Agilysys (AGYS) Risk Analysis

We rely on a combination of copyright, patent, trademark and trade secret laws and restrictions on disclosure to protect our intellectual property rights. We cannot be certain that the steps we have taken will prevent unauthorized use of our technology. Any failure to protect our intellectual property rights would diminish or eliminate the competitive advantages that we derive from our proprietary technology.

We rely on information technology networks and systems, some of which are owned and operated by third parties, to collect, process, transmit, and store electronic information on behalf of our customers. We also depend on our information technology infrastructure for a variety of functions, including worldwide financial reporting, procurement, invoicing, and email communications. These systems are susceptible to outages due to fire, floods, power loss, telecommunications failures, hacking, terrorist attacks, and similar events. Our solutions are primarily delivered through multi-tenant cloud architectures in which multiple customers are served through shared environments. Although we employ controls designed to logically segregate customer data, any failure, vulnerability, or misconfiguration could result in unauthorized access to or exposure of one customer's data to another, which could lead to legal liability, regulatory scrutiny, and reputational harm. We also rely on identity and access management controls to govern user access across our systems. Risks associated with overprivileged accounts or accounts not centrally managed through our single sign-on systems could create vulnerabilities. Any failure to promptly revoke or appropriately manage access credentials, including those of former personnel or compromised accounts, may result in unauthorized access or data exfiltration. In addition, our services depend on integrations with third-party applications through APIs, OAuth tokens, and similar authentication mechanisms. Mismanagement, compromise, or misuse of such credentials could enable unauthorized access and allow threat actors to move laterally across interconnected systems, increasing the scope and impact of a cybersecurity incident. We have implemented security measures and controls intended to protect our IT infrastructure, data centers and other systems and data against cyber-attacks. Despite our implementation of security measures and controls, our systems and those of third parties upon whom we rely are vulnerable to attack from numerous threat actors, including sophisticated nation-state and nation-state-supported actors. Threat actors have and may in the future be able to compromise our security measures or otherwise exploit vulnerabilities in our systems, including vulnerabilities that may have been introduced through the actions of our employees or contractors or defects in the design or manufacture of our products and systems or the products and systems that we procure from third parties. Our systems, and those of our third-party providers, have and could in the future become subject to cyber-attacks, including using computer viruses, credential harvesting, dedicated denial of services attacks, malware, social engineering, and other means for obtaining unauthorized access to, or disrupting the operation of, our systems and those of our third-party providers. In addition, threat actors are also increasingly using tools and techniques that circumvent controls, evade detection, and remove forensic evidence, which means that we and others may be unable to anticipate, detect, deflect, contain or recover from cyberattacks in a timely or effective manner. As AI capabilities improve and are increasingly adopted, we may see cyberattacks created through AI. These attacks could be crafted with an AI tool to directly attack IT systems with increased speed and/or efficiency than a human threat actor or create more effective phishing emails. Our network and storage applications, as well as those of our customers, business partners, and third-party providers, may be subject to unauthorized access by hackers or breached due to operator error, malfeasance or other system disruptions. The number and scale of cyberattacks have continued to increase and the methods and techniques used by threat actors, including sophisticated "supply-chain" attacks, continue to evolve at a rapid pace. As a result, we may be unable to identify current attacks, anticipate future attacks or implement adequate security measures. We have experienced attacks in the past, which did not have any material adverse effects on our business, financial condition or results of operations. However, we may experience security breaches that could remain undetected for an extended period and, therefore, have a greater impact on our systems, our products, the proprietary data contained therein, our customers, and ultimately, our business. Cyberattacks on our systems and "supply-chain" attacks on systems of third parties upon whom we rely, and any related operational disruptions, unauthorized access, or misappropriation of information (including personally identifiable information or personal data), could create costly litigation, significant financial liability, and a loss of confidence in our ability to serve customers and cause current or potential customers to choose another provider, all of which could have a material adverse effect on our business, financial condition, reputation, and results of operations.

We utilize AI solutions both for internal productivity purposes and in products and services available to our customers. We also work with partners who have incorporated or may incorporate AI solutions in their products and services. While AI and machine learning present opportunities for enhanced productivity, AI also introduces cybersecurity, data privacy, IT, intellectual property, regulatory, legal, operational, competitive, reputational and other risks that could adversely impact our business. For example, if the content, recommendations or analyses that AI applications assist in producing are or are alleged to be deficient or inaccurate, or if the data used to train these applications are or are alleged to be deficient or inaccurate or legally impermissible to train on, we could be subject to competitive risks, potential legal liability, and reputational harm. Furthermore, the integration of third-party AI models, including Large Language Models, within our products and services may rely, in part, on certain safeguards implemented by the third-party developers of the underlying AI models, including those related to the accuracy, bias, and other variables of the data, and these safeguards may be insufficient. In addition, AI may present evolving ethical issues. If our use of AI becomes controversial, we may experience reputational harm or legal liability. Further, given the early stage of generative AI, the evolving regulatory landscape surrounding AI also poses a risk, as new laws and regulations could impose additional compliance burdens, resulting in increased operational costs to comply with U.S. and non-US laws concerning the use of AI. For example, the EU's Artificial Intelligence Act, or AI Act, originally entered into force on August 1, 2024, and is expected to undergo amendments as introduced in the EU's November 2025 Digital Omnibus. As enacted, the AI Act imposes significant obligations on providers and deployers of high-risk AI systems and encourages providers and deployers of AI systems to account for EU ethical principles in their development and use of these systems. Likewise, within the United States, the regulatory landscape is rapidly evolving as evidenced by several U.S. states introducing or enacting legislation that is designed to govern the development or use of AI. Our ability to use and offer AI and machine learning solutions may be constrained by current or future laws, regulatory, or self-regulatory requirements. At the federal level, the Trump Administration has endorsed a federal moratorium on the enforcement of state AI laws, including through a December 11, 2025 executive order on "Ensuring a National Policy Framework for Artificial Intelligence." Federal efforts have thus far have not been successful in curtailing state action on AI regulation, which has contributed to an increasingly complicated regulatory landscape. The rapid evolution of AI, including potential additional government regulation of AI and its various uses, may require significant resources for us to implement compliant and ethical AI practices. We may also be subject to significant enforcement actions or litigation in the event of any perceived or actual non-compliance. The rapid adoption of AI technologies may create an "arms race" dynamic in our industry, in which competitors leverage AI to develop more efficient, automated, or lower-cost alternatives to our offerings or to disrupt traditional subscription-based software models. In addition, AI-enabled tools may bypass or reduce reliance on traditional application-layer workflows, which could diminish the value of our platform and adversely affect demand for our solutions.