system disruptions.

Current wording

In addition, threat actors are also increasingly using tools and techniques that circumvent controls, evade detection, and remove forensic evidence, which means that we and others may be unable to anticipate, detect, deflect, contain or recover from cyberattacks in a timely or effective manner. As AI capabilities improve and are increasingly adopted, we may see cyberattacks created through AI. These attacks could be crafted with an AI tool to directly attack IT systems with increased speed and/or efficiency than a human threat actor or create more effective phishing emails. Our network and storage applications, as well as those of our customers, business partners, and third-party providers, may be subject to unauthorized access by hackers or breached due to operator error, malfeasance or other system disruptions. Ransomware, data exfiltration, business email compromise, account takeover, and supply‑chain attacks can lead to business interruption, corruption or loss of data (including backups), and operational disruptions.

Previous wording

The number and scale of cyberattacks have continued to increase and the methods and techniques used by threat actors, including sophisticated “supply-chain” attacks, continue to evolve at a rapid pace. As a result, we may be unable to identify current attacks, anticipate future attacks or implement adequate security measures. We may also experience security breaches that may remain undetected for an extended period and, therefore, have a greater impact on our systems, our products, the proprietary data contained therein, our customers and ultimately, our business. Cyberattacks on our systems and “supply-chain” attacks on systems of third parties upon whom we rely, and any related operational disruptions, unauthorized access, or misappropriation of information (including personally identifiable information or personal data), could create costly litigation, significant financial liability, and a loss of confidence in our ability to serve customers and cause current or potential customers to choose another provider, all of which could have a material adverse effect on our business, financial condition, reputation, and results of operations.

Current wording

The number and scale of cyberattacks have continued to increase and the methods and techniques used by threat actors, including sophisticated “supply-chain” attacks, continue to evolve at a rapid pace. As a result, we may be unable to identify current attacks, anticipate future attacks or implement adequate security measures. We may also experience security breaches that may remain undetected for an extended period and, therefore, have a greater impact on our systems, our products, the proprietary data contained therein, our customers and ultimately, our business. Cyberattacks on our systems and “supply-chain” attacks on systems of third parties upon whom we rely, and any related operational disruptions, unauthorized access, or misappropriation of information (including personally identifiable information or personal data), could create costly litigation, significant financial liability, and a loss of confidence in our ability to serve customers and cause current or potential customers to choose another provider, all of which could have a material adverse effect on our business, financial condition, reputation, and results of operations. Such events could also trigger notification obligations to regulators, individuals, and counterparties; result in contractual claims, indemnity obligations, or liquidated damages; lead to regulatory inquiries, investigations, fines, or orders; and require us to incur significant costs for incident response, remediation, recovery, enhancements to our cybersecurity program, and credit monitoring or other remedies. Our cybersecurity insurance may be insufficient to cover all losses, may not cover certain types of claims, and may become more expensive or difficult to obtain.

Previous wording

We have in the past and may in the future fail to comply with the Nasdaq listing requirements, including the continued listing requirement to timely file all required periodic financial reports with the SEC. For example, on August 11, 2022, we were notified by Nasdaq that we were not in compliance with Nasdaq Listing Rule 5250(c)(1), which requires that a listed company timely file all required periodic financial reports with the SEC as a result of our failure to file our Quarterly Report on Form 10-Q for the period ended June 30, 2022. We have received similar deficiency letters from Nasdaq over the past couple years as the Company was responding to various accounting matters, as previously disclosed. If our common stock ceases to be listed for trading on Nasdaq for any reason, it may harm our stock price, increase the volatility of our stock price, decrease the level of trading activity and make it more difficult for investors to buy or sell shares of our common stock. Our failure to maintain listing on Nasdaq may constitute an event of default under our outstanding indebtedness, including our convertible notes due 2026, and any future indebtedness, which would accelerate the maturity date of such debt or trigger other obligations. In addition, certain institutional investors that are not permitted to own securities of non-listed companies may be required to sell their shares adversely affecting the market price of our common stock. If we are not listed on Nasdaq, we will be limited in our ability to raise additional capital we may need.

Current wording

We have in the past and may in the future fail to comply with the Nasdaq listing requirements, including the continued listing requirement to timely file all required periodic financial reports with the SEC. For example, on August 11, 2022, we were notified by Nasdaq that we were not in compliance with Nasdaq Listing Rule 5250(c)(1), which requires that a listed company timely file all required periodic financial reports with the SEC as a result of our failure to file our Quarterly Report on Form 10-Q for the period ended June 30, 2022. We received similar deficiency letters from Nasdaq in calendar year 2023 and 2024 as the Company was responding to various accounting matters, as previously disclosed. If our common stock ceases to be listed for trading on Nasdaq for any reason, it may harm our stock price, increase the volatility of our stock price, decrease the level of trading activity and make it more difficult for investors to buy or sell shares of our common stock. Our failure to maintain listing on Nasdaq may constitute an event of default under our outstanding indebtedness, including our convertible notes due 2026, and any future indebtedness, which would accelerate the maturity date of such debt or trigger other obligations. In addition, certain institutional investors that are not permitted to own securities of non-listed companies may be required to sell their shares adversely affecting the market price of our common stock. If we are not listed on Nasdaq, we will be limited in our ability to raise additional capital we may need.

Previous wording

We have identified material weaknesses in our internal control over financial reporting, and if our remediation of such material weaknesses is not effective, or if we fail to develop and maintain an effective system of disclosure controls and internal control over financial reporting, our ability to produce timely and accurate financial statements or comply with applicable laws and regulations could be impaired.

Current wording

Although we have concluded that previously identified material weaknesses in our internal control over financial reporting have been remediated, if such remediation was not effective, or if we identify additional material weaknesses in internal control over financial reporting, our ability to produce timely and accurate financial statements or comply with applicable laws and regulations could be impaired.

Previous wording

In the course of preparing our financial statements for fiscal 2023 and 2022, we identified material weaknesses in our internal control over financial reporting. A material weakness is a deficiency, or combination of deficiencies, in internal control over financial reporting, such that there is a reasonable possibility that a material misstatement of the annual or interim financial statements will not be prevented or detected on a timely basis. See Part II, Item 9A “Controls and Procedures” for additional information about these material weaknesses and our remediation efforts.

Current wording

As previously disclosed in our Annual Report on Form 10-K for the fiscal year ended September 30, 2024, we identified material weaknesses in our internal control over financial reporting. A material weakness is a deficiency, or combination of deficiencies, in internal control over financial reporting, such that there is a reasonable possibility that a material misstatement of the annual or interim financial statements will not be prevented or detected on a timely basis. We implemented remediation measures to address these material weaknesses, which we believe have resolved these previously-identified material weaknesses as of September 30, 2025. However, the policies, procedures, and controls implemented as part of the remediation plan may fail to have remediated these material weaknesses or we may fail to otherwise maintain effective controls over financial reporting in the future. See Part II, Item 9A “Controls and Procedures” for additional information about these previously-identified material weaknesses and our remediation efforts.

Previous wording

If we are unable to further implement and maintain effective internal control over financial reporting or disclosure controls and procedures, our ability to record, process and report financial information accurately, and to prepare financial statements within required time periods could be adversely affected, which could subject us to litigation or investigations requiring management resources and payment of legal and other expenses, negatively affect investor confidence in our financial statements and adversely impact our stock price. If we are unable to assert that our internal control over financial reporting is effective, or if our independent registered public accounting firm is unable to express an unqualified opinion as to the effectiveness of our internal control over financial reporting, investors may lose confidence in the accuracy and completeness of our financial reports, the market price of our common stock could be adversely affected and we could become subject to litigation or investigations by the stock exchange on which our securities are listed, the SEC or other regulatory authorities, which could require additional financial and management resources. Furthermore, we cannot assure you that the measures we have taken to date, and actions we may take in the future, will be sufficient to remediate the control deficiencies that led to our material weaknesses in our internal control over financial reporting or that they will prevent or avoid potential future material weaknesses. Our current controls and any new controls that we develop may become inadequate because of changes in conditions in our business. Further, weaknesses in our disclosure controls and internal control over financial reporting may be discovered in the future. Any failure to develop or maintain effective controls or any difficulties encountered in their implementation or improvement could harm our operating results or cause us to fail to meet our reporting obligations and may result in a restatement of our financial statements for prior periods.

Current wording

If we are unable to further implement and maintain effective internal control over financial reporting or disclosure controls and procedures, our ability to record, process and report financial information accurately, and to prepare financial statements within required time periods could be adversely affected, which could subject us to litigation or investigations requiring management resources and payment of legal and other expenses, negatively affect investor confidence in our financial statements and adversely impact our stock price. If we are unable to assert that our internal control over financial reporting is effective, or if our independent registered public accounting firm is unable to express an unqualified opinion as to the effectiveness of our internal control over financial reporting, investors may lose confidence in the accuracy and completeness of our financial reports, the market price of our common stock could be adversely affected and we could become subject to litigation or investigations by the stock exchange on which our securities are listed, the SEC or other regulatory authorities, which could require additional financial and management resources. Any failure to develop or maintain effective controls or any difficulties encountered in their implementation or improvement could harm our operating results or cause us to fail to meet our reporting obligations and may result in a restatement of our financial statements for prior periods.

Previous wording

We are highly dependent on the key members of our management team and other key technical personnel. If we were to lose the services of one or more of our key personnel, or if we fail to attract and retain additional qualified personnel, it could materially and adversely affect our business. Furthermore, recruiting and retaining qualified highly skilled engineers involved in the ongoing development required to refine our technologies and introduce future products is critical to our success. We may be unable to attract, assimilate, and retain qualified personnel on acceptable terms given the competition within the high technology industry. We do not have any employment agreements providing for a specific term of employment with any member of our senior management. We do not maintain “key man” insurance policies on any of our officers or employees. We have granted and plan to grant restricted stock units or other forms of equity awards as a method of attracting and retaining employees, motivating performance and aligning the interests of employees with those of our stockholders. As of September 30, 2024, we had 4,671,484 shares of common stock available for issuance pursuant to future grants of equity awards under our existing equity compensation plans, which may limit our ability to provide equity incentive awards to existing and future employees. If we are unable to adopt, implement and maintain equity compensation arrangements that provide sufficient incentives, we may be unable to retain our existing employees and attract additional qualified candidates. If we are unable to retain our existing employees, including qualified technical personnel, and attract additional qualified candidates, our business and results of operations could be adversely affected.

Current wording

We are highly dependent on the key members of our management team and other key technical personnel. If we were to lose the services of one or more of our key personnel, or if we fail to attract and retain additional qualified personnel, it could materially and adversely affect our business. Furthermore, recruiting and retaining qualified highly skilled engineers involved in the ongoing development required to refine our technologies and introduce future products is critical to our success. We may be unable to attract, assimilate, and retain qualified personnel on acceptable terms given the competition within the high technology industry. We do not have any employment agreements providing for a specific term of employment with any member of our senior management. We do not maintain “key man” insurance policies on any of our officers or employees. We have granted and plan to grant restricted stock units or other forms of equity awards as a method of attracting and retaining employees, motivating performance and aligning the interests of employees with those of our stockholders. As of September 30, 2025, we had 2,804,358 shares of common stock available for issuance pursuant to future grants of equity awards under our existing equity compensation plans, which may limit our ability to provide equity incentive awards to existing and future employees. If we are unable to adopt, implement and maintain equity compensation arrangements that provide sufficient incentives, we may be unable to retain our existing employees and attract additional qualified candidates. If we are unable to retain our existing employees, including qualified technical personnel, and attract additional qualified candidates, our business and results of operations could be adversely affected.