Veritone (VERI) Risk Analysis

Our success depends, in part, on our ability to protect our brand and the proprietary methods and technologies that we develop under patent and other intellectual property laws of the United States and foreign jurisdictions so that we can prevent others from using our inventions and proprietary information. As of December 31, 2025, in the United States, we have 39 issued patents, which expire between 2029 and 2042, and have 10 patent applications pending for examination. As of such date, we also had 12 issued patents and 4 patent applications pending for examination in foreign jurisdictions (including international PCT applications), all of which are based on counterpart U.S. patent applications pursued by us. We may not be issued any additional patents and any patents that have been issued or that may be issued in the future may not provide significant protection for our intellectual property. In addition, we have registered, or have applied for registration of, numerous trademarks, including Veritone and aiWARE, in the United States and in several foreign jurisdictions. If we fail to protect our intellectual property rights adequately, our competitors might gain access to our technology and our business, results of operations and financial condition may be adversely affected. The particular forms of intellectual property protection that we seek, or our business decisions about when to file patent applications and trademark applications, may not be adequate to protect our business. We could be required to spend significant resources to monitor and protect our intellectual property rights. Litigation may be necessary in the future to enforce our intellectual property rights, determine the validity and scope of our proprietary rights or those of others, or defend against claims of infringement or invalidity. Such litigation could be costly, time-consuming and distracting to management, result in a diversion of significant resources, lead to the narrowing or invalidation of portions of our intellectual property and have an adverse effect on our business, results of operations and financial condition. We also rely, in part, on confidentiality agreements with our business partners, employees, consultants, advisors, customers and others in our efforts to protect our proprietary technology, processes and methods. These agreements may not effectively prevent disclosure of our confidential information, and it may be possible for unauthorized parties to copy our software or other proprietary technology or information, or to develop similar software independently without our having an adequate remedy for unauthorized use or disclosure of our confidential information. In addition, others may independently discover our trade secrets and proprietary information, and in these cases, we would not be able to assert any trade secret rights against those parties. Costly and time-consuming litigation could be necessary to enforce and determine the scope of our proprietary rights, and the failure to obtain or maintain trade secret protection could adversely affect our competitive business position. In addition, the laws of some countries do not protect intellectual property and other proprietary rights to the same extent as the laws of the United States. To the extent we expand our international activities, our exposure to unauthorized copying, transfer and use of our proprietary technology or information may increase. Our means of protecting our intellectual property and proprietary rights may not be adequate or our competitors could independently develop similar technology. If we fail to meaningfully protect our intellectual property and proprietary rights, our business, results of operations and financial condition could be adversely affected.

Our business success depends in part on the ability of customers to access our Software Products & Services and Managed Services at any time and within an acceptable amount of time. We have experienced, and may in the future experience, disruptions, outages and other performance problems due to a variety of factors, including infrastructure changes, introductions of new applications and functionality, software errors and defects, capacity constraints due to an increasing number of users accessing our platform or initiating large volumes of processing simultaneously, or security related incidents. In addition, we rely on third parties, including AWS and Azure, to operate critical business systems and process sensitive data in a variety of contexts, including for hosting, storage and other critical services, required to operate our Software Products & Services and Managed Services. Our ability to monitor these third parties' information security practices is limited, and these third parties may not have adequate information security measures in place. As such, we are vulnerable to service interruptions, delays and outages experienced or caused by these third parties, and we have experienced (and may in the future experience) adverse consequences when certain third parties with whom we work have experienced a security incident or other service interruption, delay or outage. While we believe we are entitled to damages if certain of the third parties with whom we work fail to satisfy their privacy or security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such award. Because we also incorporate diverse software and hosted services from many third parties with whom we work, we may encounter difficulties and delays in integrating and synthesizing these applications and programs, which may cause downtimes or other performance problems. It may become increasingly difficult to maintain and improve the performance of our platform, especially during peak usage times and as our platform becomes more complex or usage increases. Additionally, our reliance on third parties could introduce new cybersecurity risks and vulnerabilities, including supply-chain attacks. Such supply-chain attacks have increased in frequency and severity, and we cannot guarantee that third parties' infrastructure in our supply chain or supply chains of the third parties with whom we work have not been compromised. Certain of our customer contracts include service level obligations, including system uptime commitments and/or required response times in the case of technical issues. If our Software Products & Services and Managed Services are unavailable or if our users are unable to access them within a reasonable amount of time or at all, we may be in breach of our contractual obligations, we may be required to issue credits or refunds to customers, and/or our customers may be entitled to terminate their contracts with us. AWS and Azure provide us with hosting, computing and storage services pursuant to agreements that may be canceled under certain circumstances. If any of our agreements with AWS or Azure is terminated, we could experience interruptions on our platform and in our ability to make our platform available to customers, as well as delays and additional expenses in arranging alternative cloud infrastructure services. Any of the above circumstances or events may harm our reputation, cause customers to stop using our platform, impair our ability to increase revenue from existing customers, impair our ability to grow our customer base, subject us to financial penalties and liabilities under our service level agreements and otherwise harm our business, results of operations and financial condition.

In the ordinary course of business, we process sensitive data. Our customers also utilize our Software Products & Services and Managed Services to process sensitive data, which may contain personal data that is subject to data protection and privacy laws in various jurisdictions. Our data processing activities subject us to numerous data privacy and security obligations, such as various laws, regulations, guidance, industry standards, external and internal privacy and security policies, contractual requirements and other obligations relating to data privacy and security. In the United States, federal, state, and local governments have enacted numerous data privacy and security laws, including data breach notification laws, personal data privacy laws, consumer protection laws (e.g., Section 5 of the Federal Trade Commission Act), and other similar laws (e.g., wiretapping laws). Numerous U.S. states have enacted comprehensive privacy laws that impose certain obligations on covered businesses, including providing specific disclosures in privacy notices and affording residents with certain rights concerning their personal data. As applicable, such rights may include the right to access, correct, or delete certain personal data, and to opt-out of certain data processing activities, such as targeted advertising, profiling, and automated decision-making. The exercise of these rights may impact our business and ability to provide our products and services. Certain states also impose stricter requirements for processing certain personal data, including sensitive data, such as conducting data privacy impact assessments. These state laws allow for statutory fines for noncompliance. For example, the California Consumer Privacy Act of 2018 ("CCPA") applies to personal data of consumers, business representatives, and employees who are California residents, and requires businesses to provide specific disclosures in privacy notices and honor requests of such individuals to exercise certain privacy rights. The CCPA provides for fines and allows private litigants affected by certain data breaches to recover significant statutory damages. These developments may further complicate compliance efforts, and increase legal risk and compliance costs for us, the third parties with whom we work, and our customers. Similar laws are being considered in several other states, as well as at the federal and local levels, and we expect more states to pass similar laws in the future. As we expand into new jurisdictions or markets outside the United States, we may become subject to an increasing number of laws, regulations, and industry standards governing data privacy and security. For example, we have entered into agreements and are actively pursuing opportunities to provide our Software Products & Services and Managed Services to customers in Europe, which involve processing of personal data, and the GDPR impose strict requirements for processing personal data. Under the GDPR, companies may face temporary or definitive bans on data processing and other corrective actions; fines of up to 20 million Euros under the EU GDPR, 17.5 million pounds sterling under the UK GDPR, or, in each case, 4% of annual global revenue, whichever is greater; or private litigation related to processing of personal data brought by classes of data subjects or consumer protection organizations authorized at law to represent their interests. In the ordinary course of business, we transfer personal data from Europe and other jurisdictions to the United States or other countries. Europe and other jurisdictions have enacted laws limiting the transfer of personal data to other countries or requiring data to be localized. In particular, the European Economic Area ("EEA") and the United Kingdom ("UK") have significantly restricted the transfer of personal data to the United States and other countries whose privacy laws they generally believe are inadequate. Other jurisdictions may adopt or have already adopted similarly stringent data localization and cross-border data transfer laws. Certain jurisdictions, including the EEA and the UK, have adopted adequacy decisions or similar frameworks in respect of specific countries or transfer regimes, which permit cross-border transfers of personal data without the need for additional transfer safeguards where applicable. Although there are currently various mechanisms that may be used to transfer personal data from the EEA and UK to the United States in compliance with law, such as the EEA standard contractual clauses, the UK's International Data Transfer Agreement / Addendum, and the EU-U.S. Data Privacy Framework and the UK extension thereto (which allows for transfers to relevant U.S.-based organizations who self-certify compliance and participate in the Framework), these mechanisms are subject to legal challenges, and there is no assurance that we can satisfy or rely on these measures to lawfully transfer personal data to the United States. If there is no lawful manner for us to transfer personal data from the EEA and the UK or other jurisdictions to the United States, or if the requirements for a legally-compliant transfer are too onerous, we could face significant adverse consequences, including the interruption or degradation of our operations, the need to relocate part of or all of our business or data processing activities to other jurisdictions at significant expense, increased exposure to regulatory actions, substantial fines and penalties, the inability to transfer data and work with partners, vendors and other third parties, and injunctions against our processing or transferring of personal data necessary to operate our business. Furthermore, companies that transfer personal data out of the EEA and UK to other jurisdictions, particularly to the United States, are subject to increased scrutiny from regulators, individual litigants, and activist groups. Some European regulators have ordered certain companies to suspend or permanently cease certain transfers of personal data out of Europe for allegedly violating the GDPR's cross-border data transfer limitations. Additionally, the U.S. Department of Justice issued a rule entitled the Preventing Access to U.S. Sensitive Personal Data and Government-Related Data by Countries of Concern or Covered Persons, which places additional restriction on certain data transactions involving countries of concern (e.g., China, Russia, Iran) and covered persons (i.e., individuals and entities who are designated as such by the U.S. Attorney General or considered "foreign persons" and are majority owned by, organized under the laws of, a primary resident in, or a contractor of, a covered person or country of concern, as applicable) that may impact certain business activities such as vendor engagements, sale or sharing of data, employment of certain individuals, and investor agreements. Violations of the rule could lead to significant civil and criminal fines and penalties. The rule applies regardless of whether data is anonymized, key-coded, pseudonymized, de-identified or encrypted, and may impact our ability to engage in certain transactions or agreements. Additionally, under various privacy laws and other obligations, we may be required to obtain certain consents to process personal data. For example, some of our data processing practices have been and may in the future be subject to challenges or lawsuits under data privacy and communications laws, including for example wiretapping laws, if we share consumer information with third parties through various methods, including chatbot and session replay providers, cookies, or via third-party marketing pixels, as has occurred. These practices may be subject to increased challenges by class action plaintiffs. Our inability or failure to obtain consent for these practices could result in adverse consequences, including class action litigation and mass arbitration demands. In addition to data privacy and security laws, we are also subject to contractual obligations related to data privacy and security, and our efforts to comply with such obligations may not be successful. For example, certain privacy laws, such as the GDPR and the CCPA, require our customers to impose specific contractual restrictions on their service providers. Additionally, some of our customer contracts require us to host personal data locally. We also publish privacy policies, marketing materials, whitepapers and other statements, such as statements related to compliance with certain certifications or self-regulatory principles, regarding data privacy, security and artificial intelligence. Regulators in the United States are increasingly scrutinizing these statements, and if these policies, materials or statements are found to be deficient, lacking in transparency, deceptive, unfair, misleading or misrepresentative of our practices, we may be subject to investigation, enforcement actions by regulators or other adverse consequences. The regulatory framework relating to data privacy and security (and consumers' data privacy expectations) is quickly changing, becoming increasingly stringent, and creating uncertainty. Additionally, these obligations may be subject to differing applications and interpretations, which may be inconsistent or conflict among jurisdictions, or which may be interpreted and applied in a manner inconsistent with our existing privacy and data management practices. Preparing for and complying with these obligations requires us to devote significant resources, which may necessitate changes to our services, information technologies, systems, and practices and to those of any third parties with whom we work. In addition, these obligations may require us to change our business model. Our business model materially depends on our ability to process personal data on behalf of our customers, including sensitive and highly regulated types of data such as biometric information, so we are particularly exposed to the risks associated with the rapidly changing legal landscape. For example, we may be at heightened risk of regulatory scrutiny, and any changes in the regulatory framework could require us to fundamentally change our business model. We may at times fail (or be perceived to have failed) in our efforts to comply with our data privacy and security obligations. Moreover, despite our efforts, our personnel or third parties with whom we work may fail to comply with such obligations, which could negatively impact our business operations. If we or the third parties with whom we work fail, or are perceived to have failed, to address or comply with applicable data privacy and security obligations, we could face significant consequences, including but not limited to: government enforcement actions (e.g., investigations, fines, penalties, audits and/or inspections); litigation (including class action claims) and mass arbitration demands; contractual liability; additional reporting requirements and/or oversight and demands that we modify or cease existing business practices (including bans on processing personal data or orders to destroy or not use personal data). In addition, the costs of compliance with, and other burdens imposed by, such laws, regulations and industry standards may adversely affect our customers' ability or desire to collect, use, process and store personal data using our software solutions, which could reduce overall demand for them. Even the perception of privacy and data security concerns, whether or not valid, may inhibit market acceptance of our software solutions in certain markets. Furthermore, privacy and data security concerns may cause our customers' customers, vendors, employees and other industry participants to resist providing the personal data necessary to allow our customers to use our products and services effectively. Additionally, plaintiffs have become increasingly more active in bringing privacy-related claims against companies, including class claims and mass arbitration demands. Some of these claims allow for the recovery of statutory damages on a per violation basis, and, if viable, carry the potential for monumental statutory damages, depending on the volume of data and the number of violations. Any of these events could have a material adverse effect on our reputation, business and operating results or financial condition, including but not limited to: loss of customers; interruptions or stoppages of data collection needed to train our algorithms; inability to process personal data or to operate in certain jurisdictions; limited ability to develop or commercialize our products; expenditure of time and resources to defend any claim or inquiry; adverse publicity or substantial changes to our business model or operations. Our employees and personnel use generative AI and/or automated decision-making technologies to perform their work, and the disclosure and use of personal data in AI technologies is subject to various privacy laws and other privacy obligations. Governments have passed and are likely to pass additional laws and regulations regulating AI and/or automated decision-making technologies. Our use of this technology could result in additional compliance costs, regulatory investigations and actions, and lawsuits. If we are unable to use AI and/or automated decision-making technologies, it could make our business less efficient and result in competitive disadvantages. For additional information about the risks related to our use of AI technologies, including those that involve processing biometric data, see the Risk Factor titled "Recent and proposed regulation of AI technologies, including facial recognition technology, the processing of biometric data, and automated decision-making and machine learning technologies, increase our compliance costs and otherwise make it harder for us to conduct our business, require us to change our business practices, and may lead to regulatory investigations or actions, litigation, reputational harm, and otherwise have a material adverse effect on our business." Finally, governments and regulators in certain jurisdictions, including Europe, are increasingly seeking to regulate the use, transfer and other processing of non-personal data, an area which has typically been the subject of very limited or no specific regulation. For example, we may become subject to certain parts of the European Union's Data Act, which imposes certain data and cloud service interoperability and switching obligations to enable users to switch between service providers without undue delay or cost, as well as certain requirements concerning cross-border international transfers of, and governmental access to, non-personal data outside the EEA. Depending on how these laws are interpreted, we may have to adapt our business practices, contractual arrangements and products to comply with such obligations.

We conduct operations in multiple tax jurisdictions throughout the United States. In many of these jurisdictions, non-income-based taxes, such as sales and use taxes, are assessed on our operations. We assess the taxability of our sales based on the product type, customer, and jurisdiction where the sales are made and accrue a liability on the balance sheet accordingly. In the event these jurisdictions challenge our positions, such jurisdictions may assert tax assessments, penalties and/or interest against us, which could adversely affect our business, results of operations and financial condition. In addition, we conduct operations outside of the United States, including in Israel and parts of Europe. These foreign jurisdictions have complex tax laws and regulations, and we may be subject to future uncertainties as a result of historical tax positions taken by us or our acquired companies. While we believe we have taken proper tax positions, as reflected in our financial statements herein, foreign tax authorities may challenge certain tax positions we or our acquired companies have taken historically, or may take in the future. While we believe we have properly accrued for estimated tax obligations in the jurisdictions where we have filing obligations, we cannot be certain the tax authorities will agree with our tax positions. As a result, our tax positions may be challenged in the future, and subject to local-, state- and country-specific audits and inquiries, the outcomes of which could differ materially from our estimates. Incurring any such tax liabilities (including related penalties and interest) could materially adversely affect our business and financial condition. Risk Related to Our Internal Use of Artificial Intelligence Technologies We use AI, including generative AI, and machine learning technologies, including third-party generative AI technologies, to support various internal business functions such as software development, content creation, customer support, sales and marketing and operational decision-making. While these AI technologies may enhance the productivity and efficiency of our employees, such productivity gains are not guaranteed, and their use may present risks that could adversely affect our business, financial condition, and results of operations. Data Security, Privacy and Confidentiality. The use of AI technologies by our employees, contractors, and vendors creates the risk that regulated or sensitive information, such as proprietary information, confidential business data, customer information, personal information or trade secrets may be inadvertently disclosed to third-party providers of AI technologies, which may "train" on that data. AI technologies may "train" on, or retain and learn from, inputs in ways that are not fully transparent, potentially compromising our intellectual property protections or comprising the unauthorized disclosure of sensitive information. Such events could expose us to adverse consequences, including regulatory scrutiny, contractual liability, competitive harm, or reputational damage. Accuracy and Reliability. AI technologies may produce outputs that are inaccurate, incomplete, biased, or otherwise unreliable, and which may appear correct. If our personnel rely on AI-generated content or analysis without adequate verification, this could result in errors in our decision-making, including making decisions that could bias certain individuals (or classes of individuals) and adversely impact their rights, employment, and ability to obtain certain pricing, products, services, or benefits, as well as errors in our product development, customer communications, or regulatory filings, which could harm our business operations, customer relationships, reputation or expose us to legal liability. Governance and Compliance. We have established certain policies and guidelines related to the permissible use of AI technologies within our organization. However, we cannot guarantee that all personnel will comply with these policies and guidelines, and any failure to do so could result in violations of applicable laws, contractual obligations, or our own standards for responsible AI use. The regulatory environment for AI is evolving rapidly across multiple jurisdictions, including the European Union's AI Act and various U.S. state laws, and we expect other jurisdictions will adopt similar laws. Furthermore, AI technologies are subject to existing regulatory regimes, such as privacy, data security, and consumer protection laws, including those related to automated decision making. These obligations may be subject to differing applications and interpretations, which may be inconsistent or conflict among jurisdictions. Compliance with these requirements may impose additional costs, legal risks, or operational constraints on us, and our efforts to comply may not be successful. Cybersecurity. AI technologies may introduce new cybersecurity vulnerabilities into our products or our IT systems, or may be used by threat actors to enable attacks, such as by developing more sophisticated tradecraft. The integration of AI technologies into our operations may increase our vulnerability to cyber-related attacks or the complexity of maintaining adequate security controls. Reputational Risk. As a company that develops and sells AI solutions, our internal use of AI technologies may be subject to heightened scrutiny. Any perceived misuse, failures, or incidents related to our internal AI practices could disproportionately harm our reputation, erode customer trust, and negatively impact demand for our products and services. We cannot predict all of the risks associated with our use of AI technologies, and the failure to foresee or effectively manage these risks could have a material adverse effect on our business, results of operations, and financial condition. For information about the legal and regulatory risks related to our use of AI technologies in our Software Products & Services, see the Risk Factor titled "Recent and proposed regulation of AI technologies, including facial recognition technology, the processing of biometric data, and automated decision-making and machine learning technologies, increase our compliance costs and otherwise make it harder for us to conduct our business, require us to change our business practices, and may lead to regulatory investigations or actions, litigation, reputational harm, and otherwise have a material adverse effect on our business."

Our success depends largely upon the continued services of our President, Chief Executive Officer and Chairman of our Board, Ryan Steelberg, and our other executive officers and senior management. We rely on our leadership team in the areas of strategy and implementation, research and development, operations, security, marketing, sales, support and general and administrative functions. We do not currently have any employment agreements with our executive officers or senior management team that require them to continue to work for us for any specified period, and, therefore, they could terminate their employment with us at any time. The loss of Ryan Steelberg, or one or more of our executive officers or members of our management team, could adversely impact our business and operations and disrupt our relationships with our key customers. Our future success also depends, in part, on our ability to continue to attract and retain highly skilled personnel. We believe that there is, and will continue to be, intense competition for highly skilled management, engineering, data science, sales, marketing and other personnel with experience in the businesses in which we operate. We must provide competitive compensation packages and a high-quality work environment to hire, retain and motivate employees. If we are unable to retain and motivate our existing employees and attract qualified personnel to fill key positions, we may be unable to manage our business effectively, including the development, marketing, sale and delivery of our products and services, which could adversely affect our business, results of operations and financial condition.