Johnson Controls (TYIA) Risk Analysis
Risk Overview Q2, 2026
Source: the company's latest filing for the period ended Jun 30, 2026, filed Jul 29, 2026
Risk Change Over Time
- Cyber Security - Risk 1Cybersecurity incidents impacting our IT systems and digital products could disrupt business operations, result in the loss of critical and confidential information, and materially and adversely affect our reputation and results of operations.
We rely upon the capacity, reliability and security of our IT and data security infrastructure, and our ability to expand and continually update this infrastructure in response to the changing needs of our business. Also, the implementation of new systems, integration of existing systems and supporting our older systems all increase risks of security breaches. If we experience a problem with the functioning of an important IT system as a result of increased burdens placed on our IT infrastructure or a security breach of our IT systems, the resulting disruptions could have a material adverse effect on our business, reputation and financial results. Global cybersecurity threats and incidents can range from uncoordinated individual attempts to gain unauthorized access to IT systems to sophisticated and targeted measures known as advanced persistent threats directed at the company and its products, customers and/or third-party service providers, including cloud providers. Moreover, AI and machine learning technologies continue to develop rapidly, and it is impossible to predict the future risks and market disruptions that may arise from such developments. Threat actors are already leveraging such technologies to develop new hacking tools and attack vectors, exploit vulnerabilities, obscure their activities, and increase the difficulty of threat attribution. For example, powerful new AI tools are finding previously undetected vulnerabilities in short time spans and creating exposures to zero-day attacks, all of which significantly diminish the window for us and our third-party service providers to detect, respond to and protect our IT and data security infrastructure. In addition, the vendors we use to support our business and operations have experienced, and will likely continue to experience, these types of threats and incidents, which add to the risks to our IT systems (including our cloud services providers' systems), internal networks, our customers' systems and the information stored and processed on such networks and systems. Despite our efforts to deploy countermeasures to deter, prevent, detect, respond to and mitigate cybersecurity threats, we have experienced, and will likely continue to experience, cybersecurity incidents and attacks. Such incidents have remained, and could in the future remain, undetected for an extended period of time, and the losses arising from such incidents could exceed our available insurance coverage for such matters. Any future cybersecurity incidents or attacks, depending on their nature and scope, may result in the incurrence of significant costs, reputational damage, exposure to legal claims, enforcement actions, audits, investigations and fines levied by governmental organizations, misappropriation, destruction, corruption or unavailability of critical data and confidential or proprietary information (our own or that of third parties), the theft of intellectual property and the diminution in the value of our investment in research, development and engineering, and the disruption of business operations. Our customers, including the U.S. government, are increasingly requiring cybersecurity protections and mandating cybersecurity standards in our products, and we may incur additional costs to comply with such demands. Moreover, an increasing number of our products, services and technologies, including our OpenBlue software platform, are delivered with digital capabilities and accompanying interconnected device networks, which include sensors, data, building management systems and advanced computing and analytics capabilities. If we are unable to manage the lifecycle cybersecurity risk in development, deployment and operation of our digital platforms and services, they could become susceptible to cybersecurity incidents and lead to third-party claims that our product failures have caused damage to our customers. This risk is enhanced by the increasingly connected nature of our products and the role they play in managing building systems.
- Technology - Risk 2We are incorporating artificial intelligence technologies into our products, services and processes. These technologies may present business, compliance and reputational risks.
Recent technological advances in AI and machine-learning technology both present opportunities and pose risks to us. If we fail to keep pace with rapidly evolving technological developments in AI, our competitive position and business results may suffer. The introduction of these technologies, particularly generative AI, into internal processes and/or new and existing offerings may result in new or expanded risks and liabilities, including due to enhanced governmental or regulatory scrutiny, litigation, compliance issues, ethical concerns, confidentiality or security risks, as well as other factors that could adversely affect our business, reputation, and financial results. In addition, our personnel could, unbeknownst to us, improperly utilize AI and machine learning technology while carrying out their responsibilities. The use of AI in the development of our products and services could also cause loss or theft of intellectual property, as well as subject us to risks related to intellectual property infringement or misappropriation, data privacy and cybersecurity. The use of AI can lead to unintended consequences, including generating content that appears correct but is factually inaccurate, misleading or otherwise flawed, or that results in unintended biases and discriminatory outcomes, which could harm our stakeholders, our reputation and our business, and expose us to risks related to inaccuracies or errors in the output of such technologies. We also face risks of competitive disadvantage if our competitors more effectively use AI to drive internal efficiencies or create new or enhanced products or services that we are unable to compete against on cost, quality or other attributes. Furthermore, the emergence of increasingly sophisticated AI and machine learning technology has prompted lawmakers around the world to consider the regulation of such technology, including in jurisdictions in which we operate. Such regulations may impose obligations on companies like ours, and the costs of monitoring and responding to such regulations, as well as the consequences of non-compliance, could have a material adverse effect on our business, operations and financial condition.
Risk Highlights Q2, 2026
Risk Word Cloud
Risk Factors Full Breakdown - Total Risks 37
- Regulation - Risk 1Irish law differs from the laws in effect in the U.S. and may afford less protection to holders of our securities.
It may not be possible to enforce court judgments obtained in the U.S. against us in Ireland based on the civil liability provisions of the U.S. federal or state securities laws. In addition, there is some uncertainty as to whether the courts of Ireland would recognize or enforce judgments of U.S. courts obtained against us or our directors or officers based on the civil liabilities provisions of the U.S. federal or state securities laws or hear actions against us or those persons based on those laws. We have been advised that the U.S. currently does not have a treaty with Ireland providing for the reciprocal recognition and enforcement of judgments in civil and commercial matters. Therefore, a final judgment for the payment of money rendered by any U.S. federal or state court based on civil liability, whether or not based solely on U.S. federal or state securities laws, would not automatically be enforceable in Ireland. As an Irish company, Johnson Controls is governed by the Irish Companies Act, which differs in some material respects from laws generally applicable to U.S. corporations and shareholders, including, among others, differences relating to interested director and officer transactions and shareholder lawsuits. Likewise, the duties of directors and officers of an Irish company generally are owed to the company only. Shareholders of Irish companies generally do not have a personal right of action against directors or officers of the company and may exercise such rights of action on behalf of the company only in limited circumstances. Accordingly, holders of Johnson Controls International plc securities may have more difficulty protecting their interests than would holders of securities of a corporation incorporated in a jurisdiction of the U.S.
- Regulation - Risk 2We are subject to risks arising from regulations applicable to companies doing business with the U.S. government.
Our customers include many U.S. federal, state and local government authorities. Doing business with the U.S. federal, state and local governments subjects us to certain particular risks, including dependence on the level of government spending and compliance with and changes in governmental procurement and security regulations. Agreements relating to the sale of products to government entities may be subject to termination, reduction or modification, either at the convenience of the government or for failure to perform under the applicable contract. We are subject to potential government investigations of business practices and compliance with government procurement and security regulations, which can be expensive and burdensome. If we were charged with wrongdoing as a result of an investigation, we could be suspended from bidding on or receiving awards of new government contracts, which could have a material adverse effect on our results of operations. In addition, various U.S. federal and state legislative proposals have been made in the past that would deny governmental contracts to U.S. companies that have moved their corporate location abroad. We are unable to predict the likelihood that, or final form in which, any such proposed legislation might become law, the nature of regulations that may be promulgated under any future legislative enactments, or the effect such enactments and increased regulatory scrutiny may have on our business.
- Regulation - Risk 3We could be adversely affected by violations of the U.S. Foreign Corrupt Practices Act, the U.K. Bribery Act and similar anti-bribery laws around the world.
The U.S. Foreign Corrupt Practices Act (the "FCPA"), the U.K. Bribery Act and similar anti-bribery laws in other jurisdictions generally prohibit companies and their intermediaries from making improper payments to government officials or other persons for the purpose of obtaining or retaining business, and require that companies maintain accurate books and records. Our policies mandate compliance with these laws. We operate in many parts of the world that are recognized as having governmental and commercial corruption and local customs and practices that can be inconsistent with anti-bribery laws. We cannot provide assurance that our internal control policies and procedures will preclude reckless or criminal acts committed by our employees or third-party intermediaries. Where we believe or have reason to believe that our employees or agents have or may have violated applicable anti-corruption laws, or if we are subject to allegations of any such violations, we have and will investigate the allegations and from time to time as necessary may engage outside counsel to investigate the relevant facts and circumstances, which can be expensive and require significant time and attention from senior management. Violations of these laws may result in criminal or civil sanctions, which could disrupt our business and result in a material adverse effect on our reputation, business, financial condition, results of operations and cash flows. In addition, we could be subject to commercial impacts such as lost revenue from customers who decline to do business with us as a result of such compliance matters, which also could have a material adverse effect on our reputation, business, financial condition, results of operations and cash flows.
- Regulation - Risk 4Our businesses operate in regulated industries and are subject to a variety of complex and continually changing laws and regulations.
Our operations and employees are subject to various U.S. federal, state and local licensing laws, codes and standards and similar foreign laws, codes, standards and regulations. Changes in laws or regulations could require us to change the way we operate or to utilize resources to maintain compliance, which could increase costs or otherwise disrupt operations. In addition, failure to comply with any applicable laws or regulations could result in substantial fines or revocation of our operating permits and licenses. Competition or other regulatory investigations can continue for several years, be costly to defend and can result in substantial fines. If laws and regulations were to change or if we or our products failed to comply, our business, financial condition and results of operations could be adversely affected. Due to the international scope of our operations, the system of laws and regulations to which we are subject is complex and includes regulations issued by the U.S. Customs and Border Protection, the U.S. Department of Commerce's Bureau of Industry and Security, the U.S. Treasury Department's Office of Foreign Assets Control and various non U.S. governmental agencies, including applicable export controls, anti-trust, customs, currency exchange control and transfer pricing regulations, laws regulating the foreign ownership of assets, and laws governing certain materials that may be in our products. No assurances can be made that we will continue to be found to be operating in compliance with, or be able to detect violations of, any such laws or regulations. We are also subject to a complex network of tax laws and tax treaties that impact our effective tax rate. For more information on risks related to tax regulation, see "Risks Related to Tax Matters" below. We cannot predict the nature, scope or effect of future regulatory requirements to which our operations might be subject or the manner in which existing laws might be administered or interpreted.
See a full breakdown of risk according to category and subcategory. The list starts with the category with the most risk. Click on subcategories to read relevant extracts from the most recent report.
