Appian (APPN) Risk Analysis

The emerging technologies described as AI, which include machine learning, generative AI, including large language models, and similar means of algorithm self-generation, have the ability to affect the market for our software by directing what are now human-orchestrated processes into machine-orchestrated processes. In recent years, AI technologies have been the subject of great interest to our customers and to followers of our markets, and these technologies have been showcased and subject to substantial interest among our customer base. Should we fail to effectively compete with, adopt, or integrate emerging AI technologies that show benefits to our customers, or should AI technologies for code generation or application development reduce the demand for our process automation platform, we could struggle to continue to grow our business or lose business with existing customers to such technologies. We have incorporated, and may continue to incorporate, AI in our products and services, and this incorporation of AI in our business and operations may become more significant over time. The use of generative AI, a technology that has evolved significantly over recent years, exposes us to additional risks, such as competitive, reputational, operational, legal, regulatory and other risks, including additional costs. For example, generative AI has been known to produce false or "hallucinatory" inferences or output, and the models, prompts, algorithms, and datasets on which AI relies, as well as the content, analyses, or other output generated thereby, may be invalid, inaccurate, or biased or contain other errors or inadequacies, any of which may not be easily detectable by us or any of our related third-party providers. While we make efforts to implement and use AI technologies designed to improve the accuracy and reduce the chances of hallucinatory inferences or outputs, we cannot completely eliminate the foregoing risks. Additionally, the use of AI technologies by companies has resulted in, and may in the future result in, cybersecurity incidents and data privacy violations that implicate the confidential, proprietary, or personal information of users of such AI technologies. If any of our employees, contractors, vendors, or service providers use any third-party AI technologies in connection with our business or the products or services they provide to us, it may lead to the inadvertent disclosure or incorporation of our confidential, sensitive, or proprietary information into publicly available or other third-party training sets which may impact our ability to realize the benefit of, or adequately maintain, protect and enforce our intellectual property or sensitive or confidential information, harming our competitive position and business. Our ability to mitigate risks associated with disclosure of our proprietary, sensitive, or confidential information, including in connection with the use of AI, will depend on our implementation, maintenance, monitoring, and enforcement of appropriate technical and administrative safeguards, policies, and procedures governing the use of AI in our business. Moreover, given we rely on third-party providers for the underlying large language models and other technology, as do many others in the software industry, we do not have full access to the underlying software code to address such issues. If the AI technologies that we or our third-party providers use are, or are perceived to be, deficient, inaccurate, biased, unethical or otherwise flawed, our reputation, competitive position and business may be materially and adversely affected. In addition, new laws and regulations, or the interpretation of existing laws and regulations, in any of the jurisdictions we operate may affect our ability to leverage AI in any of our operations, products, and services and may expose us to government enforcement or civil suits. As the legal and regulatory framework encompassing AI evolves, it may result in increases in our operational, compliance, and development expenses that impact our ability to develop, earn revenue from, or utilize any products or services incorporating AI. If we do not have sufficient rights to use the models, prompts, algorithms, and datasets on which our AI and machine learning technologies rely, or the content, analyses, recommendations or other output generated thereby, we could also incur liability through the violation of applicable laws and regulations, third-party intellectual property, privacy or other rights or contracts to which we are a party. In the U.S., a number of civil lawsuits have been initiated related to the foregoing and other concerns, any of which may, amongst other things, require us to limit the ways in which AI technologies are trained, refined or implemented, and may affect our ability to develop or use products or services using or incorporating AI. Furthermore, our competitors, customers, or other third parties may incorporate AI into their products more quickly or more successfully than us, which could impair our ability to compete effectively. Given we rely on third-party providers for the underlying large language models and other technology, our ability to differentiate our AI products or services from our competitors could be limited. Further, to the extent other, larger technology companies with greater resources and market power gain exclusive or advantageous access to large language model or other AI technology providers, our ability to offer competing AI products or services could be negatively impacted. The increasing use of generative AI by third parties may also negatively impact the integrity of our own proprietary data, data sets, and content databases if and to the extent any invalid, inaccurate, incomplete, misleading, biased, or otherwise flawed data produced by any such AI technologies may inadvertently be incorporated in our proprietary data, data sets, or content databases, negatively affecting our reputation and the value of our proprietary data, data sets, or content databases. As generative AI and other AI technologies are relatively new, sophisticated, and evolving quickly, we cannot predict all of the risks that may arise from our current or future use of AI in our business. Any of the foregoing and any similar issues, whether actual or perceived, could negatively impact our customers' experience and diminish the perceived quality and value of our products and services. This in turn could damage our brand, reputation, competitive position, and business.

Our platform is inherently complex and may contain material defects or errors. Any defects in functionality, security, or other conditions that cause interruptions in the availability of our platform could result in: - Loss or delayed market acceptance and sales;- Breach of warranty claims;- Sales credits or refunds for prepaid amounts related to unused subscription services;- Loss of customers;- Diversion of development and support resources; and/or - Injury to our reputation. The costs incurred in correcting any material defects or errors might be substantial and could adversely affect our operating results. Our customer agreements often provide service level commitments on a monthly basis. If we are unable to meet the stated service level commitments or suffer extended periods of unavailability for our platform, we may be contractually obligated to provide these customers with service credits or refunds for prepaid amounts, or we could face contract terminations. Our revenue could be significantly affected if we suffer unscheduled downtime that exceeds the allowed downtimes under our agreements with our customers. Because of the large amount of data we collect and manage, it is possible hardware failures or errors in our systems could result in data loss or corruption or cause the information we collect to be incomplete or contain inaccuracies our customers regard as significant. Furthermore, the availability or performance of our platform could be adversely affected by a number of factors, including customers' inability to access the internet, our customers' increased usage of our cloud offering, the failure of our network or software systems, security breaches, or variability in user traffic for our services. In addition to potential liability, if we experience interruptions in the availability of our cloud offering, our reputation could be adversely affected, and we could lose customers. We also provide frequent incremental releases of software updates and functional enhancements to our platform. Despite extensive pre-release testing, such new versions occasionally contain undetected errors when first introduced or released. We have, from time to time, found errors in our software, and new errors in our existing software may be detected in the future. Since our customers use our software for important aspects of their business, any errors, defects, disruptions in our platform, or other performance problems with our solution could hurt our reputation and may damage our customers' businesses. If that occurs, our customers may delay or withhold payment to us, elect not to renew, or make service credit claims, warranty claims, or other claims against us, and we could lose future sales. The occurrence of any of these events could result in an increase in our bad debt expense, an increase in collection cycles for accounts receivable, decreased future revenue and earnings, require us to increase our warranty provisions, or incur the risk or expense of litigation.

The functionality and attractiveness of our platform depends, in part, on our ability to integrate our platform with third-party applications and platforms, including customer relationship management, human resources information, accounting, and enterprise resource planning systems our customers use and from which they obtain data. Third-party providers of applications and application programming interfaces, or APIs, may change the features of their applications and platforms, restrict our access to their applications and platforms, or alter the terms governing use of their applications and APIs and access to those applications and platforms in an adverse manner. Such changes could functionally limit or terminate our ability to use these third-party applications and platforms in conjunction with our platform, which could negatively impact our offerings and harm our business. If we fail to integrate our software with new third-party applications and platforms our customers use, we may not be able to offer the functionality our customers need, which would negatively impact our ability to generate revenue and adversely impact our business.

Our software contains software licensed to us by third parties under so-called "open source" licenses, including the GNU Lesser General Public License, the BSD License, and others. From time to time, there have been claims against companies that distribute or use open source software in their products and services, asserting such open source software infringes the claimants' intellectual property rights. We could be subject to suits by parties claiming what we believe to be licensed open source software infringes their intellectual property rights. Use and distribution of open source software may entail greater risks than use of third-party commercial software, as open source licensors generally do not provide warranties or other contractual protections regarding infringement claims or the quality of the code. In addition, certain open source licenses require source code for software programs subject to the license be made available to the public and that any modifications or derivative works to such open source software continue to be licensed under the same terms. Although we monitor our use of open source software in an effort both to comply with the terms of the applicable open source licenses and to avoid subjecting our software to conditions we do not intend, the terms of many open source licenses have not been interpreted by U.S. courts, and there is a risk these licenses could be construed in a way that could impose unanticipated conditions or restrictions on our ability to commercialize our platform. By the terms of certain open source licenses, we could be required to release the source code of our software and to make our software available under open source licenses, if we combine or distribute our software with open source software in a certain manner. In the event portions of our software are determined to be subject to an open source license, we could be required to publicly release the affected portions of our source code, re-engineer all, or a portion of, that software or otherwise be limited in the licensing of our software, each of which could reduce or eliminate the value of our platform. Many of the risks associated with usage of open source software cannot be eliminated and could negatively affect our business, results of operations, and financial condition.

We are subject to the U.S. Foreign Corrupt Practices Act of 1977, as amended, or the FCPA, the U.S. domestic bribery statute contained in 18 U.S.C. § 201, the U.S. Travel Act, the United Kingdom Bribery Act 2010, and other anti-corruption laws in countries in which we conduct activities. Anti-corruption laws are interpreted broadly and prohibit our company from authorizing, offering, or providing, directly or indirectly, improper payments or benefits to recipients in the public or private sector. We use third-party law firms, accountants, and other representatives for regulatory compliance, sales, and other purposes in several countries. We can be held liable for the corrupt or other illegal activities of these third-party representatives, our employees, contractors, and other agents, even if we do not explicitly authorize such activities. In addition, although we have implemented policies and procedures to ensure compliance with anti-corruption laws, there can be no assurance all of our employees, representatives, contractors, or agents will comply with these laws at all times. Non-compliance with these laws could subject us to whistleblower complaints, investigations, sanctions, settlements, prosecution, other enforcement actions, disgorgement of profits, significant fines, damages, other civil and criminal penalties or injunctions, suspension and/or debarment from contracting with certain persons, the loss of export privileges, reputational harm, adverse media coverage, and other collateral consequences. If any subpoenas or investigations are launched, or governmental or other sanctions are imposed, or if we do not prevail in any possible civil or criminal litigation, our business, results of operations, and financial condition could be materially harmed. In addition, responding to any action will likely result in a materially significant diversion of management's attention and resources and significant defense costs and other professional fees. Enforcement actions and sanctions could further harm our business, results of operations, and financial condition. Moreover, as an issuer of securities, we also are subject to the accounting and internal controls provisions of the FCPA. These provisions require us to maintain accurate books and records and a system of internal controls sufficient to detect and prevent corrupt conduct. Failure to abide by these provisions may have an adverse effect on our business, operations, or financial condition.

The United States and other countries maintain and administer export and import laws and regulations, including various economic and trade sanctions such as those administered by the Office of Foreign Assets Control, which apply to our business. We are required to comply with these laws and regulations. If we fail to comply with such laws and regulations, we and certain of our employees could be subject to substantial civil or criminal penalties, including the possible loss of export or import privileges, fines which may be imposed on us and responsible employees or managers, and, in extreme cases, the incarceration of responsible employees or managers. Changes in our platform, or changes in applicable export or import laws and regulations, may create delays in the introduction and sale of our platform in international markets or, in some cases, prevent the export or import of our platform to certain countries, governments, or persons altogether. Any change in export or import laws and regulations or economic or trade sanctions, shift in the enforcement or scope of existing laws and regulations, or change in the countries, governments, persons, or technologies targeted by such laws and regulations could also result in decreased use of our platform or in our decreased ability to export or sell our platform to existing or potential customers. Any decreased use of our services or limitation on our ability to export or sell our services would likely adversely affect our business, financial condition, and results of operations. We incorporate encryption technology into certain of our products. Encryption products may be exported outside of the United States only with the required export authorization, including by license, license exception, or other appropriate government authorization. Obtaining the necessary export license or other authorization for a particular sale may be time-consuming and may result in the delay or loss of sales opportunities. In addition, various countries regulate the import of certain encryption technology, including import permitting and licensing requirements, and have enacted laws that could limit our ability to distribute our products or could limit our customers' ability to implement our products in those countries. Although we take precautions to prevent our products from being provided in violation of such laws, our products may have been in the past, and could in the future, be provided inadvertently in violation of such laws, despite the precautions we take. Governmental regulation of encryption technology and regulation of imports or exports, or our failure to obtain required import or export approval for our products, could harm our international sales and adversely affect our revenue. Moreover, U.S. export control laws and economic sanctions programs prohibit the provision of services to countries, governments, and persons subject to U.S. economic embargoes and trade sanctions. Even though we take precautions to prevent our platform from being used by U.S. sanctions targets, our platform could be used by a sanctioned person or in an embargoed country despite such precautions. Any such shipment could have negative consequences, including government investigations, penalties, and reputational harm.

Our business is subject to regulation by various federal, state, local, and foreign governments. In certain jurisdictions, these regulatory requirements may be more stringent than those in the United States. Noncompliance with applicable regulations or requirements could subject us to investigations, sanctions, mandatory product recalls, enforcement actions, disgorgement of profits, fines, damages, civil and criminal penalties, injunctions, or other collateral consequences. If any governmental sanctions are imposed or if we do not prevail in any possible civil or criminal litigation, our business, results of operations, and financial condition could be materially adversely affected. In addition, responding to any action will likely result in a significant diversion of management's attention and resources and an increase in professional fees. Enforcement actions and sanctions could harm our business, reputation, results of operations, and financial condition.

A significant portion of our revenue is generated from subscriptions sold to governmental entities, both in the United States and internationally. Additionally, many of our current and prospective customers such as those in the financial services, life sciences, insurance, and healthcare industries are highly regulated and may be required to comply with more stringent regulations in connection with subscribing to and implementing our platform. Selling subscriptions to these entities can be highly competitive, expensive, and time-consuming, often requiring significant upfront time and expense without any assurance we will successfully complete a sale. In addition, if our software or personnel do not meet the standards of new or existing regulations, we may be in breach of our contracts with our customers, allowing them to terminate their agreements. Governmental demand and payment for our platform may also be impacted by public sector budgetary cycles and funding authorizations, with funding reductions or delays adversely affecting public sector demand for our platform. In addition, changes in the administration and their priorities could also affect public sector budgets and funding. The United States has previously experienced lapses in federal appropriations, and any such future lapses could negatively affect our business, results of operations, and financial condition. In addition, governmental and highly regulated entities impose compliance requirements that are complicated, make pricing readily available, subject continued business to unpredictable competitive processes, or are otherwise time-consuming and expensive to satisfy. We also must comply with laws and regulations relating to the formation, administration, and performance of contracts, which provide public sector customers with specific rights, many of which are not typically found in commercial contracts. In the United States, applicable federal contracting regulations change frequently, and the President may issue executive orders requiring federal contractors to adhere to new compliance requirements after a contract is signed. If we commit to meeting special standards or requirements and do not meet them, including requirements related to security clearances for personnel and facilities, we could be subject to significant liability from our customers or regulators. Even if we do meet these special standards or requirements, the additional costs associated with providing our platform to government and highly regulated customers could harm our operating results. Moreover, changes in the underlying statutory and regulatory conditions that affect these types of customers could compromise our ability to efficiently provide them access to our platform and to grow or maintain our customer base. In addition, engaging in sales activities to foreign governments introduces additional compliance risks specific to the U.S. Foreign Corrupt Practices Act, the U.K. Bribery Act, and other similar statutory requirements prohibiting bribery and corruption in the jurisdictions in which we operate.

Our customer base is concentrated. For example, during the years ended December 31, 2025, 2024, and 2023, revenue from U.S. federal government agencies represented 25.3%, 23.9%, and 21.3% of our total revenue, respectively, and the top three U.S. federal government customers generated 3.9%, 4.0%, and 4.2% of our total revenue for the years ended December 31, 2025, 2024, and 2023, respectively. Changes in the administration and their priorities may impact public sector budgets and funding for federal government agencies. See our risk factor below at "A portion of our revenue is generated from subscriptions sold to governmental entities and heavily regulated organizations, which are subject to a number of challenges and risks." If we were to lose one or more of our significant customers and we were unable to recover the revenue from that customer from other customers, our revenue would significantly decline. In addition, revenue from significant customers may vary from period to period depending on the timing of renewing existing agreements or entering into new agreements. The loss of one or more of our significant customers could materially and adversely affect our business, results of operations, and financial condition.

Sales of our software platform account for substantially all of our subscriptions revenue and are the source of substantially all of our professional services revenue. We expect we will be substantially dependent on our platform to generate revenue for the foreseeable future. As a result, our operating results or revenue growth rates could suffer due to: - Any decline or lower than expected growth in demand for our platform;- The failure of our platform to achieve continued market acceptance;- The market for process automation solutions not continuing to grow or growing more slowly than we expect;- The introduction of products and technologies (including AI technologies) that represent an improvement over, or serve as a replacement or substitute for, our platform;- Technological innovations or new standards that our platform does not address;- Sensitivity to current or future prices offered by us or competing solutions;- The inability to further penetrate our existing industry verticals or expand our customer base; and - Our inability to release enhanced versions of our platform on a timely basis.

We derive, and expect to increasingly derive in the future, a substantial portion of our revenue from the sale of software subscriptions. For 2025, 2024, and 2023, approximately 79.3%, 79.5%, and 75.6%, respectively, of our total revenue was subscriptions revenue. In order for us to improve our operating results, it is important our customers renew their subscriptions with us when their initial term expires as well as purchase additional subscriptions from us. In general, our customers have no renewal obligation after their initial term expires, and we cannot provide assurance we will be able to renew subscriptions with any of our customers at the same or higher contract value. Further, while we offer access to our platform primarily through multi-year subscription agreements, some agreements may have shorter durations. Additionally, some of our contracts limit the amount we can increase prices from period to period or include pricing guarantees. If our customers do not renew their agreements, terminate their agreements, renew their agreements on terms less favorable to us, or fail to purchase additional software subscriptions, our revenue may decline and our operating results would likely be harmed as a result.