Rekor Systems (REKR) Risk Analysis

The markets in which we operate are in general characterized by the following factors: changes due to rapid technological advances; additional qualification requirements related to technological challenges; and evolving industry standards and changes in the regulatory and legislative environment. Our future success will depend upon our ability to anticipate and adapt to changes in technology and industry standards and to effectively develop, introduce, market and gain broad acceptance of new product and service enhancements incorporating the latest technological advancements.

We face various cyber and other security threats, including attempts to gain unauthorized access to sensitive information and networks; insider threats; threats to the security of our facilities and infrastructure; and threats from terrorist acts or other acts of aggression. Cyber threats are constant and evolving and include, but are not limited to, computer viruses, malicious software, destructive malware, attacks by computer hackers attempts to gain unauthorized access to data, disruption or denial of service attacks, and other electronic security breaches that could lead to disruptions in mission critical systems, unauthorized release or loss of confidential, personal or otherwise protected information (ours or that of our employees, customers or subcontractors), and corruption of data, networks or systems. In addition, we could be impacted by cyber threats or other disruptions or vulnerabilities found in products we use or in our partners' or customers' systems that are used in connection with our business. Our clients and subcontractors face similar threats and/or they may not be able to detect or deter them, or effectively mitigate resulting losses. These threats could damage our reputation as well as our subcontractor's ability to perform and could affect our client's ability to pay. Although we use various procedures and controls to monitor and mitigate the risk of these threats to us, our clients and our partners, there can be no assurance that these procedures and controls will be sufficient. The impact of these factors is difficult to predict, but one or more of them could result in the loss of information or capabilities, harm to individuals or property, damage to our reputation and/or require remedial actions or lead to loss of business, regulatory actions potential liability and financial loss, any one of which could have a material adverse effect on our financial position, results of operations and/or cash flows.

As internet commerce and telecommunications continue to evolve, increasing regulation by federal, state or foreign governments and agencies becomes more likely. Any increase in regulation could affect our clients' ability to collect and share data, potentially reducing demand for our products and services. In addition, taxation of products and services provided over the Internet or other charges imposed by government agencies or by private organizations for accessing the Internet or utilizing telecommunications services may also be imposed. Any regulation imposing greater fees for internet use or restricting the exchange of information over the internet could diminish the viability of our services, which could harm our business and operating results.

Certain services offered by us enable customers to capture data from video images. Although our service agreements require our customers to comply with all applicable laws, we do not exercise direct control overuse or content of information obtained by our customers through the use of our services. If our services are used by others to commit bad or illegal acts, we may become subject to claims and subject to other potential liabilities. Defending against such claims could be expensive and time-consuming, and there is a possibility that we could incur significant liability to entities who were harmed by such acts. As a result, our business may suffer, and our reputation may be damaged.

Our handling and storage of the data we collect from some of our customers, vendors and employees, and our processing of data, which may include confidential or personally identifiable information, through the services we provide, may be subject to a variety of laws and regulations, which have been adopted by various federal, state and foreign governments to regulate the collection, distribution, use and storage of personal information of individuals. Several foreign countries in which we conduct business, including the European Economic Area ("EEA") and Canada, currently have in place or have recently proposed, laws or regulations concerning privacy, data protection and information security, which are more restrictive than those imposed in the United States. Some of these laws are in their early stages and we cannot yet determine the impact these revised laws and regulations, if implemented, may have on our business. However, any failure or perceived failure by us to comply with these privacy laws, regulations, policies or obligations or any security incident that results in the unauthorized release or transfer of personally identifiable information or other customer data in our possession, could result in government enforcement actions, litigation, fines and penalties and/or adverse publicity, all of which could have an adverse effect on our reputation and business. For example, the EEA wide General Data Protection Regulation ("GDPR") became applicable on May 25, 2018, replacing the data protection laws of each EEA member state. The GDPR implemented more stringent operational requirements for processors and controllers of personal data, including, for example, expanded disclosures about how personal information is to be used, limitations on retention of information, increased requirements to erase an individual's information upon request, mandatory data breach notification requirements and higher standards for data controllers to demonstrate that they have obtained valid consent for certain data processing activities. It also significantly increases penalties for non-compliance, including where we act as a service provider (e.g. data processor). If our privacy or data security measures fail to comply with applicable current or future laws and regulations, we may be subject to litigation, regulatory investigations, enforcement notices requiring us to change the way we use personal data or our marketing practices, fines, for example, of up to 20 million Euros or up to 4% of the total worldwide annual turnover of the preceding financial year (whichever is higher) under the GDPR, or other liabilities, as well as negative publicity and a potential loss of business. Data protection regulation remains an area of increased focus in all jurisdictions and data protection regulations continue to evolve. There is no assurance that we will be able to meet new requirements that may be imposed on the transfer of personally identifiable information from the EU to the United States without incurring substantial expense or at all. European and/or multi-national customers may be reluctant to purchase or continue to use our services due to concerns regarding their data protection obligations. In addition, we may be subject to claims, legal proceedings or other actions by individuals or governmental authorities if they have reason to believe that our data privacy or security measures fail to comply with current or future laws and regulations. Moreover, we must ensure that certain vendors and customers who have access to such information also have the appropriate privacy policies, procedures and protections in place. Although we take customary measures to protect such information, the continued occurrence of high-profile data breaches provides evidence of an external environment increasingly hostile to information security. If our security measures are breached as a result of third-party action, employee or subcontractor error, malfeasance or otherwise, and, as a result, someone obtains unauthorized access to customer data, our reputation may be damaged, our business may suffer and we could incur significant liability. Techniques used to obtain unauthorized access or to sabotage systems change frequently and are growing increasingly sophisticated. As a result, we may be unable to anticipate these techniques or to implement adequate preventative measures. This environment demands that we continuously improve our design and coordination of security controls throughout our business. Despite these efforts, it is possible that our security controls over data, training and other practices we follow may not prevent the improper disclosure of personally identifiable or other confidential information. If an actual or perceived breach of our security occurs, we could be liable under laws and regulations that protect personal or other confidential data resulting in increased costs or loss of revenues and the market perception of our services could be harmed.

Because demand for our solutions and services is sensitive to changes in the level of economic activity, our business may suffer during economic downturns. During periods of weak economic growth or economic contraction, the demand for outsourced services could decline. In addition, market forces may restrict our ability to sustain funding for our sales and support efforts. When the level of demand for our products and services drops, our operating profit could be impacted unfavorably because expenses may not decline as quickly as revenues. In these periods, we can only reduce selling and administrative expenses to a certain level without negatively impacting the long-term potential of our business. Additionally, during economic downturns, government agencies and companies may slow the rate at which they pay their vendors, or they may become unable to pay their obligations. If our customers become unable to pay amounts owed to us or pay us more slowly, then our cash flow and profitability may suffer significantly.

Conducting international operations subjects us to other risks than those we have generally faced in the United States. These risks include: localization of our services and adaptation for local practices, differences in local, legal standards and regulatory requirements; difficulties in managing and staffing international operations; fluctuations in currency exchange rates; dependence on customers, third parties, and channel partners with whom we do not have extensive experience; potentially adverse tax consequences, including the complexities of foreign value-added or other tax systems; reduced or varied protection for intellectual property rights in some countries; and increased financial accounting and reporting burdens and complexities. Operating in international markets also requires significant management attention and financial resources. The investment and additional resources required to establish operations and manage growth in other countries may not produce desired levels of revenue or profitability.

In the event of natural disasters, public health crises, such as pandemics and epidemics, including from the continued effects of the COVID-19 pandemic, political crises, such as terrorism, war, political instability or other conflicts, or other events outside of our control, our business and operating results could suffer. Moreover, these types of events could negatively impact consumer spending in the impacted regions or depending upon the severity, globally, which could adversely impact our operating results.

The success of our business will depend, in part, on the continued services of certain members of our management. Our inability to attract and retain qualified personnel could significantly disrupt our business. Although we take prudent steps to retain key personnel, we face competition for qualified individuals from numerous professional services and technology companies. For example, our competitors may be able to attract and retain more qualified professional and technical personnel by offering more competitive compensation packages. If we are unable to attract new personnel and retain our current personnel, we may not be able to develop and maintain our services at the same levels as our competitors and we may, therefore, lose potential customers and sales penetration in certain markets. It may also be difficult to attract and retain qualified individuals in the timeframe demanded by our clients. Furthermore, some of our contracts may require us to employ only individuals who have particular government security clearance levels.

We rely on outsourcing partners primarily located in Europe and Asia to supply and manufacture many components of substantially all of our hardware products. Any failure of these partners to perform can have a negative impact on our cost or supply of components or finished goods. In addition, manufacturing or logistics in these locations or transit to final destinations can be disrupted or become more costly for a variety of reasons, including international trade disputes, natural and man-made disasters, information technology system failures, commercial disputes, military actions, and economic, business, labor, environmental, public health or political issues.