KALTURA INC

Except as set forth below, there have been no material changes from the risk factors previously disclosed in our 2025 10-K.

If we or our third-party service providers experience a security breach, data loss or other compromise, including if unauthorized parties obtain access to our customers’ data, our reputation may be harmed, demand for our platform, products and solutions may be reduced, and we may incur significant liabilities.

Our IT Systems, and those of third-party providers we rely on, involve the collection, storage, processing, transmission, and other use of data, including certain proprietary, confidential, sensitive, and Personal Information of ours and our customers (collectively, “Confidential Information”).

Cyberattacks are expected to accelerate on a global basis in frequency and magnitude as threat actors are becoming increasingly sophisticated in using techniques and tools-including artificial intelligence-that circumvent security controls, evade detection and remove forensic evidence. As a result, we face numerous and evolving cybersecurity risks that threaten the confidentiality, integrity and availability of Confidential Information and our IT Systems, business platform, products and solutions. Additionally, the use of AI, Gen-AI and large language models (“LLMs”), including those of third parties, by us, our customers that host files in our environment, or other third parties, is expected to pose new or unknown cybersecurity risks and challenges, including increasing data leakage and data compromise risks.

Any security breach, data loss, or other compromise, including those resulting from a cybersecurity attack, social engineering, phishing attack, human or technological error, or any unauthorized access, unauthorized usage (including malfeasance by insiders), malware (including ransomware), malicious code, or misconfigurations, bugs or other vulnerabilities in commercial software that is integrated into our (or our suppliers’ or service providers’) IT Systems, products or services, virus or similar breach or disruption could result in the loss or destruction of or unauthorized access to, or use, alteration, disclosure, or acquisition of, Confidential Information, damage to our reputation, litigation (such as class actions), regulatory investigations and enforcement actions, reputational harm, loss of existing or future customers, imposition of fines, or other liabilities. These attacks may come from diverse threat actors, such as individual hackers, hacktivists, criminal groups, and state-sponsored organizations. For example, ransomware attacks, including those from organized criminal threat actors, nation-states, and nation-state supported actors, are becoming increasingly prevalent and severe, and can lead to significant interruptions in our operations, loss of data and income, reputational loss, diversion of funds, and may result in fines, litigation and unwanted media attention. Extortion payments may alleviate the negative impact of a ransomware attack, but we may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting payments.

If our security measures are breached as a result of third-party action, employee error or negligence, a defect or bug in our offerings or those of our third-party service providers or customers using our platforms, malfeasance or otherwise and, as a result, someone obtains unauthorized access to any data, including our Confidential Information or that of our customers, or other persons, or any of these types of information is lost, destroyed, or used, altered, disclosed, or acquired without authorization, our reputation may be damaged, our business may suffer, we may be subject to regulatory investigations, and we could incur significant liability, including significant incident response, system restoration or remediation and future compliance costs, insurance costs, and penalties or fines under applicable data privacy and security laws and regulations. Even the perception of inadequate security may damage our reputation and negatively impact our ability to win new customers and retain and receive timely payments from existing customers. We experience cyber-attacks and other security incidents of varying degrees from time to time, and future incidents or threat actors' successful attacks may result in significant liability, costs, and reputational harm.

Moreover, there can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, effectively protect our IT Systems and Confidential Information. Additionally, there can be no assurance that our cybersecurity measures and tools will not be circumvented or penetrated by attackers or would keep pace with the constantly evolving threats in a timely manner.For example, use of AI Technologies by threat actors may make any existing vulnerabilities easier to expose and exploit. We are unable to comprehensively apply patches or confirm that measures are in place to mitigate all such vulnerabilities, or that patches will be applied before vulnerabilities are exploited by a threat actor. We could be required to expend significant capital and other resources to protect against and address any data security incident or breach, which may not be covered or fully covered by our insurance and which may involve payments for investigations, forensic analyses, regulatory compliance, breach notification, legal advice, public relations advice, system repair or replacement, data recovery or other services. The successful assertion of one or more large claims against us that exceeds our available insurance coverage, or results in changes to our insurance policies (including premium increases or the imposition of large deductible or co-insurance requirements), could have an adverse effect on our business. In addition, we cannot be sure that our existing insurance coverage will continue to be available on economically reasonable terms or at all or that our insurers will not deny coverage as to any future claim.

In addition, we do not directly control content that our customers store or use in our products. If our customers use our products for the transmission or storage of Confidential Information, including such information about individuals, and our security measures are or are believed to have been breached as a result of third-party action, employee error, malfeasance or otherwise, our reputation could be damaged, our business may suffer, and we could incur significant liability, including related to breach notification and incident response.

We engage third-party vendors and service providers to store and otherwise process some of our and our customers’ data, including Confidential Information. Our vendors and service providers, including providers of open source platforms, may also be the targets of cyberattacks, malicious software, phishing schemes, and fraud.

Our ability to monitor our vendors and service providers’ data security is limited, and, in any event, third parties may be able to circumvent those security measures, resulting in the unauthorized access to, misuse, acquisition, disclosure, loss, alteration, or destruction of our and our customers’ data, including Confidential Information and other information about individuals. Any such unauthorized access could materially adversely affect our business, operating results, and financial condition.

Data security breaches could also expose us to liability under various laws and regulations across jurisdictions and increase the risk of litigation and governmental or regulatory investigation.

Due to concerns about data security and integrity, a growing number of legislative and regulatory bodies have adopted breach notification and other requirements in the event that information subject to such laws is accessed by unauthorized persons and additional regulations regarding security of such data are possible. We may need to notify governmental authorities and affected individuals with respect to such incidents. For example, laws in the EU and UK and all 50 U.S. states may require businesses to provide notice to regulators and/or individuals whose Personal Information has been disclosed as a result of a data security breach. Complying with such numerous and complex regulations in the event of a data security breach would be expensive and difficult, and failure to comply with these regulations could subject us to regulatory scrutiny and additional liability. We may also be contractually required to notify regulators, customers or other counterparties of a security incident, including a data security breach. Regardless of our contractual protections, any actual or perceived data security breach, or breach of our contractual obligations, could harm our reputation and brand, expose us to potential liability or require us to expend significant resources on data security and in responding to any such actual or perceived breach.

Techniques used to sabotage or obtain unauthorized access to systems or networks are constantly evolving and, leveraging more sophisticated techniques and tools (including artificial intelligence) and, in some instances, are not identified until after they have been launched against a target. We and our service providers may be unable to anticipate these techniques, react in a timely manner, or implement adequate preventative and mitigating measures.

If we or our cybersecurity solutions providers are unable to efficiently and effectively maintain and upgrade our system safeguards, we may incur unexpected costs and certain of our systems may become more vulnerable to unauthorized access or disruption. Any of the foregoing could have a material adverse effect on our business, including our financial condition, results of operations and reputation.

We are subject to stringent and changing laws, regulations, standards, and contractual obligations related to privacy, data protection, and data security. Our actual or perceived failure to comply with such obligations could adversely affect our business

We receive, collect, store, process, transfer, share and otherwise use or host Personal Information, including data relating to users of our offerings, our employees and contractors, and other persons. We have legal and contractual obligations regarding the protection of confidentiality and appropriate use of certain data, including Personal Information and other sensitive information about individuals. We are subject to numerous federal, state, local, and international laws, directives, and regulations regarding privacy, data protection, and data security and the collection, storing, sharing, use, processing, transfer, disclosure, disposal, and protection of Personal Information and other data, the scope of which are changing, subject to differing interpretations, and may be inconsistent among jurisdictions or conflict with other legal and regulatory requirements. We are also subject to certain contractual obligations to customers and other third parties related to privacy, data protection and data security. The regulatory framework for privacy, data protection and data security worldwide is, and is likely to remain for the foreseeable future, uncertain, complex and lacking worldwide unified standards, and it is possible that these or other actual or alleged obligations may be interpreted and applied in a manner that we do not anticipate or that is inconsistent from one jurisdiction to another and may conflict with other legal obligations or our practices. Further, any significant change to applicable laws, regulations or industry practices regarding the collection, use, retention, hosting, security, processing, transfer or disclosure of Personal Information, or their interpretation, or any changes regarding the manner in which the consent of users or other data subjects for the collection, use, retention, security, processing, transfer or disclosure of such Personal Information must be obtained, could increase our costs and require us to modify our services and features, possibly in a material manner, which we may be unable to complete, and may limit our ability to receive, collect, store, host, process, transfer, and otherwise use user data or develop new services and features. Further, there has been a substantial increase in legislative activity and regulatory focus on data privacy and security in the United States and elsewhere, including in relation to cybersecurity incidents. In addition, some such requirements place restrictions on our ability to process Personal Information across our business or across country borders.

In the United States, the FTC and many state attorneys general are interpreting federal and state consumer protection laws to impose standards for the online collection, use, dissemination, and security of data. Such standards require us to publish statements that describe how we handle Personal Information and choices individuals may have about the way we handle their Personal Information.

If such information that we publish is considered untrue or inaccurate, we may be subject to government claims of unfair or deceptive trade practices, which could lead to significant liabilities and consequences. Moreover, according to the FTC, violating consumers’ privacy rights or failing to take appropriate steps to keep consumers’ Personal Information secure may constitute unfair acts or practices in or affecting commerce in violation of Section 5(a) of the Federal Trade Commission Act.

State consumer protection laws provide similar causes of action for unfair or deceptive practices. Further, data privacy advocates and industry groups have regularly proposed and sometimes approved, and may propose and approve in the future, self-regulatory standards with which we must legally comply or that contractually apply to us.

Our communications with our clients are subject to certain laws and regulations, including the Controlling the Assault of Non-Solicited Pornography and Marketing Act (the “CAN-SPAM Act”), the Telephone Consumer Protection Act (the “TCPA”), and the Telemarketing Sales Rule and analogous state laws, that could expose us to significant damages awards, fines and other penalties that could materially impact our business. For example, the TCPA imposes various consumer consent requirements and other restrictions in connection with certain telemarketing activity and other communication with consumers by phone, fax or text message. The CAN-SPAM Act and the Telemarketing Sales Rule and analogous state laws also impose various restrictions on marketing conducted use of email, telephone, fax or text message.

As laws and regulations, including FTC enforcement, rapidly evolve to govern the use of these communications and marketing platforms, the failure by us, our employees or third parties acting at our direction to abide by applicable laws and regulations could adversely impact our business, financial condition and results of operations or subject us to fines or other penalties.

In addition, the Video Privacy Protection Act (“VPPA”), which restricts the disclosure of consumers’ video viewing information, and state wiretapping statutes, such as the California Invasion of Privacy Act (“CIPA”), have become the basis for a significant increase in class action litigation targeting companies that deliver video content online or deploy cookies and similar tracking technologies. Given the nature of our business and our use of cookies and similar technologies, we may be exposed to claims under these or similar statutes. Such claims could result in class action litigation and statutory damages, which could adversely affect our business, financial condition, and results of operations.

Various other U.S. federal privacy laws are relevant to our business, including the Family Educational Rights and Privacy Act (“FERPA”) and the Children’s Online Privacy Protection Act (“COPPA”), While we are not directly subject to FERPA or COPPA, our contracts with certain educational institution customers impose obligations on us related to FERPA and COPPA. Any actual or perceived failure to comply with these laws could result in a costly investigation or litigation resulting in potentially significant liability, injunctions and other consequences, loss of trust by our users, and a material and adverse impact on our reputation and business.

In addition, many state legislatures have adopted legislation that regulates how businesses operate online, including measures relating to privacy, data security, and data breaches. For example, the CCPA, provides data privacy rights for California residents and imposes operational requirements on covered companies, such as obligations to provide disclosures to California residents and receive and respond to data privacy rights requests. The CCPA marked the beginning of a trend toward more stringent data privacy legislation in the United States, which could also increase our potential liability and adversely affect our business, with “copycat” laws or other similar laws being passed or proposed in numerous states across the country.

This legislation may add additional complexity, variation in requirements, restrictions, and potential legal risk, require additional investment in resources to compliance programs, could impact strategies and availability of previously useful data and could result in increased compliance costs and/or changes in business practices and policies.

In addition, in the EU and the UK, we are subject to the European Union General Data Protection Regulation (the “EU GDPR”) and to the United Kingdom General Data Protection Regulation and UK Data Protection Act 2018 (collectively, the “UK GDPR”) (the EU GDPR and UK GDPR together referred to as the “GDPR”).

The GDPR imposes comprehensive data privacy compliance obligations in relation to our collection, use, sharing, disclosure and other processing of Personal Information, including a principle of accountability and the obligation to demonstrate compliance through policies, procedures, training and audit.

Among other requirements, the GDPR regulates the transfer of Personal Information outside of the European Economic Area (“EEA”) and the UK to third countries that have not been found to provide adequate protection for such Personal Information, including the United States.

We are certified under the EU-US Data Privacy Framework (“DPF”) and currently rely on the DPF and on the UK Extension to the DPF to transfer Personal Information from the EEA and the UK to our affiliates in the United States and other DPF-certified entities in the United States.

We also rely on the EU standard contractual clauses (“SCCs”) and the UK Addendum to the SCCs, as relevant, to transfer Personal Information outside the EEA and the UK to countries other than the United States and to entities in the United States not certified under the DPF.

Recent legal developments in Europe, including decisions from the Court of Justice of the European Union and regulatory guidance from regulators in the EEA and UK, have created complexity and uncertainty regarding data transfers, and we expect this legal complexity and uncertainty to continue. In particular, we expect international transfers to the United States and to other jurisdictions more generally to continue to be subject to enhanced scrutiny by regulators. As the regulatory guidance and enforcement landscape in relation to data transfers continue to develop, we could suffer additional costs, complaints and/or regulatory investigations or fines; we may have to stop using certain tools and vendors, implement alternative data transfer mechanisms and/or take additional compliance and operational measures; and/or it could otherwise affect the manner in which we provide our services, and could adversely affect our business, operations and financial condition.

Since we are subject to the supervision of relevant data protection authorities under both the EU GDPR and the UK GDPR, we could be fined under each of these regimes independently in respect of the same breach. Penalties for certain breaches are up to the greater of €20 million / GBP 17.5 million or 4% of global annual turnover for the preceding financial year for the most serious violations. The GDPR also provides for a right to compensation for material or non-material damage claimed by individuals. In addition to the foregoing, a breach of the GDPR could result in regulatory investigations, reputational damage, orders to cease or change our processing of our data, enforcement notices and/or assessment notices (for a compulsory audit).

We are also subject to evolving EU and UK privacy laws on cookies, tracking technologies and e-marketing. Recent European court and regulator decisions are driving increased attention to cookies and tracking technologies. If the trend of increasing enforcement by regulators of the strict approach to opt-in consent for all but essential use cases, as seen in recent guidance and decisions continues, this could lead to additional costs, require systems changes, limit the effectiveness of our marketing and personalization activities, divert the attention of our technology personnel, adversely affect our margins, increase costs and subject us to additional liabilities. There can be no assurances that we will be successful in our efforts to comply with such laws; violations of such laws could result in regulatory investigations, fines, orders to cease or change our use of such technologies, as well as civil claims including class actions, and reputational damage.

EU data-related laws apply to some of our offerings, including the EU Data Act, which established new requirements for providers of data processing services (including cloud and SaaS, among other service models) in the EU. The EU Data Act requires providers to facilitate customers switching to other providers or solutions and port their data within certain timeframes; remove technical, contractual, and commercial obstacles to service switching; and include certain mandatory terms in customer contracts, amongst other requirements. Failure to comply with the EU Data Act can result in regulatory enforcement and fines, civil claims, and reputational damage. The EU Data Act, together with developing guidance in this area, may require changes to our customer contracts, operations, and business practices, increase our compliance costs, require adjustments to our financial measurements and reporting practices, and adversely affect our financial condition, business, and operations. We are continuing to monitor the application and impact of the EU Data Act as further guidance, practice and enforcement trends emerge.

Additionally, as our products and services continue to evolve, we may be subject to certain cybersecurity and technology regulations in the EU and UK, including the UK Network and Information Systems Regulations, the EU Network and Information Systems Directive 2 as transposed into member state law, the Cyber Resilience Act, and the Digital Operational Resilience Act. These laws impose various obligations, including in relation to implementing cybersecurity risk measures, ensuring the security and integrity of our products and services, and reporting of security incidents and vulnerabilities to competent regulators. To the extent these laws apply to us, a failure to comply could result in regulatory enforcement and fines, reputational damage, and/or require us to change our business practices, products and services.

We may be subject to online content regulations, and our actual or perceived failure to comply with applicable regulations could adversely affect our business.

The EU, UK and certain other jurisdictions have enacted, or may enact in the future, regulations that may govern the content that we or our users share or make available via the solutions we offer. In the EU, the Digital Services Act (the “DSA”) sets out rules regarding, in addition to other related matters, the potential liability of providers of certain online solutions for content shared or made available via those solutions. In the United Kingdom, the Online Safety Act 2023 (the “OSA”) similarly imposes requirements on providers of certain online user-to-user (and search) services to protect users from illegal and harmful content. The DSA and OSA may increase our compliance costs, expose us to potential regulatory action and liability and/or require changes to our user interfaces, processes, operations, and business practices, which may adversely affect our ability to attract, retain, and provide our services to customers, and may otherwise adversely affect our business, results of operations, and financial condition. Failure to comply with the DSA can result in fines of up to 6% of total annual worldwide turnover and recipients of services have the right to seek compensation from providers in respect of damage or loss suffered due to infringement by the provider to comply with the DSA. Failure to comply with the OSA can result in fines of up to 10% of total annual worldwide turnover or GBP 18 million (whichever is greater).

We may face risks associated with our use of certain AI and machine learning model technologies and compliance with the evolving regulatory framework around AI development and use.

We have developed, integrated and interfaced, and continue to develop, integrate and interface, certain AI-based solutions, applications and features as part of our offerings, including through our acquisitions of eSelf and PathFactory. The underlying AI algorithms, digital processing or software, analyze and processes video and audio content, processes, and use of our products by developers, administrators and users, while performing intellectual processes characteristic of intelligent beings, such as deep learning, natural language processing, reasoning, discovering meaning, generalizing, processing, summarizing and representing knowledge, planning, and learning from past experience. The technologies and solutions pursued by us include also generative AI, namely, a type of artificial intelligence technology that can produce various types of content or data, such as text, images, videos, audio, synthetic data or other media, using generative models ,as well as agentic AI capabilities that can take actions or execute workflows with limited human involvement. Artificial intelligence and machine learning are rapidly evolving fields of study, and bear risks associated with the introduction of new technologies and the lack of learning curve and technology maturity. Thus, the Company cannot assure nor guarantee the accuracy of any output generated therefrom or other results obtained from use thereof, or that actions taken by agentic features will be appropriate or as intended . Given the probabilistic nature of machine learning and AI, use of such AI processing and tools may in some situations result in an inaccurate output.

If our solutions (including those of our vendors and subcontractors) fail to perform as intended, our business, financial condition, and results of operations would be adversely affected. In addition, although the Company seeks, in accordance with its policies and customer agreements, to limit its retention and use of its customers' contents or metadata provided or uploaded by them or otherwise generated from their use of the Company's AI tools, and does not use its customers' data or content for the creation of any AI-output for other users of the Company's systems and solutions, the processing of its customers' data may nonetheless result in the creation of residual know how, experience and information, statistical models, and training of deep learning, algorithms, simulations, statistics, predictability and other AI features and capabilities. If we fail to establish processes, policies, rules and contractual frameworks to avoid misuse or unauthorized use of our customers data, or to establish and secure the Company's rights with respect to its own developments, technologies and AI products and tools, or if evolving regulation of AI and machine learning model technologies would develop differently from our standards and policies, and as a consequence we may suffer claims for intellectual property infringement, misuse or abuse, then our business, financial condition, and results of operations would be adversely affected.

The regulatory framework around the development and use of machine learning, AI and automated decision making is rapidly evolving, and many federal, state and foreign government bodies and agencies have introduced and/or are currently considering additional laws and regulations. For example, in the United States,the regulatory framework for AI Technologies faces significant uncertainty. At the federal level, Congress has yet to enact meaningful AI legislation. Instead, federal policy on AI has been shaped by a series of executive orders that have shifted priorities and requirements substantially depending on the administration in power. Any such changes at the federal level could require us to expend significant resources to modify our products, services, or operations to ensure compliance or remain competitive.

In the absence of federal AI legislation, states have filled the void by enacting laws and regulating different aspects of AI Technologies. For example, California has enacted laws and regulations related to AI safety protocols, reporting and transparency, among other AI-related topics. Moreover, various state AI laws and comprehensive state privacy laws, including the California Consumer Privacy Act (“CCPA”), regulate the use of automated decision-making technology that results in legal or similarly significant effects on individuals, and provide rights to individuals with respect to that automated decision making. California also enacted numerous new laws that further regulate use of AI Technologies and provide consumers with additional protections around companies’ use of AI Technologies, such as requiring companies to disclose certain uses of generative AI. Other states have also passed AI-focused legislation, such as Colorado’s Artificial Intelligence Act, which will require developers and deployers of “high-risk” AI systems to implement certain safeguards against algorithmic discrimination, and Utah’s Artificial Intelligence Policy Act, which establishes disclosure requirements and accountability measures for the use of generative AI in certain consumer interactions. Such additional regulations may impact our ability to develop, use, procure and commercialize AI Technologies in the future.

Numerous other states have enacted, passed, or are considering AI-focused legislation, creating a patchwork of regulations and a complex compliance challenge. However, the durability of these laws and the potential for additional state-level legislative activity face uncertainty following President Trump’s December 2025 Executive Order “Ensuring a National Policy Framework for Artificial Intelligence.” This Executive Order establishes a federal policy favoring a uniform national AI regulatory framework designed to promote innovation and U.S. global competitiveness. The order directs federal agencies to identify, challenge, and potentially pre-empt state and local AI laws that are viewed as inconsistent with or burdensome to this national approach. It remains to be seen how agencies will effectuate this directive, and how states will approach AI legislation moving forward

In Europe, on August 1, 2024, the EU Artificial Intelligence Act (the “EU AI Act”) entered into force, and establishes a comprehensive, risk-based governance framework for AI in the EU market. The majority of the substantive requirements apply from August 2, 2026. The EU AI Act applies to companies that develop, use and/or provide artificial intelligence in the EU and, in relation to AI developed or deployed by the Company depending on the artificial intelligence use case, includes requirements around transparency, conformity assessments and monitoring, risk assessments, human oversight, security, accuracy, general purpose artificial intelligence and foundation models, with fines for breaches of up to 7% of worldwide annual turnover. In addition, the revised EU Product Liability Directive came into force in December 2024, to be implemented into EU member state national law by December 2026. This Directive extends the EU’s existing strict product liability regime to AI Technologies and AI-enabled products, and facilitates civil claims in respect of harm caused by AI. Once fully applicable, the EU AI Act and the EU Product Liability Directive will have a material impact on the way artificial intelligence is regulated in the EU, and together with developing guidance and/or decisions in this area, may affect our use of artificial intelligence and our ability to provide and to improve our services, require additional compliance measures and changes to our operations and processes, result in increased compliance costs and potential increases in civil claims against us.

Both in the United States and internationally, AI usage and development are the subject of evolving review by various governmental and regulatory agencies, including the SEC and the FTC, and changes in laws, rules, directives and regulations governing the use of AI may adversely affect the ability of our business to use or rely on AI. Implementation standards and enforcement practices are likely to remain uncertain for the foreseeable future, and we cannot yet determine the impact future laws, regulations, standards, or perception of their requirements may have on our business. Any actual or perceived failure to comply with evolving regulatory frameworks around the development and use of AI could adversely affect our business, operations and financial condition.

See “Our expanded use of AI and generative AI technologies, including their incorporation into our offerings, may expose us to increased liability and new regulatory, compliance, and ethical risks” below for further information.

Our expanded use of AI and generative AI technologies, including their incorporation into our offerings, may expose us to increased liability and new regulatory, compliance, and ethical risks.

We have launched and recently further enhanced AI-driven offerings, including Work Genie and Class Genie, Agentic Avatars, Publishing Agents and Content Lab, that rely on generative models or other advanced algorithms.

The continuous development, maintenance and operation of our AI-driven offerings is expensive and complex, and may involve unforeseen difficulties including material performance problems, undetected defects or errors. These AI tools may inadvertently produce inaccurate, misleading or biased outputs or other discriminatory or unexpected results such as hallucinatory behavior, in each case potentially leading to harm to our reputation, business or customer relationships and to potential claims by customers and other third parties. For example, the underlying model can experience decay (also known as “model drift”) in which its performance and accuracy decreases over time without further human intervention to correct such decay.

Our efforts to develop AI-driven offerings could increase our operating costs, and our ability to develop any such offerings may be limited by our access to processing infrastructure or training data, as we do not train our models on customers' data and our access to third-party data is limited to data that we are able to license on acceptable terms. Additionally, we may be dependent on third-party providers for processing infrastructure resources such as cloud facilities providers and others, which could increase our operating costs. Nonetheless, the expansion of AI based usage and offering, may create a need for additional data sources for training, which in turn could require us to explore more alternatives and accommodate the risks associated therewith, such as such data source integrity and freedom from third party rights or bias information.

Certain of the data that we use in developing our AI solutions is licensed from third parties, and we are dependent upon our ability to obtain necessary data licenses within appropriate time frames and on commercially reasonable terms, and such third parties’ assurances that such data was obtained and provided to us lawfully. Our data suppliers may withhold their data from us in certain circumstances, for example: if there is a competitive reason to do so; if we breach our contract with a supplier; if they are acquired by one of our competitors; or if new laws or case law restrict the use or dissemination of the data they provide. Additionally, we could terminate relationships with our data suppliers if they fail to adhere to our data quality, vendor or other standards. If a substantial number of data suppliers were to withdraw or withhold their data from us, or if we sever ties with our data suppliers based on their inability to meet our standards, our ability to provide products and services to our customers, and our revenue prospects, could be materially adversely impacted.

Our AI-driven offerings could generate output that is infringing or that otherwise violates third-party rights, and we could be subject to claims or lawsuits, including for infringement of third-party intellectual property rights as a result of the output of such AI offerings. In addition, certain of our offerings, including our Agentic Avatars and AI-powered virtual humans, generate or use synthetic representations of individuals’ likenesses and voices, which could expose us to claims under right of publicity, privacy, or similar laws, and an increasing number of jurisdictions have adopted or are considering laws regulating digital replicas and synthetic or manipulated media, which could restrict or impose consent, disclosure or other requirements on such offerings.

We may also experience difficulties in enforcing the intellectual property rights in output generated by generative AI. The United States Copyright Office has taken the position, and U.S. courts have held, that material generated by AI without sufficient human authorship is not eligible for copyright protection, and the United States Patent and Trademark Office and U.S. courts have similarly determined that an AI tool cannot be an “inventor” of a patent, rendering it impossible to obtain patent protection for inventions created solely by AI.

More broadly, whether a work of authorship or an invention developed by humans and AI together can be adequately protected by copyright or patent law is still an unresolved area of law in the U.S. In addition, if we are deemed to not have sufficient rights to the data we use to train our generative AI, we may be subject to litigation by the owners of the content or other materials that comprise such data, similar to the litigation that is currently pending in various U.S. courts against other developers of certain generative AI tools, and in which the outcome of such litigation is uncertain. Similarly, the third-party LLM providers on which our offerings rely are subject to such litigation, and an adverse outcome, settlement or injunction could restrict the availability or functionality of, or increase the cost of, such models, or expose us or our customers to claims relating to their use.

A number of aspects of intellectual property protection in the field of AI and machine learning are currently under development, and there is uncertainty and ongoing litigation in different jurisdictions as to the degree and extent of protection warranted for AI and machine learning systems and relevant system input and outputs. The law is also uncertain across jurisdictions regarding the copyright ownership of content that is produced in whole or in part by generative AI tools. If we fail to obtain protection for the intellectual property rights concerning our AI offerings or later have our intellectual property rights invalidated or otherwise diminished, our competitors may be able to take advantage of our research and development efforts to develop competing products which could adversely affect our business, reputation and financial condition. Given the extensive patenting activity in the field of AI, other parties may also have (or in the future may obtain) patents or other proprietary rights that would prevent, limit, or interfere with our ability to make, use, or sell our own AI offerings.

Further, the market for AI-driven offerings is rapidly evolving, and important assumptions about the characteristics of targeted markets, pricing, sales cycles, cost, performance, and perceived value associated with our offerings may be inaccurate. We cannot be sure that the market will continue to grow or that it will grow in ways we anticipate. In addition, market acceptance and consumer perceptions of products and services that incorporate AI is uncertain. Our failure to successfully develop and commercialize our products or services involving AI could negatively impact our stock and finances.

Moreover, the regulatory environment around AI is rapidly evolving, with new measures under discussion or adoption in the U.S., EU (including the EU AI Act), UK, and elsewhere. See “Risk Factors – Risks Related to Our Business and Industry”- “We may face risks associated with our use of certain AI and machine learning model technologies and compliance with the evolving regulatory framework around AI development and use”.

Purchases of Equity Securities by the Issuer or Affiliated Purchaser

None.

None.

Not applicable.