Calix (CALX) Risk Analysis

The implementation of significant changes to U.S. trade policies, sanctions, legislation, treaties and tariffs, including, but not limited to, significant new tariffs on goods imported into the U.S.(and uncertainty related to the enforceability thereof), have introduced uncertainty to our business and will increase the cost of our U.S. manufactured products and components sourced outside of the U.S., which will result in an increase to our cost of revenue and may cause a reduction in our gross margin. In response, China announced additional tariffs on U.S. goods and new export control restrictions. The imposition of additional tariffs or other trade barriers by countries outside of the U.S may increase our costs in these markets, and to the extent these increased costs result in increased prices for our customers, the demand for our products may decrease as our customers seek alternative sourcing, making it more difficult for us to sell our products in some markets. The extent and duration of increased tariffs and the resulting impact on general economic conditions and on our business are uncertain and depend on various factors, such as negotiations between the U.S. and affected countries, the responses of other countries or regions, exemptions or exclusions that may be granted, availability and cost of alternative sources of supply, and demand for our products in affected markets. Other countries where we operate or sell our products may themselves change their own policies on trade as well, which may affect future business and foreign investment in their respective countries. U.S. and foreign policy changes and uncertainty about such changes has resulted in increased market volatility and currency exchange rate fluctuations. To the extent dissatisfaction with U.S. government policy results in U.S.-based suppliers being disfavored over foreign-based alternatives, it may diminish demand for our products with such customers and cause them to find alternative sourcing or otherwise make it more difficult for us to sell more products to these customers. As a result of these dynamics, we may find it difficult to predict the impact to our business of these and future changes to the trading relationships between the U.S. or other countries or the impact on our business of new laws or regulations adopted by the U.S. or other countries.

Government authorities in the U.S. and around the world have implemented and are continuing to implement broader and more stringent laws, rules, regulations, industry standards and other requirements concerning data protection, privacy, security and the processing of personal information, many of which we are subject to. The interpretation, application and amendment of these laws, regulations and other requirements are often uncertain and constantly changing, and it is possible that they may be interpreted and applied in a manner that is inconsistent with our data practices or that new laws, regulations and other requirements require us to incur significant costs, implement new processes, or change our processing of information and business operations. For example, in the U.S., certain states have adopted or modified privacy and security laws and regulations which govern the privacy, processing and protection of personal information. Such laws and regulations will be subject to interpretation by various courts and other governmental authorities, thus creating potentially complex compliance issues for us and our future customers and strategic partners. For example, the California Consumer Privacy Act (the "CCPA") requires covered businesses that process the personal information of California residents to, among other things: (i) provide certain disclosures to California residents regarding the business's collection, use and disclosure of their personal information; (ii) receive and respond to requests from California residents to access, delete and correct their personal information or to opt out of certain disclosures of their personal information; and (iii) enter into specific contractual provisions with service providers that process California resident personal information on the business's behalf. Additional compliance investment and potential business process changes may also be required. Similar laws have been passed in other states, creating a patchwork of overlapping but different state laws, and are continuing to be proposed at the state and federal level, reflecting a trend toward more stringent privacy legislation in the U.S. Many of these laws include restrictions on processing consumer information for targeted advertising, which could negatively affect our marketing cloud products. The enactment of such laws could have potentially conflicting requirements that would make compliance challenging. If we are subject to or affected by the CCPA, or other domestic privacy and data protection laws, any liability from failure to comply with the requirements of these laws could adversely affect our financial condition. In 2024, the National Security Division of the U.S. Department of Justice ("DOJ") issued a new rule-referred to as the "Data Security Program" ("DSP") to implement Executive Order 14117, aimed at preventing access to "bulk U.S. sensitive personal data" and "government-related data" by "countries of concern" (including China, Russia, Iran, North Korea, Cuba, and Venezuela) and "covered persons" (as all such terms are defined in the DSP). Effective as of April 8, 2025, and fully enforceable as of July 9, 2025, the DSP imposes stringent obligations on companies within its scope and prohibits or restricts "covered data transactions" that grant countries of concern or covered persons access to bulk U.S. sensitive personal data or any amount of government-related data. The DSP is new, complex and has yet to be enforced, and as such, there is a risk that our interpretation of its applicability, scope and requirements is incorrect, incomplete or misapplied. Compliance with the DSP may require us to invest heavily in data security and compliance measures such as implementing and complying with the Cybersecurity and Infrastructure Security Agency's guidelines and other burdensome recordkeeping, reporting and auditing requirements. It may also require us to implement new processes, stop or restrict certain data transfers, alter the geographic scope of our operations, cease doing business with certain third parties or using certain tools or vendors, or change how data flows throughout our business, any of which could materially impact our business operations or hinder our ability to grow our business. Finally, non-compliance with the DSP could result in significant civil or criminal penalties, which could materially adversely affect our business, results of operations and financial condition. Furthermore, the Federal Trade Commission ("FTC") and many state Attorneys General continue to enforce federal and state consumer protection laws against companies for online collection, use, dissemination and security practices that appear to be unfair or deceptive. For example, according to the FTC, failing to take appropriate steps to keep consumers' personal information secure can constitute unfair acts or practices in or affecting commerce in violation of Section 5(a) of the Federal Trade Commission Act. The FTC expects a company's data security measures to be reasonable and appropriate in light of the sensitivity and volume of consumer information it holds, the size and complexity of its business, and the cost of available tools to improve security and reduce vulnerabilities. The General Data Protection Regulation ("EU GDPR") adopted by the European Union ("EU") and the UK General Data Protection Regulation ("UK GDPR") adopted by the United Kingdom ("UK") (the EU GDPR and UK GDPR hereinafter referred to as the "GDPR") and national data protection supplementing laws in these jurisdictions impose specific duties and requirements upon companies that are subject to their provisions and collect, process or control personal data of individuals. Although we currently do not have material operations or business in the EU or the UK, we are in the process of expanding in these jurisdictions, and we have incurred and will continue to incur substantial costs in this respect. Furthermore, the GDPR imposes significant penalties for noncompliance which can amount to the greater of €20 million (for the EU GDPR) or £17.5 million (for the UK GDPR) or 4% of the total worldwide annual turnover of the preceding financial year; thus, any non-compliance with the GDPR could result in a material adverse effect on our business, financial condition and results of operations. The GDPR regulate cross-border transfers of personal data out of the European Economic Area (the "EEA") and the UK. There is currently legal complexity and uncertainty regarding international personal data transfers, and we expect this to continue. For example, there are number of decisions and proceedings in the EU where the legality of data transfers to China is being challenged. As the regulatory guidance and enforcement landscape in relation to data transfers further develops, our business, operations and financial condition could be adversely affected and we could suffer additional costs, complaints and/or regulatory investigations or fines. We may also have to stop using certain tools and vendors and make other operational changes. Further, our customers may not use our services in a manner that is compliant with applicable data privacy laws and regulations and our services may not be competitive in certain markets. We may also become subject to new laws that regulate both personal and non-personal data. For example, the Data Act came into effect on September 12, 2025, establishing new requirements for providers of data processing services (including cloud, SaaS) into the EU. The Data Act requires providers to facilitate customers switching to other providers/ on-premise solutions and porting their data within certain timeframes; remove technical, contractual, and commercial obstacles to service switching (including switching charges); and include certain mandatory terms in customer contracts. Failure to comply with the Data Act can result in regulatory enforcement and fines, civil claims, and reputational damage. The Data Act, together with developing guidance in this area, may require changes to our customer contracts, products, operations and business practices, increase our compliance costs, require adjustments to our revenue recognition practices and adversely affect our financial condition, business and operations. In addition, security regulations such as the EU's Network and Information Security 2 Directive ("NIS2") and its EU Member State transpositions, and the UK's Telecommunications (Security) Act 2021 together with its implementing regulations impose further security obligations, including on electronic communications networks and services. We may be required to implement (and contractually commit to) additional security measures to remain a competitive vendor, as customers will need to ensure their vendors are able to meet the obligations that they are themselves subject to, or customers may choose different vendors due to our security measures. This could result in additional costs and require operational changes which could adversely affect our business, operations and financial condition. In light of the complex and evolving nature of EU, EU Member State and UK data and security laws, there can be no assurances that we will be successful in our efforts to comply with such laws; violations of such laws could result in regulatory investigations, fines, orders to cease/change our use of technologies and/or our processing activities, enforcement notices and assessment notices (for a compulsory audit), as well as lead to civil claims including class actions and reputational damage. Complying with new and changing laws could cause us to incur substantial costs in order to market and sell our cloud-based solutions in the U.S. and internationally, deter customers from adopting our cloud-based solutions or require us to redesign our platform in order to meet customer requirements related to such laws. Regulatory actions or claims involving our practices in the collection, storage, processing, use or disclosure of consumer information or other personal data, even if unfounded, could damage our reputation and adversely affect our operating results. The failure or perceived failure to comply with such laws, rules, regulations, industry standards and other requirements relating to data privacy, security or the processing of personal information may result in proceedings or actions against us, by individuals, consumer rights groups, government agencies or others, could cause us to incur significant costs in investigations and defending such claims, or could cause us to incur significant costs in investigations and defending such claims, pay significant damages or fines or be required to make changes to our business if found liable, lose customers and subject us to significant negative publicity and an erosion of trust, all of which could have an adverse effect on our business, results of operations and financial condition.

We use AI, machine learning, and automated decision-making technologies, including proprietary AI and machine learning algorithms and models (collectively, "AI Technologies") throughout our business, and are making significant investments in this area. For example, with the implementation of our agentic workflows within our platform, we will aim to provide both our customer success team and CXP customers with advanced automated tools to augment their operations, accelerate transformation initiatives and expand their impact independent of traditional resource constraints. We expect that increased investment will be required in the future to continuously improve our use of AI Technologies. As with many technological innovations, there are significant risks involved in developing, maintaining and deploying these technologies, and there can be no assurance that the usage of, or our investments in, such technologies will always enhance our products or services or be beneficial to our business, including our efficiency or profitability. In particular, if the models underlying our AI Technologies are: incorrectly designed or implemented; trained or reliant on incomplete, inadequate, inaccurate, biased or otherwise poor quality data, or on data to which we do not have sufficient rights or in relation to which we and/or the providers of such data have not implemented sufficient legal compliance measures; used without sufficient oversight and governance to ensure their responsible use; and/or adversely impacted by unforeseen defects, technical challenges, cybersecurity threats, data privacy concerns, or material performance issues, the performance of our products, services and business, as well as our reputation and the reputations of our customers, could suffer or we could incur liability resulting from the violation of laws or contracts to which we are a party or civil claims. With respect to our products or services that incorporate AI Technologies, including agentic AI, the market for such products and services is rapidly evolving and unproven in many industries, including our own, and important assumptions about the characteristics of targeted markets, pricing, sales cycles, cost, performance, and perceived value associated with our services or products may be inaccurate. We cannot be sure that the market will continue to grow or that it will grow in ways we anticipate. In addition, market acceptance and consumer perceptions of products and services that incorporate AI Technologies is uncertain. Our failure to successfully develop and commercialize our products or services involving AI Technologies could depress the market price of our stock and impair our ability to: raise capital; expand our business; provide, improve and diversify our product offerings; continue our operations and efficiently manage our operating expenses; and respond effectively to competitive developments. Additionally, the regulatory framework for AI Technologies is rapidly evolving. Already, certain existing legal regimes (e.g., relating to data privacy) regulate certain aspects of AI Technologies, and existing laws and regulations may be enjoined in judicial proceedings, interpreted or enforced in ways that would affect the operation of our AI Technologies, or could be rescinded or amended as new administrations take differing approaches to evolving AI Technologies. Additionally, many federal, state and foreign government bodies and agencies have enacted or are currently considering additional laws and regulations governing AI. As a result, implementation standards and enforcement practices are likely to remain uncertain for the foreseeable future, and we cannot predict the impact future laws, regulations, or standards, or the market perception of their requirements, may have on our business or how we will respond to these laws or regulations. For example, in the U.S., the regulatory framework for AI Technologies faces significant uncertainty. At the federal level, Congress has yet to enact meaningful AI legislation. Instead, federal policy on AI has been shaped by a series of executive orders that have shifted priorities and requirements substantially depending on the administration in power. In the absence of AI legislation, states have filled the void by enacting laws regulating different aspects of AI Technologies. For example, California has enacted laws and regulations related to AI safety protocols, reporting and transparency, among other AI-related topics. Numerous other states have enacted, passed or are considering AI-focused legislation, creating a patchwork of state-level governance of AI in the U.S. and a complex compliance challenge. However, the durability of these laws and the potential of additional state-level legislative activity faces uncertainty following President Trump's December 2025 Executive Order "Ensuring a National Policy Framework for Artificial Intelligence", which establishes a federal policy favoring a uniform national AI regulatory framework designed to promote innovation and U.S. global competitiveness, and directs federal agencies to identify, challenge, and potentially pre-empt state and local AI laws that are viewed as inconsistent with or burdensome to this national approach. It remains to be seen how agencies will effectuate this directive, and how states will approach AI legislation moving forward. In Europe, the EU Artificial Intelligence Act ("EU AI Act") establishes a comprehensive, risk-based governance framework for AI in the European Union ("EU") market. The majority of the substantive requirements are expected to apply from August 2, 2026, though the European Commission has proposed an extension to December 2, 2027 (such extension is not yet finalized or effective). The EU AI Act applies to companies that develop, use and/or provide AI in the EU, with specific requirements based on the relevant AI use cases. For example, in relation to our use of generative AI, we may be subject to certain disclosure and transparency obligations, with fines up to the greater of €15 million or 3% of global revenue. In addition, the revised EU Product Liability Directive, to be implemented into EU member state national law by December 2026, extends the EU's existing strict product liability regime to AI Technologies and AI-enabled products, and facilitates civil claims in respect of harm caused by AI. Once fully applicable, the EU AI Act and the EU Product Liability Directive, together with developing guidance and/or decisions in this area, will have a material impact on the way AI is regulated in the EU. It is possible that further new laws and regulations will be adopted in the United States and in other non-U.S. jurisdictions, or that existing laws and regulations, including competition, antitrust, data privacy and consumer protection laws, may be interpreted or enforced in ways that would limit our ability to use AI Technologies for our business, or require us to change the way we use AI Technologies in a manner that negatively affects the performance of our products, services, and business and the way in which we use AI Technologies. We may need to expend resources to adjust our products or services in certain jurisdictions if the laws, regulations, or decisions are not consistent across jurisdictions. Further, the cost to comply with such laws, regulations, decisions and/or guidance interpreting existing laws, or to adjust our business plans based on changes to how such laws are enforced, including adapting to loosened regulation to remain competitive, could be significant and would increase our operating expenses (such as by imposing additional reporting obligations regarding our use of AI Technologies) or impact our ability to use, procure or commercialize AI Technologies. Such an increase in operating expenses could adversely affect our business, financial condition and results of operations. In addition, if we fail or are perceived to fail to comply with these laws and regulations, we may face lawsuits (including class actions), investigations, enforcement actions, negative reputational impacts, and other penalties that materially impact our business.

We incorporate open-source software into our products. The terms of many open-source software licenses have not been interpreted by the courts, and there is a risk that such licenses could be construed in a manner that could impose unanticipated conditions or restrictions on our ability to sell our products. In such event, we could be required to make our proprietary software generally available to third parties, including competitors, at no cost, to seek licenses from third parties in order to continue offering our products, to re-engineer our products or to discontinue the sale of our products in the event re-engineering cannot be accomplished on a timely basis or at all, any of which could adversely affect our revenue and operating expenses.

We have platform, cloud and managed service offerings, including new AI-enabled "agentic" capabilities, which are early in their product life cycles and subject to uncertain market demand. If our customers are unwilling to adopt these new offerings, install our new products or deploy our new services, or if we are unable to achieve market acceptance of our products and platform, our business and financial results may be harmed. Moreover, adoption of our platform, cloud and managed service offerings is dependent upon the success of our customers in investing, marketing, selling and deploying broader services to their subscribers, and our ability to differentiate our products from competing or substitutive product and service offerings. For example, our SmartLife managed services include AI-driven managed Wi-Fi, network security, parental controls and an ecosystem of services from partners, including Arlo and Bark. However, if subscriber demand for such services does not grow as expected or declines, or our customers are unable or unwilling to invest in our platform to deploy and market these services, demand for our products may not grow at rates as we anticipate, negatively impacting our revenue and long-term growth.

Our products are subject to a significant number of domestic and international standards, which evolve as new technologies are developed and deployed. As we expand into new global markets, we are likely to encounter additional standards. Our products must comply with these standards in order to be widely marketable. In some cases, we are required to obtain certifications or authorizations before our products can be introduced, marketed or sold in new markets or to new customers. For example, our ability to maintain Operations System Modification for Intelligent Network Elements certification for our products will affect our ongoing ability to continue to sell our products to large broadband service providers. In addition, our ability to expand our international operations may be limited by standards in countries or may require us to redesign our products or develop new products to meet local standards. We may not be able to design our products to comply with local requirements, which would impede or prevent our ability to grow our business in those locations. Moreover, as we expand our business and operations globally, we must increase investments to maintain compliance with evolving standards across all of our markets. The costs of complying with evolving standards or failure to obtain timely authorizations or certification could prevent us from selling our products where these standards or regulations apply, which would result in lower revenue and lost market share.

We materially depend upon third-party vendors for our complex global supply-chain operations, including for services to develop, design and source components and materials as well as manufacture, transport and deliver our products. If any of these vendors stop providing their services, for any reason, we would have to obtain similar services from other sources, which may not be available on commercially reasonable terms, if at all. We also have limited control over disruptions that may occur at the facilities of those providers, such as supply interruptions, labor shortages, strikes, shipping backlogs at ports and similar disruptions to transportation infrastructure, design and manufacturing failures, quality control issues, systems failures or facility closures arising from pandemics, natural disasters, terrorist attacks or acts of war. In addition, switching development firms or manufacturers could delay the manufacture and availability of products and/or require us to re-qualify our products with our customers, which would be costly and time-consuming. A significant portion of our cost of revenue is driven by memory component pricing, which is subject to significant volatility and has significantly increased recently. Although we have in the past, are currently, and may in the future use advance purchasing and pricing actions, including memory surcharges, to mitigate these impacts, such measures may be only partially effective. As component prices stay at their current level or increase, our gross margin and operating results have in the past, currently are, and may in the future be adversely affected. Any interruption in the development, supply or distribution of our products, any continued increase in memory or other component costs or any inability to recover increased component costs through surcharges or other pricing actions, have adversely affected and may in the future adversely affect our ability to meet scheduled product deliveries to our customers and could result in lost revenue or higher costs, which have adversely impacted, and may in the future adversely impact, our gross margin and operating results and harm our business. Particular risks associated with management of our global supply-chain operations include the following: - Manufacturing constraints, shortages and other disruptions. We do not have internal manufacturing capabilities and we rely solely on a small number of contract manufacturers, or CMs, and original design manufacturers, or ODMs, to manufacture and supply our products. Our business operations and ability to supply our products are highly dependent upon our ability to secure adequate third-party manufacturing capabilities and capacity and to effectively manage those third parties to meet our business needs. Our dependence solely on third-party manufacturers has made us in the past and continues to make us vulnerable to possible supply and capacity constraints and has reduced in the past and continues to reduce our control over manufacturing disruptions due to component availability, extended lead times, delivery schedules, quality, manufacturing yields and increased costs. Some of these risks occur from time to time in our business. If these disruptions and constraints are prolonged, or if these manufacturers do not have the ability or business continuity plans to fulfill their obligations to us, our business could be disrupted. If we cannot effectively manage our vendors or if we fail to invest adequate resources to manage our supply chain operations, our ability to meet customer orders and generate revenue may be negatively impacted. A substantial portion of our manufacturing is done at facilities outside of the U.S., largely in Asia, which presents increased supply risk, including the risk of supply interruptions, delays, shortages or reductions in manufacturing quality or controls. In addition, these supply interruptions, delays and shortages could impair our ability to meet our customer requirements or require us to pay higher prices or incur expedite fees, which would harm our business and negatively impact our gross margin and results of operations. Our international manufacturing also creates risks and uncertainties associated with regulatory changes or government actions such as local business requirements, trade restrictions and tariffs, economic sanctions or related legislation, which may complicate our export and import activities, be disruptive to the operations of our manufacturers and logistics partners or result in higher product and shipping costs and variability of supply. Manufacturing in Asia further heightens our risk of meeting customer delivery requirements as we rely upon third-party logistics companies to transport and import significant volumes of products to the U.S. where we generate a substantial majority of our revenue. These supply chain risks are further increased by periodic shipping backlogs at ports and similar disruptions to transportation infrastructure. - Limited sources and sole-sourced supply. We are dependent upon sole-source or limited-source suppliers for some key product components such as chipsets, certain of our application-specific integrated circuit processors and memory and resistor components, including certain components sourced solely through suppliers located in China and other Asian countries. Any of these suppliers could stop producing our components, raise the prices they charge us, be subject to higher product tariffs, epidemics or other conditions that disrupt their operations, cease operations or enter into exclusive arrangements with our competitors, consequently affecting our operations and results. For example, the technology industry is currently experiencing significant supply constraints for memory components, driven in part by the reallocation of manufacturing capacity towards the global AI infrastructure build, which constraints may continue for years until new manufacturing capacity is built. These constraints have contributed to elevated and volatile DDR memory and other memory component prices in the past, currently are contributing to elevated and volatile DDR memory and other memory component prices and may do so in the future, as a result, the impact on our gross margin may vary based on inventory timing, supply availability, and the effectiveness of surcharges or other pricing actions. These constraints have resulted in, and are expected to continue to result in, increased costs and extended lead times for the components used in our products. Being dependent upon a limited number of suppliers constrains our ability to mitigate these disruptions in our supply chain, particularly if such disruptions are prolonged. This may adversely affect our ability to obtain components and materials needed to manufacture our products at acceptable prices in a timely fashion, or at all, which would adversely affect our ability to meet scheduled product deliveries to our customers, increase costs and in turn harm our business and results of operations. - Limitations on ability to manage third-party risks. Our business with certain third-party manufacturers may represent a relatively small percentage of their revenue. Consequently, our orders may not be given adequate priority if such manufacturers have to allocate limited capacity among competing customers. This could delay supplies of product to us or limit our ability to ramp product volumes within desired timeframes. If any of our manufacturing partners are unable or unwilling to continue manufacturing our products in required volumes and at high quality levels, we would have to identify, qualify and select acceptable alternative manufacturers. The time it takes to qualify new third-party manufacturers could disrupt our ability to maintain continuous supply of product to meet customer requirements. An alternative manufacturer may not be available to us when needed or may not be in a position to satisfy our production requirements at commercially reasonable prices and quality. In addition, we and/or our manufacturers may not be able to negotiate commercially reasonable terms and sufficient quantities of component supplies with component and materials suppliers to meet our manufacturing needs because our purchase volumes may be too low for us to be considered a priority customer for securing supplies, particularly when there are shortages or limited availability of key components and materials. As a result, suppliers could stop selling to us and our manufacturers at commercially reasonable prices, or at all. While we have worked to mitigate the cost impact from historical price increases, our efforts may not be successful with respect to increases arising from product tariffs recently announced by the U.S. Any such interruption or delay may force us and our manufacturers to seek components or materials from alternative sources, which may not be available, or result in higher prices. Switching suppliers could also force us to redesign our products to accommodate new components and could require us to re-qualify our products with our customers, which would be costly and time consuming. A significant interruption in manufacturing or supply availability for any of these reasons would reduce supply to our customers, which would result in lost revenue and harm our customer relationships. - Ability to forecast and manage inventory liability with vendors. We have experienced increases in demand from many customers, in part as a result of higher consumer demand for better internet services and improved Wi-Fi. If we underestimate product demand from our customers, our manufacturers may have inadequate component inventory to meet our demand. If we are unable to adequately anticipate demand, this could interrupt our product manufacturing, increase our cost of revenue associated with expedite fees and air freight and/or result in delays or cancellation of customer orders. If we are unable to deliver products timely to our customers, we may lose customer goodwill or our customers may choose to purchase from other vendors, all of which may have a material negative impact on our revenue and operating results. If we overestimate our product demand, our third-party manufacturers may purchase excess components and build excess inventory, and we could be required to pay for these excess parts or products and their storage costs. Long lead times for component supply, which may be exacerbated by higher demand for certain components, and demand for our products has and is expected to continue to impact our ability to accurately forecast our production requirements. We may incur liabilities for certain component inventory purchases that have been rendered excess or obsolete, which may have an adverse effect on our gross margin, financial condition and results of operations.