ARM Holdings PLC ADR (ARM) Risk Analysis

In order to remain competitive in the highly competitive markets in which we do business, we may need to reduce the prices of our products or services or otherwise change the structure and terms of our customer relationships or our business model. If our competitors offer significant discounts on certain products in an effort to recapture or gain market share or to sell other software or hardware products, we may need to lower our prices or offer other favorable terms to compete successfully. Any such changes would likely reduce our profits and could have a material adverse effect on our business, results of operations, financial condition and prospects. Any substantial changes to our other commercial arrangements with our customers or our business model could cause revenues to decline or be delayed as our sales force implements and our customers adjust to the commercial arrangements or business model. Changes to our business model could also necessitate changes in our product mix, which could cause revenues or profitability to decline, particularly if such changes in our product mix result in an increased reliance on lower margin offerings. If we cannot offset price reductions with a corresponding increase in sales volume or by reducing our costs, then the reduced revenues resulting from lower prices could have a material adverse effect on our business, results of operations, financial condition and prospects. Further, we can provide no assurances that customers will accept changes in our business model, which could result in lower revenues, particularly in the period immediately following the initial introduction of a new business model. In such case, we may not realize the anticipated financial benefits of such changes in the amounts we anticipate, on the expected timeline or at all. We also, from time to time, engage in commercial activities that are accretive to our business but are not part of our core business. We have entered, and expect in the future to enter, into arrangements with third parties where we undertake to arrange for products to be supplied to a customer by a third party. For example, we recently entered into an agreement to arrange for certain semiconductor products to be supplied by a third party to a customer. In connection with this agreement, we have purchase commitments of approximately $100 million to be purchased over the next 12 months. We expect that our purchase commitments are likely to grow materially in subsequent years pursuant to this agreement or others of a similar nature. As a result, we face additional risk and financial exposure from these arrangements in the form of third-party default, order cancellation, periods during which we bear financial exposure without corresponding customer cash flows, and related inventory risks. We may also be exposed to claims for contractual breach, reputational harm and loss of future business opportunities. Such risks may be amplified in markets for high-demand or scarce technology products, where supply-and-demand imbalances, competitive pressures for supplier allocation and supplier prioritization of other customers may increase the risk of default. In addition, increases in the number or value of commercial contracts signed in the future may not materialize in the same way or at all under a new business model or in connection with accretive commercial activities and, therefore, our revenue may be lower than expected. Further, the use of a new business model or accretive commercial activities may have unexpected consequences for our company, including making our products less attractive to current and prospective customers or otherwise changing how we must operate our business, which could have a material adverse effect on our business, competitive position, results of operations, financial condition and prospects.

Our success depends substantially on the acceptance of our products and services by semiconductor and systems companies, particularly those that develop and market chips for high-volume electronic devices in the automotive, embedded and internet of things ("IoT"), enterprise electronics, and mobile and consumer electronics markets. There are competing microprocessor architectures in the market and there is no certainty that the market will continue to accept our products to the same or greater extent than it does today. Demand from large, global systems companies, including original equipment manufacturers ("OEMs") and cloud service providers ("CSPs"), drives much of the development of silicon chips and computer systems. Accordingly, acceptance of our products by these companies as well as semiconductor and other companies for use in a variety of end-market applications is critical for our continued success. The semiconductor and electronics industries have also become increasingly complex and subject to increasing design and manufacturing costs. Many of our customers utilize third-party vendors for EDA tools and also outsource the manufacture of their semiconductor designs to foundries. We work closely with major EDA vendors and foundries to ensure that our products are compatible with their design tools and manufacturing processes. However, if we fail to optimize our products for use with major EDA vendors' tools and foundries' manufacturing processes, or if our access to such tools and processes is hampered, then our products may become less desirable to our customers. Similarly, for customers that do not outsource design and manufacturing processes, if our products are unsuitable for the customers' internal processes, then our products may not be acceptable to those customers. Additionally, there are risks inherent in the manufacturing of next-generation process technologies, including production timing delays, lower-than-anticipated manufacturing yields, and product defects and errata. If foundries are unable to successfully or efficiently manufacture future generations of chips based on our products, demand for our products could be materially adversely affected along with our business, results of operations, financial condition and prospects.

We are required to test our foreign private issuer status at the end of our second fiscal quarter in each fiscal year. If we were no longer a foreign private issuer, we would be required to comply with all of the periodic disclosure and current reporting requirements of the Exchange Act applicable to U.S. domestic issuers as of the first day of the following fiscal year. In order to maintain our current status as a foreign private issuer, either (a) a majority of our securities must be either directly or indirectly owned of record by nonresidents of the U.S. or (b)(i) a majority of our executive officers or directors cannot be U.S. citizens or residents, (ii) more than 50% of our assets must be located outside the U.S. and (iii) our business must be administered principally outside the U.S. If SoftBank Group or its affiliates do not continue to hold a majority of our ordinary shares, we would likely fail to maintain our status as foreign private issuer. If we lose our status as a foreign private issuer, we would be required to comply with the Exchange Act reporting and other requirements applicable to U.S. domestic issuers, which are more detailed and extensive than the requirements for foreign private issuers. We may also be required to make changes in our corporate governance practices in accordance with various SEC and Nasdaq rules. The regulatory and compliance costs to us under U.S. securities laws if we are required to comply with the reporting requirements applicable to a U.S. domestic issuer may be significantly higher than the cost we would incur as a foreign private issuer. As a result, we expect that a loss of foreign private issuer status would increase our legal and financial compliance costs and is likely to make some activities highly time-consuming and costly. We also expect that if we were required to comply with the rules and regulations applicable to U.S. domestic issuers, it would make it more difficult and expensive for us to obtain director and officer liability insurance, and we may be required to accept reduced coverage or incur substantially higher costs to obtain coverage. These rules and regulations could also make it more difficult for us to attract and retain qualified members of our Board of Directors.

To remain competitive, we must continue to innovate and develop new products and services, as well as enhancements to our existing products and services, in response to expressed or anticipated customer demand and new market opportunities. We continue to actively consider the impact of next generation technology adopted by market participants, which has resulted in us allocating resources to, and exploring, new markets and/or different products and solutions for existing and prospective customers in various end markets. For example, in 2024, we introduced a CSS targeted at customers in the infrastructure space and, more recently, we expanded our compute platform into production silicon products with the Arm AGI CPU. We intend to continue allocating resources and engaging with our ecosystem partners to explore the viability and development of new products including, without limitation, new products in our IP portfolio, as well as solutions beyond individual IP designs such as RTL-based CSSs, GDSII-based CSSs, chiplets and complete chip solutions. For example, we have been, and may in the future be, engaged to advise on or design chips for certain existing customers and other third parties, including affiliates of SoftBank Group, across a variety of use cases and end markets. Any products or solutions that constitute an entry into new markets or offerings of different solutions may be unsuccessful for any number of reasons. For example, as with any company entering a new market or offering new products or solutions, we will compete with companies that have a more established presence, longstanding customer relationships and established brand awareness. Additionally, any such new business activities may be undertaken utilizing any number of commercial arrangements, including as a technical advisor or licensor to SoftBank Group or its affiliates. Additionally, because our resources must be allocated amongst developing and maintaining our existing IP portfolio and developing and commercializing any new, more integrated compute products or solutions, companies that focus their efforts on a single product or solution or a limited number of products or solutions may have significantly greater financial, technical, manufacturing, marketing, sales and distribution resources dedicated to such markets and solutions than we do. Such companies may also have a more developed IP portfolio for the applicable markets and solutions and may be able to leverage these resources and competitive factors to gain or maintain market share. Further, although more integrated compute products may provide our customers superior performance and faster routes to market for their products (compared to licensing and integrating separate IP components), our customers may prefer to continue integrating our IP components in their products and solutions, and, therefore, our more integrated compute products may not be adopted by customers on our expected timeline or at all. Any developments in our product offerings, including our entry into production silicon products such as the Arm AGI CPU, and other changes to our products and services, may create real or perceived conflicts with companies that are important to our business. Our direct commercial relationships with hyperscale, cloud, enterprise, and AI infrastructure customers increase the potential for competitive conflicts with our traditional licensing customers. Many of our semiconductor and systems company customers who have historically licensed our IP may face direct competition from us in certain market segments, and our partnerships and certain commercial relationships may be perceived by other customers as preferential treatment or as creating conflicts of interest. As a result, these customers or partners may terminate or materially reduce their relationship with us, seek alternative architectures or products, develop their own proprietary architectures, withhold sensitive roadmap information, reduce collaboration on product development, challenge our pricing models or demand more favorable commercial terms, or pursue legal action. We may also be subject to greater regulatory scrutiny in relation to our business. Accordingly, to the extent that we pursue entry into any new market or offer any new product or solution, we may not realize the anticipated financial benefits of such changes in the amounts we may anticipate, on our expected timeline or at all. The loss of one or more significant licensing customers as a result of these competitive conflicts could have a material adverse effect on our licensing revenue and could materially harm our business, results of operations, financial condition, and prospects. Furthermore, we have, and may in the future, need to recruit and hire engineers or other employees or acquire companies that possess the requisite expertise, which we may not be able to do successfully on a timely basis, on competitive terms or at all. We have also begun exploring potential acquisitions of, or service agreements with, companies with the required expertise. The recruitment and retention of engineers and other employees or the acquisition of companies may require significant expenditures, including compensation costs or the acquisition of businesses employing the required expertise. We may also be required to seek to hire engineers or other employees from customers, partners or competitors in order to secure the necessary expertise to develop new or enhanced products or solutions, which may result in customers or partners terminating or materially reducing their relationship with us. Additionally, to the extent we seek to hire engineers or other employees from competitors, we may be unsuccessful due to, among other reasons, such competitors having greater resources or long-standing relationships with such engineers and other employees. To the extent that we do not have the technical expertise, financial resources or other capabilities for a particular research and development project with respect to new products or solutions, we have partnered, and may in the future partner, with third parties, including SoftBank Group and/or its affiliates. There can be no assurance that such partnerships will be established on a timely basis, on competitive terms or at all. In such circumstances, we rely on third parties over which we exercise little or no control, and we can provide no assurances that any such third parties will dedicate the resources, or have the requisite technical or other capabilities, necessary to achieve our and/or our customers' expectations.

Our success and ability to compete depend significantly on protecting our IP rights. We primarily rely on patent, copyright, trade secret and trademark laws, trade secret protection and contractual protections, such as confidentiality, invention assignment and license agreements with our employees, customers, third-party partners and others, to protect our IP rights. The steps we take to protect our IP rights may be inadequate. We also may not be able to obtain desired patents, and our pending (of which we currently have approximately 2,750) or future patent applications, whether or not being currently challenged, may not result in the issuance of patents with the scope of protection we seek, including in jurisdictions of strategic importance and, if issued, may not provide any meaningful protection or competitive advantage. The scope of our patent protections may be adversely affected by changes in legal precedent and patent office interpretation of these precedents. Further, patents directed to particular subject matter associated with our business (e.g., CPU architecture) may be difficult to obtain and enforce in many jurisdictions and there may also be limits on recovery for damages in those jurisdictions. Any of our existing patents, and any future patents, may be challenged, narrowed, invalidated or circumvented. Further, we may be unsuccessful in executing adequate invention assignment agreements with all employees, contractors or other third parties involved in the development of our IP portfolio. In certain jurisdictions, rights to IP developed by our employees or contractors or other third parties may not automatically vest in us, and our employees or contractors or other third parties may claim ownership in IP that we believe is owned by us. We may also be required to spend significant resources to establish, monitor and protect our IP rights, particularly as we expand our operations globally. Our exposure to different legal jurisdictions also may impact our ability to exercise our contractual and other rights around IP in such jurisdictions, in particular in countries whose laws regarding the protection of IP are less rigorous or more difficult to enforce than in the U.K., the U.S. and the European Union. In jurisdictions where effective IP protection is unavailable or limited, our IP rights may be vulnerable to unauthorized disclosure, infringement, misappropriation or other violation by employees, third-party partners, suppliers, customers and other entities or individuals, even though our customers and partners are contractually restricted from using our IP outside of the agreed-upon licensing arrangements. Policing unauthorized use of our IP is difficult and expensive, and we may not be able, or may lack the resources, to prevent infringement, misappropriation or other violation of our IP rights, including increased difficulty as a foreign entity in certain international locations, particularly outside the U.K., the U.S. and the European Union. In addition, our ability to monitor and control theft, misappropriation or infringement is uncertain, particularly in countries outside of the U.K., the U.S. and the European Union, as the laws of some countries do not provide the same level of protection of our proprietary and confidential information as do the laws of the U.K., the U.S. and the European Union. Moreover, because we deliver our products to our customers in a source form, we have limited ability to trace the source of misappropriation of our IP and there are limited technological barriers (e.g., remote authorization requirements) we can put in place to protect our products from use by unauthorized parties. Additionally, theft of our IP or proprietary business information (including our trade secrets) could require substantial expenditures and resources to remedy. If we, our employees or our third-party partners, consultants, contractors, vendors or service providers were to suffer an attack or breach, for example, that results in the unauthorized access to, or use, theft, disclosure, misappropriation or sale of, our IP by any unauthorized third parties, we may have to notify consumers, partners or governmental authorities, and may be subject to investigations, civil penalties, administrative and enforcement actions and litigation, any of which could be costly and distracting or otherwise harm our business and reputation. We may be unable to successfully obtain, maintain, protect and enforce our IP rights (including defending against counterfeit, knock-off, grey-market, infringing or otherwise unauthorized goods). Specifically, third parties may distribute, license and sell counterfeit or grey-market versions of our products, which may be inferior or pose safety risks and could confuse consumers or customers, which could cause them to refrain from purchasing our brands in the future or otherwise damage our reputation. The presence of counterfeit versions of our products and technology in the market could also dilute the value of our brands, force us and our customers to compete with heavily discounted products and technology, cause us to be in breach of contract (including license agreements), impact our compliance with distribution and competition laws in jurisdictions including the U.K., the U.S., the European Union and the PRC, or otherwise have a negative impact on our reputation and business, prospects, financial condition or results of operations. Further, we may not be able to detect all violations of our IP rights and, even if we do become aware of any such violations, we may not be able to adequately enforce our IP rights in certain domestic and foreign jurisdictions. If we are unable to successfully navigate the relevant legal and regulatory environment and/or enforce our IP rights and/or contractual rights in relevant jurisdictions, our business, results of operations, financial condition and prospects could be materially and adversely impacted. Litigation may be necessary in the future to enforce our patents and other IP rights, to protect our trade secrets, to determine the validity and scope of the proprietary rights of others, or to defend against claims of infringement, misappropriation or invalidity. We have in the past been and may in the future be subject to claims by third parties alleging our infringement, misappropriation or other violation of third-party IP rights, including patent rights, or misuse of third-party confidential information. Additionally, our increasing use of AI internally as well as our entry into production silicon may increase these risks. Any such litigation, whether or not determined in our favor or settled by us, would divert the efforts and attention of our management and technical talent from normal business operations, could be costly, require us to enter into royalty or licensing arrangements, subject us to damages or injunctions restricting the sale of our products, result in the invalidation of a patent or family of patents, require us to refund license fees to our customers or to forgo future payments or require us to redesign or rebrand certain of our products, any one of which could have a material adverse effect on our business, results of operations, financial condition and prospects. Furthermore, our efforts to enforce our IP rights may be met with defenses, counterclaims and countersuits attacking the validity and enforceability of our IP rights. In addition, counterparties in litigation may have greater resources that they can dedicate to litigation-related matters than we can. Moreover, litigation against current or former customers and partners may adversely impact existing relationships. Accordingly, we may not be able to prevent third parties from infringing, misappropriating or otherwise violating our IP rights. In any potential dispute involving our patents or other IP, our licensees or the customers of our licensees could also become the target of litigation and we may be bound to indemnify such parties under the terms of our customer agreements. Although we do not agree to indemnify our customers' end customers and our indemnification obligations are generally subject to a maximum amount, such obligations could nevertheless result in substantial expenses to us and end customers may initiate claims against us as well. See "Item 4. Information on the Company-B. Business Overview-Legal Proceedings." In addition to the time and expense required for us to indemnify our licensees or the customers of our licensees, such parties' development, marketing and sales of chips and end products utilizing our products could be severely disrupted or discontinued as a result of litigation, which, in turn, could have a material adverse effect on our business, results of operations, financial condition and prospects. Moreover, the semiconductor industry is generally subject to high turnover of employees, so the risk of trade secret misappropriation may be amplified. If any of our trade secrets are subject to unauthorized disclosure or are otherwise misappropriated by third parties, our competitive position may be materially and adversely affected. Any adverse determinations in litigation could result in the loss of our IP rights or proprietary rights, subject us to significant liabilities, require us to seek licenses from third parties or prevent us from licensing our products, any of which could have a material adverse effect on our business, results of operations, financial condition and prospects. Our failure to obtain, maintain, protect, defend and enforce our IP rights could have a material adverse effect on our brand or our business, results of operations, financial condition and prospects. Furthermore, because our products are often based on a common architecture and our new products are often based on legacy products, adverse events related to our IP may have a more significant impact on us than if our products were less related.

We collect, store and otherwise process certain personal, confidential and proprietary information in the operation of our business, including trade secrets, customer information, corporate data, personal information and other sensitive and protected data. Further, our third-party partners and customers regularly provide us with highly sensitive information, including details about their future product plans and roadmaps. Any unauthorized access to or disclosure of this information, whether inadvertent, malicious or as the result of a cyberattack, security breach or other similar incident, could have a material adverse effect on our third-party partners and customers as well as our own operations, which may in turn result in significant damage to our reputation, business and operating results. Cyberattacks, including, but not limited to, ransomware events, computer viruses or other malware, phishing, denial of service attacks, illegal hacking and credential stuffing, targeted attacks driven by AI tools, or other malicious attempts to compromise and/or interrupt the operation of information technology systems continue to increase in frequency, magnitude and sophistication. These increasing threats are being driven by a variety of sources, including nation-state sponsored espionage and hacking activities, industrial espionage, organized crime, advanced persistent threat actors, and hacking by groups and individuals. These sources can also implement social engineering techniques to induce our third-party partners, users, employees or customers to disclose passwords or other sensitive information or take other actions to gain access to our or our third-party partners' data or our users' data. Additionally, the increased usage of AI internally may create new attack surfaces or methods for malicious actors and may increase the risk of unintended or inadvertent transmission of our proprietary or confidential information. We have also incorporated third-party data into some of our or third-party AI models and used proprietary and open-source datasets to train our or third-party models and may continue to do so. These datasets may be flawed, insufficient, or contain certain biased information, and may otherwise decrease resilience to security incidents that may compromise the integrity of our AI outputs, leading to potential reputational damage, regulatory scrutiny, or adverse impacts on the performance and reliability of our products, which could, in turn, materially and adversely affect our partners' and customers' operations and trust. We may have limited insight into the data privacy or security practices of third-party providers, including for our AI algorithms. Techniques, including techniques based on or otherwise using AI, used to obtain unauthorized access to, or to sabotage, systems or networks are constantly evolving and may not be recognized until launched against a target. In addition, as new AI models are developed and released, the ability of cyberattacks to use these models to detect and exploit vulnerabilities may significantly increase. Therefore, we may be unable to anticipate these techniques, react in a timely manner, or implement adequate preventive measures, and we may face delays in our detection, containment, or remediation of, or other responses to, such cyberattacks, security breaches and other similar incidents. Geopolitical instability, such as ongoing conflict between Russia and Ukraine and conflicts in the Middle East, including Iran, may increase the likelihood that we or our third-party partners and customers could experience direct or collateral consequences from cyber conflicts between nation-states or other politically motivated actors targeting critical technology infrastructure. Furthermore, we may in the future acquire companies that have less robust security measures, which may expose us to increased risk of cyberattacks, security breaches or other similar incidents. As we increase our customer base and our brand becomes more widely known and recognized, and as our products are used in more heavily regulated industries where there may be a greater concentration of sensitive and protected data, such as healthcare, government, life sciences and financial services, we and our third-party partners may become more of a target for these malicious actors. Cyberattacks, security breaches or other similar incidents with respect to our information technology systems or those of our third-party partners could result in unauthorized access to, or misappropriation, loss of availability or integrity, disclosure, modification, misuse, loss, destruction or theft of, personal, confidential and proprietary information belonging to us or our employees, third-party partners, customers or suppliers, requiring us to notify individuals, regulators, customers, or other persons under applicable laws or contractual obligations. Such incidents could also cause a significant disruptive effect on our services, which could result in us, our third-party partners or our customers suffering significant financial or reputational damage and potential third-party legal action. If our security measures are, or are believed to be, inadequate or breached as a result of third-party action, including third-party partners that have access to our internal network and environment, employee negligence, error or malfeasance, fraud, product defects, accidental technological failure, social engineering techniques, improper user configuration or otherwise, and this results in, or is believed to result in, compromise of the confidentiality, integrity or availability of our data or our third-party partners' and customers' data, or otherwise causes a significant disruptive effect on our services, we could incur significant liability to various parties, including our third-party partners and customers, and to individuals or organizations whose information is being processed by us, our third-party partners or our customers. Further, such information and data being stored in foreign jurisdictions, could lead to us being required to disclose or provide access to data or other IP to a foreign government pursuant to national security or other laws of such foreign jurisdiction. Any perceived or actual violation of security, data protection and/or reporting obligations under relevant privacy and data protection laws, regulations, rules, standards and other obligations could also result in regulatory inquiries, investigations and enforcement actions, fines and/or legal action. We spend significant effort to detect and prevent cyberattacks, security breaches and other similar incidents, and we may face increased costs and be required to expend substantial resources in the event of an actual or perceived cyberattack, security breach or other similar incident. While we and our third-party partners and customers have experienced cyberattacks, including attempts to breach our information technology systems, and may experience cyberattacks in the future, as of the date of this Annual Report, we have identified no material breaches of our information technology systems. We can provide no assurances that we will not experience material breaches of our information technology systems in the future, that our third-party partners and customers will not experience breaches of their information technology systems in the future that are material to us, or that we or our third-party partners and customers have not experienced such a breach but have not yet discovered it. Hardware and software we procure from third parties, including AI software, or through open-source solutions may contain vulnerabilities and be susceptible to cyberattacks, security breaches or other similar incidents. Additionally, our vendors or service providers may suffer, or be perceived to suffer, cyberattacks, security breaches or other similar incidents that may compromise data stored or processed for us or that may result in a compromise of our information technology system, which may also give rise to any of the foregoing. In addition, in certain circumstances, we provide third-party partners with access to our internal networks and environment, which may increase the risk of security vulnerabilities and cyberattacks. Our ability to monitor our vendors' and service providers' data security is limited, and, in any event, third parties may be able to circumvent those security measures, resulting in the unauthorized access to, misuse, disclosure, loss, acquisition, modification, unavailability, destruction or other processing of, our and our customers' data. If our vendors or service providers suffer cyberattacks, security breaches or other incidents, we may be unable to perform essential functions to operate our business. To the extent any of our IP is compromised as a result of a security breach experienced by us or by a vendor or service provider, and we do not promptly identify or are not promptly made aware of such breach, we may incorporate compromised IP in our products, thereby making customer implementations of our products vulnerable to future cyberattacks, security breaches or other similar incidents. Moreover, if we, or any of our vendors or service providers, experience a security breach resulting in the exfiltration of confidential data about our information technology systems, such data may provide additional avenues for further attacks. In addition, employees and contractors, and former employees and contractors, including those who become employees or contractors of competitors or other third parties, may misappropriate, wrongfully use, publish or provide to our competitors or other third parties our personal, proprietary or confidential information. We cannot ensure that any limitations of liability in our agreements with customers, third-party partners, service providers and other third parties with which we do business would be enforceable or adequate or would otherwise protect us from any liabilities or damages with respect to any particular claim in connection with a cyberattack, security breach or other similar incident. Additionally, we cannot be certain that our insurance coverage will be adequate for cybersecurity liabilities actually incurred, that insurance will continue to be available to us on economically reasonable terms, or at all, or that our insurer will not deny coverage as to any future claim. Any of the foregoing may cause our business to suffer and our reputation or competitive position to be damaged, which may have a material adverse effect on our business, results of operations, financial condition and prospects.

Our business depends on the efficient and uninterrupted operation of our information technology and communications systems. If such systems were to fail, in whole or in part, for any reason or if we were to experience any unscheduled downtimes, even for only a short period, our reputation, operations and financial results could be adversely affected. Our information technology and communication systems could be damaged or interrupted by several scenarios including natural hazards, extreme weather, fire, utility loss, infrastructure failure, service provider failure or cyber threats. Certain types of attacks could harm us even if our systems are left undisturbed. For example, certain threats are designed to remain dormant or undetectable, sometimes for extended periods of time, or until launched against a target, and we may not be able to implement adequate preventative measures. In many cases we use cloud provided software solutions where we are reliant on the software provider meeting our service level and contractual agreements. In the event that a critical software provider cannot provide their agreed service, this could have an adverse impact on our reputation, operations and financial reporting. We have disaster recovery and business continuity plans in place for all critical systems and key business services, which are reviewed and tested regularly. However, these plans may not be successful in preventing delays or other complications that could arise from information technology systems failure or cyberattacks and, if they are not successful, insurance may not adequately compensate us for all losses that may occur and have a material adverse effect on our business, results of operations, financial condition and prospects.

Our participation in standards-setting organizations or with other industry initiatives may require us to license our patents or products to companies that adopt industry-standard specifications. Depending on the rules of the organization, government regulations, or court decisions, we may be required to grant to all other participants licenses to our patents or products that are essential to the practice of those standards for little or no cost, or otherwise on reasonable and non-discriminatory ("RAND") terms. RAND typically is used to describe a voluntary licensing commitment that standards-setting organizations often request from the owner of an IP right that is, or may become, essential to practice a technical standard. Accordingly, RAND terms could limit our control over the use of these patents and products. If we fail to limit to whom we license our patents or products, or fail to limit the terms of any such licenses, we may be required to license our patents or other IP to others in the future, which could limit the effectiveness of our patents against competitors. In these situations, the royalty rates we charge could be limited for these products, and we may be unable to limit to whom we license such products or to restrict many terms of the license. As a result, we may be unable to enforce certain patents against others, our costs of enforcing our licenses or protecting our patents may increase, and the value of our IP rights may be impaired. We may in the future be subject to claims that our licensing of industry standard technologies may not conform to the requirements of the standards-setting organization. Allegations such as these could be asserted in private actions seeking monetary damages and injunctive relief, or in regulatory actions. Claimants in such cases could seek to restrict or change our licensing practices or our ability to license our products. Any of the foregoing could have a material adverse effect on our business, results of operations, financial condition and prospects.

From time to time, we are involved in various legal, administrative and regulatory proceedings, claims, demands and investigations relating to our business, which may include claims with respect to commercial, product liability, IP, cybersecurity, privacy, data protection, antitrust, breach of contract, labor and employment, whistleblower, mergers and acquisitions and other matters. We are involved in pending litigation, including, but not limited to, lawsuits with Qualcomm Inc. and Qualcomm Technologies, Inc. (together "Qualcomm") and Nuvia, Inc. ("Nuvia"). In addition, our products are involved in pending litigation to which we are not a party. We cannot provide you any assurances regarding how any such litigation will be resolved, what benefits we will obtain or what losses we might incur. On August 31, 2022, we sued Qualcomm and Nuvia, in the U.S. District Court for the District of Delaware alleging that, inter alia, Qualcomm and Nuvia breached the termination provisions of Nuvia's Architecture License Agreement (the "Nuvia ALA") with us by failing to destroy technology Nuvia developed under the Nuvia ALA, which we terminated in March 2022 based on Nuvia's failure to obtain our consent to the assignment of the Nuvia ALA to Qualcomm. Our complaint sought, among other things, specific performance of the Nuvia ALA termination provisions to require Qualcomm and Nuvia to stop using and to destroy the relevant Nuvia technology, and to stop their improper use of our trademarks with their related products. The claims were tried to a jury in December 2024. The jury failed to reach a complete verdict on the three issues presented to it. The jury concluded that certain technology was licensed to Qualcomm under the Qualcomm license and that Qualcomm had not breached the Nuvia ALA but failed to reach a verdict on whether Nuvia breached the Nuvia ALA. Both parties filed post-trial motions seeking judgment as a matter of law, and we also sought a new trial on the issues that were tried. On September 30, 2025, the Court affirmed the jury verdict on the issues on which it reached a conclusion and granted Qualcomm judgment as a matter of law in its favor to conclude that Nuvia did not breach the Nuvia ALA. We have filed an appeal with the United States Court of Appeals for the Third Circuit, which is currently pending. On April 18, 2024, Qualcomm brought a new action in Delaware against Arm Holdings plc, asserting claims that were rejected for inclusion in the original action. In this new action, Qualcomm asserted that we failed to satisfy certain delivery obligations under Qualcomm's Architecture License Agreement with us (the "Qualcomm ALA"). On December 16, 2024, Qualcomm amended its complaint to add allegations relating to an Arm notice of breach of the Qualcomm ALA and related tort and anti-competition claims. In 2025, Qualcomm amended its complaint again to add claims relating to an alleged breach of Qualcomm's Technology License Agreement. On January 7, 2026, Qualcomm's motion seeking to add Arm Limited, our wholly-owned subsidiary through which we have historically conducted our business, to the April 2024 lawsuit was denied. Subsequently, Qualcomm filed a separate lawsuit against Arm Limited seeking to make the April 2024 lawsuit's allegations against Arm Limited. In March 2026, the lawsuit against Arm Limited was consolidated with the April 2024 lawsuit against us. On March 30, 2026, Qualcomm filed an amended complaint against only Arm Limited seeking to add another breach of contract claim. We have moved to strike this new claim. We disagree with the assertions made by Qualcomm (as referred to above) and intend to vigorously defend against them. The case is expected to go to trial in the fourth calendar quarter of 2026. We can provide no assurances regarding the outcome of either litigation or how the litigation will affect our relationship with or revenue from Qualcomm, which is currently a major customer of ours and accounted for 9% of our total revenue for the fiscal year ended March 31, 2026. These cases will likely require significant legal expenditures going forward and may also require substantial time and attention from our executives or employees, which could distract them from operating our business. Further, we are subject to antitrust laws and regulations in multiple jurisdictions, which could and has from time to time subjected us to investigations by antitrust regulators. Our involvement in litigation with Qualcomm or in any antitrust investigation could cause us to incur significant reputational damage in the industry, in our relationship with Qualcomm or in our relationship with other third-party partners. These matters can be time-consuming, divert management's attention and resources, and cause us to incur significant expenses. Any allegations made in the course of regulatory or legal proceedings may also harm our reputation, regardless of whether there is merit to such claims.

We conduct business globally and file income tax returns in multiple jurisdictions. Our income tax rate, results of operations, cash flows, financial position and the tax treatment of our ADSs and ordinary shares could be materially adversely affected by many factors, including: changing tax laws, regulations and treaties, or the interpretation thereof; tax policy initiatives and reforms; the practices of tax bodies in jurisdictions in which we operate, including any competent authority and its ability to resolve instances of double taxation; and the resolution of issues arising from tax examinations. In addition, we carry out extensive research and development activities. We benefit in the U.K. from the research and development expenditure credit ("RDEC") regime, which provides relief against U.K. corporation tax. Broadly, RDEC provides a tax credit equal to 20% of ‘qualifying research and development expenditure'. We also benefit from the U.K.'s "patent box" regime, which allows certain profits attributable to revenues from patented products (and other qualifying income) to be taxed at an effective corporation tax rate of 10%. If there are unexpected adverse changes to the RDEC or the "patent box" regimes or we are unable to qualify for such tax incentives, then our income tax rate, results of operations, cash flows and financial condition may be adversely affected. We believe that our provision for income taxes and our tax assets and liabilities is reasonable, but the ultimate tax outcome of our tax positions may differ from the amounts recorded in our financial statements and such differences may materially affect our financial results in the period or periods in which such outcome is determined and impact our future income, cash flows and balance sheet.

Privacy and data protection has become a significant issue in the U.K., the U.S., the European Union and in many other jurisdictions where we operate and where the chips and end products incorporating our products are offered. The regulatory framework for privacy and data protection issues worldwide is rapidly evolving and is likely to remain uncertain for the foreseeable future, which could expose us to further regulatory burdens. Many government bodies and agencies, including in the U.K., the European Union and the U.S., have adopted or are considering adopting or modifying laws and regulations addressing privacy and data protection, including the collection, storage, transfer, use and other processing of personal information. Certain jurisdictions have also enacted data localization laws mandating that certain types of data collected in a particular country be stored and/or processed primarily within that country. It is possible that our practices may be deemed not to comply with those privacy and data protection legal requirements that apply to us now or in the future, which could adversely affect our operations, financial condition, and reputation. In the European Union and in the U.K., we are subject to the GDPR and the U.K. GDPR, respectively, which impose stringent obligations regarding the collection, control, use, sharing, disclosure and other processing of personal data. Failure to comply with the GDPR or the U.K. GDPR can result in significant fines and other liability. European data protection authorities have already imposed fines on companies for GDPR violations up to, in some cases, hundreds of millions of euros. While the U.K. GDPR currently imposes substantially the same obligations as the GDPR, the U.K. GDPR does not automatically incorporate changes to the GDPR, which creates a risk of divergent parallel regimes and related uncertainty. We cannot predict how the U.K. GDPR and other U.K. privacy and data protection laws, regulations or rules may develop, including as compared to the GDPR, nor can we predict the effects of divergent laws and related guidance. Moreover, the U.K. government has introduced proposed reforms to the U.K. GDPR in ways that, if formalized, may create a risk of divergent parallel regimes and related uncertainty, along with the potential for increased compliance costs. In addition, in the European Union, there are a number of new and revised laws focused on cybersecurity and product security. For example, the new Network and Informative Security Directive ("NIS2") establishes a high common level of cybersecurity across the European Union by strengthening the security of network and information systems and covers a wider range of sectors and entities, including critical infrastructure. Further, the EU Cyber Resilience Act (the "CRA") is a new regulation, which imposes obligations on manufacturers, importers and distributors of products with a digital component to ensure that such products adhere to minimum security requirements. Other jurisdictions have enacted or are considering similar cross-border personal data transfer laws and local personal data residency laws, any of which would increase the cost and complexity of doing business and could result in fines from regulators. For example, China's law imposes various requirements relating to data processing and data localization. Data broadly defined as important under China's law, including personal data, may not be transferable outside of China without prior assessment and approval by the Cyberspace Administration of China ("CAC"). Compliance with these requirements, including CAC assessments and any deemed failures of such assessments, could cause us to incur liability, prevent us from using data collected in China or impact our ability to transfer data outside of China. The inability to import personal data to the United States could significantly and negatively impact our business operations, limit our ability to collaborate with parties that are subject to European, China and other data privacy and security laws, or require us to increase our personal data processing capabilities in Europe and/or elsewhere at significant expense. Some European regulators have prevented companies from transferring personal data out of Europe for allegedly violating the GDPR's cross-border data transfer limitations, which could negatively impact our business. Further, our business may be affected by laws, regulations, rules and standards aimed at regulating the use of personal information for marketing purposes, the tracking of the online activities of individuals and the regulation of machine-to-machine communications. For example, the European Union's proposed ePrivacy Regulation, which is still being negotiated, may impose burdensome requirements around obtaining consent and impose fines for violations that are materially higher than those imposed under the European Union's current ePrivacy Directive and related European Union member state legislation. Compliance with these laws, regulations, rules and standards may result in increased costs and limit the effectiveness of our marketing activities, while failure to comply may subject us to substantial fines and reputational damage. In the U.S., we are subject to various federal, state and local privacy and data protection laws, rules, and regulations governing the collection, sharing, use, retention, disclosure, security, transfer, storage and other processing of personal information. For example, at the state level, we are subject to the CCPA, which broadly defines personal information and gives California residents expanded privacy rights and protections, such as affording them the right to access and request deletion of their information and to opt out of certain sharing and sales of personal information. The CCPA provides for severe civil penalties and statutory damages for violations and a private right of action for certain data breaches that result in the loss of unencrypted personal information. Numerous other states also have enacted, or are in the process of enacting or considering, comprehensive state-level privacy and data protection laws, rules and regulations that share similarities with the CCPA. Additionally, the U.S. Department of Justice has recently issued rules concerning the cross-border transfer of certain sensitive data that will have widespread compliance implications. Moreover, we make public statements about our collection, use, disclosure and other processing of personal information through our privacy policies and information on our website. Although we endeavor to comply with our public statements and documentation, we may at times fail to do so or be alleged to have failed to do so. Our privacy policies and other public statements that provide promises and assurances about privacy, information security, and data protection can subject us to potential government or legal action if they are found to be deceptive, unfair or misrepresentative of our actual practices. Any concerns about our privacy and data protection practices, even if unfounded, could damage our reputation and adversely affect our business. Although we monitor the regulatory environment and have invested in addressing new developments, we may be required to make additional changes to our services and business practices to enable us and our customers to comply with applicable laws, regulations, rules, standards and other obligations. Evolving regulatory and legal obligations may also increase our potential liability exposure through higher potential penalties for non-compliance. Laws, regulations, rules, standards and other obligations relating to privacy and data protection are subject to differing interpretations and may be inconsistent among jurisdictions, thereby making compliance with such obligations challenging. Revising our services and business practices to comply with these requirements could reduce demand for our services, require us to take on more onerous obligations in our contracts, or restrict our ability to store, transfer and otherwise process data or, in some cases, impact our ability or our customers' ability to offer our services in certain locations, to deploy our products, to reach current and prospective customers, or to derive insights from customer data globally. Third-party partners with access to personal information or other sensitive or confidential information for which we are responsible could breach their contractual obligations to us, or may experience data breaches or security incidents, which could impact our business, including by causing us to breach our obligations under privacy and data protection laws, regulations, rules, standards and other obligations. This could in turn adversely affect our business, results of operations and financial condition. In addition, our third-party due diligence, contractual measures, and other privacy and data protection-related safeguards may not sufficiently protect us from the risks associated with the third-party processing, storage and transmission of such information. Our failure or perceived failure to comply with any applicable privacy or data protection laws, regulations, rules, standards or other obligations could result in increased costs for our products, monetary penalties, damage to our reputation, government and regulatory inquiries, investigations and enforcement actions, fines, orders to stop or limit processing of personal information, or legal action. Furthermore, the uncertain and shifting regulatory environment and trust climate may cause concerns regarding privacy and data protection and may cause our customers or their customers to resist providing the data necessary to allow our customers to use our services effectively. Even the perception that the privacy of personal information is not satisfactorily protected or does not meet regulatory requirements could inhibit sales of our products or services and could limit adoption of our products. Any of the foregoing could have a material adverse effect on our business, results of operations, financial condition and prospects.

We are exposed to the risk of fraud or other misconduct by our employees, independent contractors, consultants and vendors. Misconduct by these partners could include intentional failures to comply with laws, standards, regulations, guidance or codes of conduct, provide accurate information to regulatory authorities, comply with manufacturing standards, report financial information or data accurately or disclose unauthorized activities to us. We may also be exposed to risks in connection with any insider trading violations by employees or others affiliated with us. It is not always possible to identify and deter employee misconduct, and the precautions we take to detect and prevent this activity may not be effective in controlling unknown or unmanaged risks or losses or in protecting us from governmental investigations or other actions or lawsuits stemming from a failure to be in compliance with such laws, standards, regulations, guidance, contractual requirements or codes of conduct. If any such actions are instituted against us, and we are not successful in defending ourselves or asserting our rights, those actions could have a significant impact on our business and results of operations and prospects, including the imposition of significant fines or other sanctions and damage to our reputation.

The semiconductor industry relies on a limited number of companies to manufacture chips and related products. The chip manufacturing operations of these companies are concentrated in certain geographic regions, including Taiwan and other parts of East Asia, which makes us susceptible to adverse developments in these regions' economic and political conditions, particularly to the extent that such developments create an unfavorable business environment that significantly affects our and our customers' operations or the foundries and other contract manufacturers which we rely. These manufacturers or the geographic regions in which they operate may be impacted by events outside of our or their control, including, among other things, company-specific operational issues, trade conflicts and military action or terrorist activities and associated political instability, any of which could have a material adverse effect on our business, results of operations, financial condition and prospects. Although the governments of certain countries, including the U.S., have taken actions to make their countries more attractive for chip manufacturing operations, there can be no assurances that the current geographic concentration of chip manufacturing will be meaningfully changed in the near term or at all. Any escalation in geopolitical tensions in Asia, particularly between the PRC and Taiwan, could significantly disrupt semiconductor chip manufacturing and interrupt the global semiconductor chip supply chain. A significant portion of the world's semiconductor manufacturing is in Taiwan, and increased geopolitical tensions there could exacerbate supply chain disruptions. In addition, geopolitical conflicts, such as the war in Ukraine and conflicts in the Middle East, including Iran, could lead to market disruptions and exacerbate current supply chain constraints, including with respect to certain materials and metals, which are essential in semiconductor manufacturing.

We are subject to risks arising from adverse changes in global economic conditions. In particular, due to economic uncertainties in many of our key markets, our customers and their customers may delay, suspend or reduce technology purchases and investments and/or delay their payments to us. Economic conditions could continue to deteriorate in the future, including as a result of fluctuating inflation and interest rates, a sustained global semiconductor shortage, supply chain disruptions and any disruptions of international trade relationships, such as tariffs, export licenses or other government trade restrictions or new or continued conflicts. In particular, the semiconductor and electronics industries could fail to grow and sustained or increasing inflation could increase our operating expenses, increase costs for our customers and reduce demand for our products or our customers' products. In addition, adverse economic conditions affect demand for devices that our products help create, such as smartphones, automobiles and servers. Longer-term reduced demand for these or other devices could result in reduced demand for our products and significant decreases in our licensing fees and royalty revenues over time. In addition, if our customers, distributors or other companies in the value-chain build elevated inventory levels, we could experience a decrease in short-term and/or long-term demand for our products. If any of these events or disruptions were to occur, the demand for our products could be materially adversely affected along with our business, results of operations, financial condition and prospects. Our business and operating results are also vulnerable to interruption by other events outside of our control, such as earthquakes, fire, extreme weather events, power loss, telecommunications failures, epidemics, pandemics or other public health crises, political instability, geopolitical turmoil, such as the war in Ukraine and conflicts in the Middle East, including Iran, and any sanctions, export controls or restrictions on doing business with Russia and Belarus, or with other countries (including the PRC), as well as any resulting disruption, instability or volatility in the global markets and industries resulting from such conflict, pandemics, military conflict and uncertainties arising out of terrorist attacks, including a global economic slowdown, the economic consequences of the recent resurgence and escalation of trade conflicts between the U.S. and the PRC as well as other major U.S. trade partners, the potential for deteriorating relations between the PRC and Taiwan and the associated disruptions to, or effects on, the semiconductor industry, military action or terrorist activities and associated political instability. Economic or political instability may undermine consumer confidence and/or cause current or potential customers, including the end customers of our customers or potential customers, to reduce or delay their technology purchases and investments. Such events could also materially adversely affect our ability to operate and supply our products to our customers, including by disrupting our global supply chain. See "-Risks Relating to Government Regulation and Legal Compliance-Our international operations expose us to risks in international jurisdictions and we may be negatively impacted by export restrictions and trade barriers." Furthermore, such geopolitical and economic factors could contribute to the fragmentation of the global semiconductor market, as certain countries, including the United States, seek more end-to-end control over architecture, leading to increased fragmentation and a reduced role for a global architecture. Countries may take political decisions to enforce the use of an alternative architecture, or locally generated implementations for certain use cases, to make their country more resilient in the case of trade barriers or for national security reasons. This could lead to increased costs to support region specific products, reduced revenue as a result of lost investment in territories that no longer use our products and potential market loss and loss of future licensing opportunities, all of which could have a material adverse effect on our business, results of operations, financial condition and prospects. We regularly maintain cash balances at third-party financial institutions in excess of government-insured limits. If banks and financial institutions, including financial institutions at which we maintain deposits, enter receivership or become insolvent in the future in response to financial conditions affecting the banking system and financial markets or otherwise, our ability and our customers' ability to access cash, cash equivalents and investments may be threatened. These factors could cause customers to delay, decrease or cancel the licensing of our products and could expose us to increased credit risk on customer obligations owed to us, each of which could have a material adverse effect on our business, results of operations, financial condition and prospects.