Autodesk (ADSK) Risk Analysis

As we digitize Autodesk and use cloud- and web-based technologies to leverage customer data to deliver the total customer experience, we are exposed to increased security risks and the potential for unauthorized access to, or improper use, disclosure, or other processing of, our and our customers' information. Like other software offerings and systems, ours are vulnerable to security breaches and incidents, including those from acquired companies. Also, our ability to mitigate the risk of security breaches and incidents may be impacted by our limited control over our customers or third-party technology providers and vendors, or the processing of data by third-party technology providers and vendors, which may not allow us to maintain the integrity or security of such transmissions or processing. We devote significant resources in an effort to maintain the security and integrity of our systems, offerings, services, and applications (online, mobile, and desktop). Despite these efforts, we have been subject to security breaches and incidents, and we face the risks of them occurring in the future, as well as the risks of delays and other difficulties in identifying, responding to, or remediating security breaches or incidents. Hackers regularly have targeted our systems, offerings, services, and applications, and we expect them to do so in the future. To date, we have not considered any such identified security events as material to us, including to our reputation or business operations, or had a material financial impact, but there can be no assurance that future cyberattacks will not be material or otherwise significant. Security breaches or incidents disrupt the proper functioning of our systems, solutions, offerings, applications, or services; cause errors in the output of our customers' work; allow unauthorized access to or unauthorized use, disclosure, modification, loss, unavailability, or destruction of, sensitive data or intellectual property, including proprietary or confidential information of ours or our customers; or cause other destructive or disruptive outcomes. The risk of a security incident, particularly through cyber-attack or cyber intrusion, including by computer hackers, foreign governments, and cyber terrorists, has increased as the number, intensity, and sophistication of attempted attacks and intrusions from around the world have increased. These threats include, among others, identity theft, unauthorized access, DNS attacks, wireless network attacks, viruses and worms, malware, bugs, vulnerabilities, advanced persistent threats, application-centric attacks, peer-to-peer attacks, social engineering, phishing, credential stuffing, malicious file uploads, backdoor trojans, supply chain attacks, ransomware attacks, and distributed denial of service attacks. In addition, third parties may attempt to fraudulently induce our employees, vendors, partners, customers, or users to disclose information to gain access to our data or our customers' or users' data and there is the risk of employee, contractor, or vendor error or malfeasance. These risks are compounded given the shift in recent years to work-from-home arrangements for a large population of employees and contractors, as well as employees and contractors of our third-party technology providers and vendors, and the risks could also be elevated in connection with the ongoing wars between Ukraine and Russia and conflicts in the Middle East as we and our third-party technology providers and vendors are vulnerable to a heightened risk of cyberattacks from or affiliated with nation-state actors, including retaliatory attacks from Russian actors against U.S.-based companies. Additionally, these threats continue to evolve in sophistication and volume and are difficult to detect and predict due to advances in electronic warfare techniques, advances in cryptography and other technologies, including AI and machine learning. AI and machine learning technologies have the potential to increase the impact and speed of cyber-attacks, and may be able to be used to detect, and take advantage of vulnerabilities in, systems or networks. These or other uses of AI by third parties or our employees may increase our risks of being subject to a security breach or incident or increase the impact of certain attacks, breaches, or incidents. Despite our significant efforts to create security barriers to such threats, we cannot entirely mitigate these risks, and there is no guarantee that inadvertent or unauthorized use or disclosure of such information will not occur or that third parties will not gain unauthorized access to such information. Many governments have enacted laws requiring companies to provide notice of security breaches or incidents involving certain types of personal data and personal information. We are also contractually required to notify certain customers of certain security breaches or incidents. Any security breach or incident suffered, or believed to have been suffered, by us or by our technology providers or vendors could result in harm to our reputation and competitive position, difficulty attracting new customers (including government customers), retaining existing customers, and securing payment from customers, our expenditure of significant capital and other resources to evaluate and alleviate the security incident and to try to prevent further or additional incidents, and regulatory inquiries, investigations, and other proceedings, private claims, demands, lawsuits, potential liability, and the potential loss of our authorization under the Federal Risk and Authorization Management Program ("FedRAMP"). We could incur significant costs and liabilities, including due to litigation, indemnity obligations, damages for contract breach, penalties for violation of applicable laws or regulations, and costs for remediation and other incentives offered to customers or other business partners in an effort to maintain business relationships after a security breach or incident, and our financial performance could be negatively impacted. We cannot assure you that any limitations of liability provisions in our contracts would be enforceable or adequate or would otherwise protect us from any liabilities or damages with respect to any particular claim relating to a security incident. We also cannot be sure that our existing insurance coverage will continue to be available on acceptable terms or will be available in sufficient amounts to cover one or more large claims related to a security incident, or that the insurer will not deny coverage as to any future claim. The successful assertion of one or more large claims against us that exceed available insurance coverage, or the occurrence of changes in our insurance policies, including premium increases or the imposition of large deductible or co-insurance requirements, could have a material adverse effect on our business, including our financial condition, operating results, and reputation.

Our success and ability to invest and grow depend largely on our ability to attract and retain highly skilled technical, professional, managerial, sales, and marketing personnel. Historically, competition for these key personnel has been intense. The loss of services of any of our key personnel, including key personnel joining our company through acquisitions, inability to retain and attract qualified employees in the future, or delays in hiring required personnel, particularly engineering and sales personnel, including sales leadership personnel, could make it difficult to meet key objectives, such as timely and effective product introductions and financial goals.

Our business is subject to numerous risks and uncertainties that you should consider before investing in our securities. These risks are described more fully below and include, but are not limited to, risks relating to the following: - Our strategy to develop and introduce new products and services, exposing us to risks such as limited customer acceptance (both with new and existing customers), costs related to product defects, and large expenditures. - Existing and increased competition and rapidly evolving technological changes. - Global economic and political conditions. - Costs and challenges associated with strategic acquisitions and investments. - Dependency on international revenue and operations, exposing us to significant international regulatory, economic, intellectual property, collections, currency exchange rate, taxation, political, and other risks. - Inability to predict subscription renewal rates and their impact on our future revenue and operating results. - Fluctuation of our financial results, key metrics and other operating metrics. - Deriving a substantial portion of our net revenue from a small number of solutions, including our AutoCAD-based software products and collections. - Any failure to successfully execute and manage initiatives to realign or introduce new business and sales initiatives. - Our strategy and expectations regarding the expected benefits, timing and costs associated with our restructuring plans. - Net revenue, billings, earnings, cash flow, or subscriptions shortfalls or volatility of the market causing the market price of our stock to decline. - Challenges relating to the proper management and governance of our use of AI in our offerings. - Security incidents compromising the integrity of our or our customers' offerings, services, data, or intellectual property. - Reliance on third parties to provide us with a number of operational and technical services as well as software. - Our highly complex software, which may contain undetected errors, defects, or vulnerabilities, and is subject to service disruptions, degradations, outages or other performance problems. - Increasing regulatory focus on privacy, data protection, and cybersecurity issues and expanding laws. - Governmental export and import controls that could impair our ability to compete in international markets or subject us to liability if we violate the controls. - Protection of our intellectual property rights and intellectual property infringement claims from others. - The government procurement process. - Fluctuations in currency exchange rates. - Our debt service obligations. - Our investment portfolio consisting of a variety of investment vehicles that are subject to interest rate trends, market volatility, and other economic factors.

Our offerings are subject to export controls and economic sanctions laws and regulations that prohibit the delivery of certain solutions and services or the export of these solutions and services to locations, governments, and persons targeted by applicable sanctions without the required export authorizations. While we have processes to prevent our offerings from being exported in violation of these laws, including obtaining authorizations as appropriate and screening against U.S. government and applicable international lists of restricted and prohibited persons, we cannot guarantee that these processes will prevent all violations of export controls and sanctions laws and regulations. If our channel partners fail to obtain appropriate import, export, or re-export licenses or permits, we may also be adversely affected, through reputational harm as well as other negative consequences including government investigations and penalties. We presently incorporate export controls and sanctions compliance requirements in our channel partner agreements. Complying with export controls and sanctions laws and regulations for a particular sale may be time-consuming and may result in the delay or loss of sales opportunities. Violations of applicable sanctions or export control laws or regulations can result in fines or penalties. For additional risks regarding sanctions and trade protectionism, please see the risk factor entitled "We are dependent on international revenue and operations . . ." earlier in this section.

We are involved in legal proceedings and receive inquiries from regulatory agencies. As the global economy has changed and our business has evolved, we have seen an increase in litigation activity and regulatory inquiries. Like many other technology companies, the number and frequency of inquiries from U.S. and foreign regulatory agencies we have received regarding our business and our business practices, as well as the business practices of others in our industry, have increased in recent years. In the event we are involved in significant disputes or are the subject of a formal action by a regulatory agency, we could be exposed to costly and time-consuming legal proceedings that could result in any number of outcomes. Any claims or regulatory actions initiated by or against us, whether successful or not, could result in high defense costs, damage awards, injunctive relief, increased costs of business, fines or orders to change certain business practices, significant dedication of management time, diversion of operational resources, or otherwise harm our business. In any such event, our financial results, results of operations, cash flows, or trading prices for our securities could be negatively impacted.

We are a U.S.-based multinational company subject to tax in multiple U.S. and foreign tax jurisdictions. Our effective tax rate is primarily based on our geographic mix of earnings; statutory rates; stock-based compensation; intercompany arrangements, including the manner in which we develop, value, and license our intellectual property; and enacted tax rules. Significant judgment is required in determining our effective tax rate and in evaluating our tax positions on a worldwide basis. While we believe our tax positions, including intercompany transfer pricing policies, are consistent with the tax laws in the jurisdictions in which we conduct our business, it is possible that these positions may be challenged by tax authorities and, if our positions are not sustained, may have a significant impact on our effective tax rate and cash taxes. Tax laws in the United States and in foreign tax jurisdictions are dynamic and subject to change as new laws are passed and new interpretations of the law are issued or applied. Due to the complexity and varying interpretations of new and existing tax laws, the U.S. Department of Treasury and other standard-setting bodies have issued and will continue to issue regulations and interpretative guidance that could significantly impact how we will apply the law and the ultimate effect on our results of operations, including for our prior tax years. For example, California has recently amended its sales tax law to subject certain retail sales of digital pre-written software, cloud-based applications, and software services to sales tax in California, effective January 1, 2027, which may increase the cost to our California-based customers of purchasing our products. In addition, increases in corporate tax rates, could increase our effective tax rate, cash taxes and have an adverse effect on our results from operations. Increasingly, tax authorities are reviewing existing corporate tax regulatory and legal regimes. Many countries are actively considering or implementing new taxing regimes and changes to existing tax laws. This could include U.S. and foreign tax law developments related to changes to long-standing tax principles arising from proposals made by the Organization for Economic Co-operation and Development (the "OECD") that seek to allocate greater taxing rights to countries where customers are located and establish a global minimum tax rate of 15% ("Pillar Two"). On January 5, 2026, the OECD announced a "side-by-side" elective safe harbor that exempts U.S.-parented multinational entities from certain provisions of Pillar Two for fiscal years beginning on or after January 1, 2026. If U.S. or foreign tax authorities change applicable tax laws or successfully challenge how or where our profits are currently recognized, our overall taxes could increase, and our business, financial condition, or results of operations may be adversely impacted.

Our strategy to digitize Autodesk involves increasing our use of cloud- and web-based technologies and applications to leverage customer data to improve our offerings for the benefit of our customers. To accomplish this strategy, we must collect and otherwise process customer data, which may include personal data and personal information of users from different jurisdictions globally. We also collect and otherwise process personal data and personal information of our employees and contractors. As a result, numerous federal, state, and global laws and regulations relating to privacy, data protection, cybersecurity, and the collection, use, security, and other processing of personal data, personal information, and other data and information, apply to our data and information processing activities. The scope of these laws and regulations is rapidly evolving, subject to differing interpretations, may be inconsistent among jurisdictions, or conflict with other rules and is likely to remain uncertain for the foreseeable future. We also expect that there will continue to be new laws, regulations, and industry standards concerning these matters proposed and enacted in various jurisdictions. Globally, laws such as the General Data Protection Regulation ("EU") 2016/679 ("GDPR") in the European Union and the Personal Information Protection Law ("PIPL") in China have been enacted, and numerous other countries have proposed or have enacted laws concerning these matters, and we expect new laws, regulations, and industry standards concerning these matters to be proposed and enacted in various jurisdictions. In addition, new and emerging laws and regulations in the United States governing privacy, data protection, and cybersecurity, such as the California Consumer Privacy Act ("CCPA"), the California Privacy Rights Act ("CPRA"), other laws and regulations in other states, and numerous laws and regulations at the U.S. federal level, have been enacted or otherwise promulgated. These laws and regulations, as well as industry self-regulatory codes, industry standards, and other actual and asserted obligations to which we are or may be asserted to be subject, create new compliance obligations and substantially expand the scope of potential liability and provide greater penalties for non-compliance. For example, the GDPR provides for penalties of up to €20 million or 4% of a company's annual global revenue, whichever is greater, the PIPL provides for penalties of up to 50 million renminbi or 5% of a company's annual revenue and disgorgement of all illegal gains, whichever is greater, and the CCPA provides for penalties of up to $7,500 per violation. These laws, regulations, and codes may also impact our innovation and business drivers in developing new and emerging technologies (e.g., AI and machine learning). These requirements, among others, may impact demand for our offerings and force us to bear the burden of expanded obligations in our contracts. Many laws and regulations relating to privacy and data protection impose restrictions on cross-border transfers of personal data. Available data transfer mechanisms impose obligations on us and other companies that engage in cross-border personal data transfers and are complex, uncertain, and subject to active litigation and enforcement actions in a number of jurisdictions around the world. Data transfer mechanisms may be challenged, revoked, or otherwise modified. Numerous jurisdictions also have imposed data localization requirements, and we have faced, and expect to continue to face, customer requirements to maintain data in particular jurisdictions. We may, in addition to other impacts in connection with personal data transfer mechanisms or data localization requirements, be required to expend significant time and resources to update contractual arrangements and to comply with new and evolving obligations, experience additional costs associated with increased compliance burdens, and find it necessary or appropriate to stop using certain service providers, engage in new contract negotiations, localize certain personal data, or make other operational changes, all of which may impact our business, financial condition, and results of operations. Further, we face exposure to regulatory complaints, actions, and other proceedings, and the potential for substantial fines, other liabilities, and injunctions or other imposed requirements, in connection with transfers of personal data and data localization requirements. In addition, the CPRA and many other recently enacted state laws addressing privacy and cybersecurity provide for additional obligations and grant additional rights to consumers such as correction of personal information and additional opt-out rights. These laws have required us to modify our data processing practices and policies and may cause us to make additional modifications, and to incur substantial costs and expenses, in our efforts to comply. Additionally, privacy advocacy groups and technology and other industries are considering various new, additional, or different self-regulatory standards that may place, or be asserted to place, additional burdens on us. Evolving legislation and the interplay of federal and state laws may be subject to varying interpretations by courts and government agencies, creating complex compliance issues. These, as well as conflicting obligations imposed by laws and regulations in various jurisdictions around the world, have caused and may cause variation in requirements, increase restrictions and potential legal risk and impact strategies and the availability of, and our ability to process, previously useful data, potentially exposing us to additional expense, adverse publicity, and liability. Governments, regulators, plaintiffs' attorneys, and privacy advocates have increased their focus on how companies collect, use, store, share, transmit, and otherwise process personal data, personal information, and certain other data and information. Any perception of our practices, products, offerings, or services as violating of individual privacy or data protection rights, or failing to comply with obligations under laws or regulations relating to privacy, data protection, or cybersecurity, may subject us to public criticism, lawsuits, reputational harm, or investigations, claims, demands, or other proceedings by regulators, industry groups or other third parties, all of which could disrupt or adversely impact our business and expose us to fines, penalties, and other liabilities. Moreover, because the interpretation and application of many laws, regulations, and other actual and asserted obligations relating to privacy, data protection, cybersecurity, and the collection, use, security, and other processing of data and information are uncertain, it is possible that these laws, regulations, and obligations may be interpreted and applied in a manner that is inconsistent with our practices or the features of our products, offerings, and services. We could be required to fundamentally change our business activities and practices or modify our products, offerings, and services, any of which could require significant additional expense and adversely affect our business and results of operations, including impacting our ability to innovate, delaying our development roadmap, negatively impacting our efforts to understand our customers, limiting the effectiveness of our marketing activities, adversely affecting our relationships with customers and our ability to compete, harming our margins, and subjecting us to additional liabilities. If we are obligated to fundamentally change our business activities and practices or modify our products, offerings, or services, we may be unable to make such changes and modifications in a commercially reasonable manner, or at all, and our ability to develop new products, offerings, and services could be limited.

The software industry has limited barriers to entry, and the availability of computing devices with continually expanding performance at progressively lower prices contributes to the ease of market entry. The industry has undergone a transition from developing and selling perpetual licenses and on-premises products to subscriptions and cloud-enabled technologies. This shift further lowers barriers to entry and poses a disruptive challenge to established software companies. The markets in which we operate are characterized by vigorous competition, both by entrants with innovative technologies and by consolidation of companies with complementary offerings and technologies. Some of our competitors have greater financial, technical, sales and marketing, and other resources. Our competitors and new entrants may also be able to develop and market new technologies that render our existing or future products less competitive. For example, disruptive technologies such as machine learning and other AI technologies may significantly alter the market for our products in unpredictable ways and reduce customer demand. The market may also react to these disruptive technologies in unpredictable ways inconsistent with our financial condition and results of operation. Furthermore, a reduction in the number and availability of compatible third-party applications or our inability to rapidly adapt to technological and customer preference changes, including those related to cloud computing, mobile devices, and new computing platforms, may adversely affect the sale of our solutions. Because of these and other factors, competitive conditions in the industry are likely to intensify in the future. Increased competition could result in price reductions, reduced net revenue and profit margins, and loss of market share, any of which would likely harm our business.

We derive a substantial portion of our net revenue from sales of subscriptions of a limited number of our offerings, including AutoCAD software, solutions based on AutoCAD, which include our collections that serve specific markets, and products that are interoperable with AutoCAD. Any factor adversely affecting sales of these subscriptions, including the product release cycle, market acceptance, product competition, performance and reliability, reputation, price competition, economic and market conditions, and the availability of third-party applications, would likely harm our financial results. During the six months ended July 31, 2026 and 2025, combined revenue from our standalone AutoCAD and AutoCAD LT family products represented 24% and 25% of our total net revenue, respectively.

Our overall performance depends largely upon domestic and worldwide economic and political conditions. The United States and other countries' economies have experienced cyclical downturns, in which economic activity was impacted by falling demand for a variety of goods and services, restricted credit, poor liquidity, decreased government spending, reduced corporate profitability, volatility in credit, equity, and foreign exchange markets, inflationary pressures and higher interest rates, bankruptcies, and overall uncertainty. These economic conditions can occur abruptly. For example, current geopolitical and global macro-economic challenges, most recently regarding tariffs and trade protectionism, have caused uncertainty in the global economy, and an economic downturn or recession in the United States or in other countries may occur or has already occurred and may continue. The extent to which these challenges will impact our financial condition or results of operations is still uncertain and will continue to depend on developments such as the impact of these challenges on our customers, vendors, distributors, and resellers, such as the supply chain disruption and resulting inflationary pressures and global labor shortage that we have seen recently, material scarcity, as well as other factors; actions taken by governments, businesses, and consumers in response to these challenges; speed and timing of economic recovery, including in specific geographies; our billings and renewal rates, including new business close rates, rate of multi-year contracts, pace of closing larger transactions, and new unit volume growth; wars and armed conflicts, including the ongoing wars between Ukraine and Russia and conflicts in the Middle East; foreign exchange rate fluctuations; and the effect of these challenges on margins and cash flow. All of these factors continue to evolve and remain uncertain at this time, and some of these factors are not within our control. If economic growth in countries where we do business slows or if such countries experience further economic recessions, customers may delay or reduce technology purchases. Our customers include government entities, including the U.S. federal government, and if spending cuts impede the ability of governments to purchase our products and services, our revenue could decline. In addition, a number of our customers rely, directly and indirectly, on government spending. As described elsewhere in these risk factors, we are dependent on international revenue and operations and are subject to related risks of conducting business globally. Trends toward nationalism and protectionism, including imposition of tariffs and related trade wars, and the weakening or dissolution of international trade pacts may increase the cost of, or otherwise interfere with, conducting business. These trends have increased political and economic unpredictability globally and may increase the volatility of global financial markets, and the impact of such developments on the global economy remains uncertain. Political instability or adverse political developments in any of the countries in which we do business could harm our business, results of operations, and financial condition. A financial sector credit crisis could impair credit availability and the financial stability of our customers, including our distribution partners and channels. A disruption in the financial markets may also have an effect on our derivative counter-parties and could also impair our banking partners, on which we rely for operating cash management. War, geopolitical conflicts, and any related political or economic responses and counter-responses or otherwise by various global actors or the general effect on the global economy, could also affect our business. Any of these events could harm our business, results of operations, and financial condition.

International net revenue represented 65% of our net revenue for both the six months ended July 31, 2026 and 2025. Our international revenue, some of which comes from emerging economies, is subject to economic and political conditions in foreign markets, including those resulting from economic and political conditions in the United States. Our total revenue is also impacted by the relative geographical and country mix of our revenue over time. Our dependency on international revenue makes us much more exposed to global economic and political trends, which can negatively impact our financial results even if our results in the United States are strong for a particular period. We anticipate that our international operations will continue to account for a significant portion of our net revenue and, as we expand our international development, sales, and marketing expertise, will provide significant support to our overall efforts in countries outside of the United States. Risks inherent in our international operations include: - economic volatility;- tariffs, quotas, and other trade barriers and restrictions, geopolitical conflicts, and any political or economic responses and counter-responses thereto by various global actors;- fluctuating currency exchange rates, including devaluations, currency controls, and inflation, and risks related to any hedging activities we undertake;- changes in regulatory requirements and practices;- delays resulting from difficulty in obtaining export licenses for certain technology;- different purchase patterns as compared to the developed world;- operating in locations with a higher incidence of corruption and fraudulent business practices, particularly in emerging economies;- compliance with the U.S. Foreign Corrupt Practices Act, the U.K. Bribery Act, and other anti-corruption laws;- difficulties in staffing and managing foreign sales and development operations;- local competition;- longer collection cycles for accounts receivable;- U.S. and foreign tax law changes and the complexities of tax reporting;- laws regarding the free flow of data across international borders and management of and access to data and public networks;- possible future limitations upon foreign-owned businesses;- increased financial accounting and reporting burdens and complexities;- inadequate local infrastructure;- greater difficulty in protecting intellectual property;- software piracy; and - other factors beyond our control, including popular uprisings, terrorism, war (including any related political or economic responses and counter-responses or otherwise by various global actors or the general effect on the global economy), natural disasters, and diseases and pandemics. Some of our business partners also have international operations and are subject to the risks described above. In addition, in recent years, the United States has instituted or proposed changes to foreign trade policy, including the negotiation or termination of trade agreements, the imposition of new or increased tariffs on products imported from certain countries; economic sanctions on individuals, corporations, or countries; and other government regulations affecting trade between the United States and other countries in which we do business. For example, the United States and other global actors have continued to impose sanctions and export restrictions as a result of the war against Ukraine launched by Russia, the geopolitical landscape with respect to China, ongoing conflicts in the Middle East, and other risks. Additionally, recent executive actions and executive branch policies in the United States, such as those communicated in a February 2025 memorandum regarding a change in U.S. policy with respect to the negotiation and imposition of digital services taxes and regulations by other countries, suggest a broader purview for changes in U.S. trade policy, including a significant increase in the imposition of tariffs, as a component of U.S. foreign policy. For example, since March 2025 the United States has imposed additional tariffs on various commodities under authorities provided in Section 232 of the Trade Expansion Act of 1962, including but not limited to steel, aluminum, passenger vehicles and trucks (and components for such vehicles), and other industry-specific targets. Between February 2025 and February 2026, the United States placed additional fentanyl-related tariffs on most goods from China, Canada and Mexico (with an exception for goods qualifying for duty-free treatment under the U.S.-Mexico-Canada Agreement); and between April 2025 and February 2026 placed additional reciprocal tariffs on most imports from U.S. trading partners other than Canada, Mexico, Russia, Belarus, Cuba, and North Korea. These additional U.S. tariffs were implemented under authorities asserted in the International Emergency Economic Powers Act ("IEEPA") and rescinded on February 24, 2026, following a Supreme Court decision invalidating the use of IEEPA to authorize these tariffs. Although the U.S. government began rolling out a system to process refund requests for certain affected entities, the availability, timing, and amount of any related refunds associated with payments of these duties remain uncertain and subject to further legal, regulatory, and administrative action. Between February 24, 2026, and July 24, 2026, the U.S. government also implemented a global "temporary import surcharge" of 10% on many of the same products affected by the prior reciprocal tariffs, under authorities provided for in Section 122 of the Trade Act of 1974. Upon expiration of the Section 122 temporary import surcharge on July 24, 2026, the U.S. government implemented tariffs of up to 10% or 12.5% on imported commodities from 60 U.S. trading partners, with certain items excepted, under authorities provided under Section 301 of the Trade Act of 1974, following a determination by the U.S. Trade Representative that these trading partners have insufficiently implemented or enforced forced labor laws. The United States also recently announced an intent to impose 50% tariffs on certain products of Canada effective August 19, 2026 under authorities provided in Section 338 of the Tariff Act of 1930. Additional trade-related investigations by the U.S. government are in progress and could result in the imposition of additional tariffs, including under Sections 232, 301, 122, and 338. There is currently significant uncertainty about the future relationship between the United States and its trading partners with respect to trade policies, tariffs, taxes, and similar policies affecting cross-border operations. These new or increased tariffs and other changes in U.S. trade policy, including new sanctions and increased export restrictions, have triggered and could continue to trigger retaliatory actions by affected countries, including Canada, China, Russia, and others, that have instituted, considered, or are considering imposing new or increased tariffs, export controls, and other trade sanctions targeting certain U.S. persons or U.S.-manufactured goods. These retaliatory measures could include responses such as the imposition of new or increased digital services taxes. The escalation of protectionist or retaliatory trade measures in either the United States or any other countries in which we do business, such as additional sanctions, a change in tariff structures, increased export controls, or other trade policies, may increase the cost of, or otherwise interfere with, the conduct of our business, and could have a material adverse effect on our financial condition, operations, and business outlook. Even if we are able to successfully manage the risks of international operations, our business may be adversely affected if our business partners are not able to successfully manage these risks.

Our business is highly automated and relies extensively on the availability of our network and data center infrastructure, our internal technology systems, and our websites. We also rely on hosted computer services from third parties for services that we provide to our customers and computer operations for our internal use. The failure of our systems or hosted computer services due to a catastrophic event, such as an earthquake, fire, flood, tsunami, weather event, other climate-related events (such as drought, water security, heat waves, cold waves, and poor air quality), telecommunications failure, power failure, cyber-attack, terrorism or war (including the ongoing wars between Ukraine and Russia and conflicts in the Middle East, and any related political or economic responses and counter-responses or otherwise by various global actors or the general effect on the global economy), or business interruption from epidemics or pandemics, or the fear of such events, could adversely impact our business, financial results, and financial condition. For example, our corporate headquarters and executive offices are located near major seismic faults in the San Francisco Bay Area and face annual periods of wildfire danger, which increase the probability of power outages and may impact employees' abilities to commute to work or to work from home. We have developed disaster recovery plans and maintain backup systems in order to reduce the potential impact of a catastrophic event; however, there can be no assurance that these plans and systems would enable us to return to normal business operations. In addition, any such event could negatively impact a country or region in which we sell our products. This could in turn decrease that country's or region's demand for our products, negatively impacting our financial results.

Because we conduct a substantial portion of our business outside the United States, we face exposure to adverse movements in foreign currency exchange rates, which could have a material adverse impact on our financial results and cash flows. These exposures may change over time as business practices evolve and economic conditions change. We use derivative instruments to manage a portion of our cash flow, revenue and expense exposure to fluctuations in foreign currency exchange rates. As part of our risk management strategy, we use foreign currency contracts to manage a portion of our exposures of underlying assets, liabilities, and other obligations, which exist as part of our ongoing business operations. These foreign currency instruments may have maturities that extend for one to 18 months in the future and provide us with some protection against currency exposures. However, our attempts to hedge against these risks may not be completely successful, resulting in an adverse impact on our financial results. The fluctuations of currencies in which we conduct business can both increase and decrease our overall revenue and expenses for any given period. Although our foreign currency cash flow hedge program extends beyond the current quarter in order to reduce our exposure to foreign currency volatility, we do not attempt to completely mitigate this risk, and in any case, will incur transaction fees in adopting such hedging programs. Such volatility, even when it increases our revenues or decreases our expenses, impacts our ability to accurately predict our future results and earnings. In addition, global events, including geopolitical and economic developments, may contribute to volatility in foreign exchange markets, which we may not be able to effectively manage, and our financial results could be adversely impacted. Additionally, countries in which we operate may be classified as highly inflationary economies, requiring special accounting and financial reporting treatment for such operations, or such countries' currencies may be devalued, or both, which may adversely impact our business operations and financial results.