Risk factor changes · CRM

What changed in Salesforce's risk factors

Item 1A (Risk Factors) of Salesforce's FY2026 10-K compared with its FY2025 10-K, sentence by sentence.

Newer: 10-K filed 2026-03-02 · Older: 10-K filed 2025-03-05

New in the latest 10-K 72

• The evolving landscape related to environmental, social and governance matters.
• Volatility in our stock price and associated litigation. 12 Table of Contents Provisions in our governing documents and Delaware law that might discourage, delay or prevent a change of control of the Company or changes in our management.
• Our ability to mitigate these risks may be impacted by the following: evolving and increasingly sophisticated techniques used to breach or disrupt IT systems and infrastructure, including the use or exploitation of AI technologies by threat actors to accelerate, scale or personalize cyberattacks, which may increase speed and effectiveness and limit our ability to anticipate, detect or mitigate such threats; the increasing complexity of our internal IT systems as we integrate acquired businesses and adopt new technologies and data-sharing models; and our limited control over our customers, partners, and third-party vendors (including those authorized by customers to access their data), or over the processing of data by such third parties, which may limit our ability to maintain the integrity or security of such transmissions or processing.
• As our market presence grows, we may face increased risks of cyberattacks and other security threats.
• Additionally, as AI technologies, including generative and agentic AI, continue to evolve, threat actors are using and exploiting these technologies to enhance the sophistication, scale, speed and effectiveness of security threats that may be more difficult to detect and defend against.
• Any delay in detecting, containing, or remediating a cybersecurity incident may result in additional harm, and in certain cases the full scope and impact of any such incident may not be immediately apparent. 13 Table of Contents A cybersecurity incident could result in unauthorized access to, or the loss or denial of authorized access to, our IT systems or data, or those of our customers, including intellectual property and other proprietary, sensitive or confidential information.
• Assessing whether an incident is material or reportable may require complex judgment and investigation, and disclosure of an incident may itself adversely affect our reputation, customer relationships and exposure to legal or regulatory proceedings.
• Additionally, it may take considerable time for us to investigate and evaluate the full impact of cybersecurity attacks, particularly for sophisticated attacks, which may inhibit our ability to provide prompt, full and reliable information about the incident to our customers, regulators and the public.
• In addition, prevention, detection, investigation and remediation of actual or suspected vulnerabilities or incidents, including determining whether notification or disclosure is required, may not be straightforward, may result in significant direct and indirect costs, including increased infrastructure and security spending and the diversion of resources from development activities.
• Such outcomes could reduce future sales, increase in our allowance for doubtful accounts, increase collection cycles and expose us to litigation and related expenses.
• Any loss of the right to use such hardware, software, data or cloud computing platforms could significantly increase our expenses and disrupt or delay the provision of our services until equivalent technology is either developed internally or obtained from third parties and integrated into our systems.
• There can be no assurance that such replacement technology would be available or implemented in a timely manner or at all.
• Additionally, increased energy consumption, including as a result of AI adoption, climate-related events, energy market volatility, and power grid disruptions may increase the operational costs related to inputs across our value chain, including for data centers.
• For example, in connection with our acquisition of Informatica, we entered into the Informatica Credit Agreements on an unsecured basis.
• In November 2025, the Company borrowed the full $6.0 billion available under the Informatica Credit Agreements to finance a portion of the cash consideration for the acquisition, repay existing indebtedness of Informatica and its subsidiaries, and pay related fees, costs, and expenses.
• For more information, see Note 9 Debt to the consolidated financial statements in Item 8 of Part 2.
• For example, in the second quarter of fiscal 2026, we implemented a new enterprise resource planning system ( ERP ).
• Among other things, our ERP is essential to our financial planning, reporting, and compliance programs, and any unforeseen problems with our new ERP or in migrating away from previous systems and processes could harm our ability to manage our business.
• Furthermore, new AI offerings and technologies, which are integrated into our operations, may disrupt workforce needs and could adversely affect our operations if not managed properly.
• Strategic and Industry Risks The markets in which we participate are intensely competitive, and if we do not compete effectively, our operating results could be harmed.
• Our current competitors include: vendors of packaged business software, as well as companies offering enterprise applications delivered through on-premises offerings from enterprise software application vendors and cloud computing application service providers, either individually or with others;
• Policies we adopt or choose not to adopt, on social and ethical issues, particularly regarding the development, deployment or use of our products, may be viewed as controversial by employees, customers, potential customers, or regulators who have varied, evolving and oftentimes conflicting expectations.
• These perceptions have in the past, and may in the future, impact our ability to attract or retain employees and customers and may result in negative publicity or reputational harm.
• Regulatory frameworks such as the EU Digital Services Act ( DSA ), the EU AI Act and other rapidly evolving and sometimes conflicting global laws and regulations related to AI, privacy and consumer protection could increase compliance costs, restrict features or data flows, delay launches and expose us to penalties or litigation.
• As we develop and deploy AI applications in our products and services, including in customer-facing contexts, the speed, scale and complexity of related data processing may increase.
• AI applications may be targeted or misused, or may perform in ways that are inaccurate, biased, unreliable or otherwise harmful, or that implicate personal or proprietary data in ways that may be difficult to anticipate, detect or control.
• Such issues could result in regulatory scrutiny, litigation, contractual disputes, loss of customer trust or reputational harm.
• Inadequate or ineffective AI development, testing, deployment, content labeling, governance, monitoring or oversight, whether by us or others, could result in our AI applications not operating as intended or with reduced functionality, reduced acceptance of our products and services or diminished confidence in the decisions, predictions, analysis or other content that our AI applications produce.
• Such risks may be heightened as AI applications are integrated into a broader range of our products and services.
• This could subject us to regulatory scrutiny, competitive harm, legal liability and reputational damage.
• We may rely in part on third-party models, datasets, cloud infrastructure or other technologies in developing or offering certain AI applications.
• Our reliance on such third parties exposes us to risks relating to performance, availability, security vulnerabilities, intellectual property claims, licensing restrictions, cost increases or changes in terms of service.
• If a third-party provider modifies, suspends or terminates access to its models, data or infrastructure, or if such technologies fail to perform as expected, our ability to offer, scale or support certain AI applications may be adversely affected, and we may incur additional costs to mitigate such impacts.
• The rapid evolution of AI technologies and related regulatory requirements will require the allocation of significant resources to develop, test, monitor and maintain our products and services in order to comply with applicable laws and regulations and to address concerns relating to accuracy, bias, transparency, explainability, security and data provenance.
• Uncertainty surrounding new and emerging AI applications, including generative AI content creation and AI agents, may require additional investment in compliance programs, governance frameworks, licensing arrangements, documentation, auditing and risk mitigation processes, which may be complex, costly and could impact our profit margins.
• Moreover, 21 Table of Contents expansion of our AI capabilities to content generation, including through Agentforce and other generative AI offerings, introduces additional risks and responsibilities.
• AI technologies may produce content that is inaccurate, misleading, biased, offensive or unsafe, and may implicate privacy, security or intellectual property rights, including through the generation of copyrighted or other protected material.
• If our customers or others rely on such content to their detriment, or if regulators or rights holders assert claims relating to AI-generated content, we may be exposed to litigation, regulatory investigations, enforcement actions, indemnification obligations, monetary penalties or other liabilities, or reputational harm.
• The volume, complexity and scope of these regulatory requirements may continue to increase, including in response to heightened geopolitical tensions.
• These laws continue to evolve and expand, including through the adoption of new comprehensive data protection regimes such as India s Digital Personal Data Protection Act 2023, and through the introduction of additional implementing rules and regulations in various jurisdictions.

Reworded 175

Removed words are struck through; added words are highlighted.

• Risk Factor Summary Operational and Execution Risks Any breaches in our security measures or those of our third-party data center hosting facilities, providers, cloud computing platform providers providers, customers, partners, or other third-party service partners, vendors, or the underlying infrastructure of the Internet infrastructure that cause unauthorized access to a to, disclosure, alteration, corruption, destruction or loss of customer s data, our data or our IT systems, or the blockage or disablement disruption of authorized access to our services. thereto.
• Any interruptions or delays in services from third parties, including data center hosting facilities, cloud computing platform providers and other hardware and software vendors, as well as internet availability, Internet infrastructure, or from our inability to adequately plan for and manage service interruptions or infrastructure capacity requirements. requirements, could impair the delivery of our services and harm our business.
• A more time-consuming and expensive sales cycle, pricing pressure and implementation and configuration challenges as we target more of our for sales efforts at to larger enterprise customers.
• Any discontinuance by third-party developers and providers vendors in embracing our technology delivery model and enterprise cloud computing services, or customers asking us for warranties for third-party applications, integrations, data and content.
• Social Social, ethical, and ethical regulatory issues, including the development, deployment, use or capabilities of AI in our offerings. 11 Table of Contents The evolving landscape related to ESG matters.
• Legal and Regulatory Risks Privacy concerns and laws as well as evolving regulation of cloud computing, AI services, increased restriction of cross-border data transfers and other regulatory developments.
• Provisions in our certificate of incorporation and bylaws governing documents and Delaware law that might discourage, delay or prevent a change of control of the Company or changes in our management. management and, therefore, depress our stock price.
• The occurrence of natural disasters and other catastrophic events beyond our control.
• Operational and Execution Risks If our security measures measures, or those of our third-party data center hosting facilities, providers, cloud computing platform providers or third-party service providers, customers, partners, other third-party vendors or the underlying infrastructure of the Internet infrastructure, are breached, and breached or otherwise compromised, resulting in the unauthorized access is obtained to a to, disclosure, alteration, corruption, destruction or loss of customer s data, our data or our IT systems, or disruption of authorized access is blocked or disabled, thereto, our services may be perceived as not being secure, insecure, customers may curtail reduce or stop using terminate their use of our services, and we may incur significant reputational harm, legal exposure and liabilities, liability, regulatory scrutiny or a negative financial impact.
• Our services and underlying infrastructure have in the past and may in the future be materially breached or compromised compromised, including, for example, as a result of the following: third-party attempts to fraudulently induce our employees, partners customers, partners, or customers third-party vendors to disclose sensitive information to gain unauthorized access to our customers data or IT systems, or our customers data or our IT systems; efforts by hackers or sophisticated groups, such as threat actors, including criminal organizations, state-sponsored organizations or actors and nation-states, to launch coordinated cyberattacks or supply chain attacks on internally built our infrastructure or on that of our third-party cloud-computing platform providers, vendors, including through ransomware, destructive malware and malware, distributed denial-of-service attacks; third-party attacks or exploitation of previously unknown zero-day vulnerabilities; attempts to abuse misuse our marketing, advertising, messaging or social products and functionalities to impersonate persons or organizations and disseminate information that is false, misleading or malicious; vulnerabilities existing within arising from new technologies and infrastructures, including those from acquired companies, or resulting from acquisitions, enhancements and updates to our existing service offerings; products, and the adoption and deployment of AI technologies within our products, services, internal systems, which may introduce novel security, data governance, or operational risks; vulnerabilities in the products or components across within the broad ecosystem that in which our services operate in conjunction with and are dependent on; upon which they depend; attacks on, or vulnerabilities in, the many different underlying networks and services that power the Internet that on which our products depend on, depend, most of which are not under our control or the control of our third-party vendors, partners or customers; and 12 Table of Contents employee or contractor errors errors, omissions or intentional acts that compromise our security systems.
• We Although we devote significant resources to protecting our data and IT systems, we can provide no assurances that our security measures, including implemented systems and processes designed to protect the confidentiality, integrity and availability of our customers and our customers customers proprietary and other sensitive data, will provide absolute security or otherwise be effective or that a material breach cybersecurity incident will not occur.
• In the normal course of business, we and our customers are and have been the target of malicious cyberattacks and have experienced other security incidents. threats.
• Although, Although to date, such date we have not identified any security events incidents involving our systems that have not had a material financial impact, impact on us, there can be no assurance that future cyberattacks incidents will not be material or significant.
• We have contractual are subject to contractual, regulatory and other legal obligations to notify relevant stakeholders of certain security breaches. incidents.
• For example, SEC rules require disclosure on Form 8-K of the nature, scope and timing of any material cybersecurity incident and the reasonably likely impact of any such incident.
• A security breach incident or resulting mandatory related disclosure could result in a loss of confidence in the security of our services, damage harm our reputation, negatively impact our future sales, disrupt our business and lead to increases in operations, increase insurance premiums and result in legal, regulatory and financial exposure and liability.
• Further, there can be no assurance that our insurance coverage will be sufficient in type or amount to cover the financial, legal, business, or reputational losses that may result arising from a cybersecurity incident or breach of our IT systems. incident.
• We have in the past and may in the future find identify defects in or experience disruptions to our services.
• Such issues may arise in a variety of circumstances, including due to our from customers using our services in unanticipated ways that may cause a disruption in services disrupt access for other customers attempting to access their data; as a result of customers; from employee, contractor or other third-party action or inaction; or due to from the complexity of our services, which incorporate a variety of hardware, proprietary software and third-party and open-source software.
• We have experienced and may in the future experience defects in our, our customers , or third-party vendors products that and components, which may create vulnerabilities that inadvertently permit unauthorized access to protected customer data.
• We can provide no assurance that such product defects or other vulnerabilities will not occur in the future, have a material adverse effect on our business or subject us to substantial liability.
• Vulnerabilities in open source or any open-source, proprietary or third-party product products and components can persist even after security patches have been issued if customers have updates are not installed the most recent updates, timely implemented or if the attackers exploited the threat actors exploit vulnerabilities before patching was remediation is complete.
• Since our customers use rely on our products and services for important aspects of their business, operations, errors, defects, disruptions in service disruptions or other performance problems issues have in the past adversely impacted our customers businesses and could do so in the future.
• As a result, customers could elect to not renew our services or their services, delay or withhold payment to or make warranty or other claims against us.
• We could also lose future sales or customers may make warranty Any defects or other claims against us, which could result in an increase disruptions in our allowance for doubtful accounts, an increase in collection cycles services that diminish demand for accounts receivable or the expense and risk of litigation. 13 our services. 11 Table of Contents Any interruptions or delays in services from third parties, including data center hosting facilities, cloud computing platform providers and other hardware and software vendors, as well as internet availability, Internet infrastructure, or from our inability to adequately plan for and manage service interruptions or infrastructure capacity requirements, could impair the delivery of our services and harm our business. requirements.
• We currently rely on third-party data center hosting facilities and cloud computing platform providers located in the United States and other countries, as well as the many different underlying networks and services that power the Internet, to deliver our products, services products and business operations services and to operate critical business systems.
• We also rely on computer hardware purchased or leased from, software licensed from, and cloud computing platforms provided by, by third parties in order to offer our products and services, including database software, hardware and data from a variety of multiple vendors.
• Any disruption or damage to, disruption, degradation or failure of our systems generally, including the systems systems, or those of third-party providers the third parties on which we rely on, rely, could result in service interruptions and harm our business.
• We have from time to time experienced service interruptions and such interruptions may occur in the future.
• As we increase our reliance on these third-party systems, systems increases, and particularly with respect to on third-party cloud computing platforms, our exposure to damage from service interruptions or other and performance or quality issues may also increase.
• Service interruptions or other performance or quality issues may cause us to issue credits or pay penalties, cause customers to make assert warranty or other claims against us or to terminate their subscriptions, and adversely affect our attrition rates and our ability to attract new customers, all of which would could reduce our revenue.
• Our business and reputation would also be harmed if our customers and potential customers believe perceive our services are as unreliable.
• For many of our offerings, our production environment and customers customer data are replicated in a at geographically separate facility located elsewhere. facilities.
• Certain offerings, including some offerings of companies those added through acquisitions, may be served delivered through alternate facilities or arrangements.
• We do not control the operation of any of these facilities, and they may be vulnerable to damage or interruption from earthquakes, floods, fires, power loss, telecommunications failures and similar events. events outside of our control, such as natural disasters or supply chain disruptions.
• Despite precautions taken at these facilities, such as disaster recovery and business continuity arrangements, the occurrence of any of the foregoing events or risks, or a natural disaster or public health emergency, an act of terrorism, a decision to close the facilities without adequate notice or other unanticipated problems or events, problems, operational failures at these facilities 14 Table of Contents or other disruptions could result in lengthy prolonged service interruptions, and no assurance there can be provided no assurance that any such interruptions would be remediated without significant cost or cost, in a timely manner or at all.
• As we scale our operations, the amount volume and type nature of information transferred on data processed by our offerings continues continue to evolve, including as a result of the deployment of AI technologies, and our infrastructure capacity requirements, including network capacity and capacity, computing power, power and energy requirements, may increase as a result.
• If we do not accurately plan for our infrastructure capacity requirements and we experience significant strains on our data center capacity, whether due to insufficient infrastructure capacity or for other reasons outside of our control, our customers could experience performance degradation or service outages that may subject us to financial liabilities, result in customer losses losses, subject us to litigation and harm our reputation and business.
• Acquisitions We continue to evaluate such opportunities and expect to make such acquisitions and other transactions and arrangements in the future, which may involve numerous risks and could create unforeseen operating difficulties and expenditures, including: potential failure to achieve the expected benefits on a timely basis or at all; potential identified or unknown security vulnerabilities in acquired products or technologies that expose us to additional security risks or cybersecurity risks, delay our ability to integrate the product integration into our service offerings, as well as difficulties or create challenges in increasing or maintaining the security standards for acquired technology; 14 Table of Contents the acquired technologies; difficulty of transitioning the acquired technology onto our existing platforms and customer acceptance of multiple platforms on a temporary or permanent basis; platforms; brand or reputational harm associated with our acquired companies; challenges converting the acquired company s revenue recognition policies and forecasting the related revenues, including both consumption- and subscription-based revenues and term software license revenue, as well as appropriate allocation of the customer consideration to revenue; in the individual deliverables; case of foreign acquisitions, challenges entering into new markets in which we have little or no experience or where competitors may have stronger market positions; currency with integrating operations across different cultures and languages and addressing the particular economic, currency, political, cybersecurity, regulatory and market risks associated with foreign countries and potential additional cybersecurity and compliance risks resulting from entry into new markets; certain countries; operational and financial difficulties and strains on resources in integrating acquired operations, technologies, services, platforms and personnel; personnel (including cultural integration and retention of employees); regulatory challenges from antitrust or other regulatory authorities that may block, delay or impose conditions (such as divestitures, ownership or operational restrictions or other structural or behavioral remedies) on the completion of transactions or the integration of acquired operations; failure to fully assimilate, integrate or retrain acquired employees, which may lead to retention risk with respect to both key acquired employees and our existing key employees or disruption to existing teams or our workplace culture; challenges with maintaining the acquired company s customers, partners and third-party service providers; known and potential unknown liabilities associated with the acquired businesses, including due to litigation; difficulties in managing, or potential write-offs of, acquired assets, and potential financial and credit risks associated with acquired customers; negative impact to our results of operations because of the depreciation and amortization of acquired intangible assets, fixed assets and operating lease right-of-use assets; difficulties in and financial costs of addressing acquired compensation structures inconsistent with our compensation structure; additional stock-based compensation issued or assumed in connection with the acquisition, including the impact on stockholder dilution and our results of operations; ineffective or inadequate controls, procedures and policies at the acquired company; and the tax effects related to integration and business operation changes, realizability of our deferred tax assets, and uncertain tax liabilities. 15 Table of Contents Any of these risks could harm our business or negatively impact our results of operations.
• For example, if If we finance acquisitions by issuing equity or convertible or other debt securities or taking out loans, our existing stockholders may be diluted, or we could face constraints related to the terms of, and repayment obligation related to, the incurrence of indebtedness that could affect the market price of our common stock. stock price.

Removed since the previous 10-K 74

• Any defects or disruptions in our services that diminish demand for our services.
• Volatility in the market price of our common stock and associated litigation.
• These risks are mitigated, to the extent possible, by our ability to maintain and improve business and data governance policies and enhance processes and internal security controls, including our ability to escalate and respond to known and potential risks.
• For example, our ability to mitigate these risks may be impacted by the following: evolving techniques used to breach or sabotage IT systems and infrastructure, including as a result of the increased use of AI technologies by bad actors, which are generally not recognized until launched against a target, and could result in our being unable to anticipate or implement adequate measures to prevent such techniques; the increasing complexity of our internal IT systems as we incorporate and secure IT environments from acquired companies and early adoption of new technologies and new ways of sharing data; and our limited control over our customers or third-party technology providers (including those authorized by customers to access their data), or the processing of data by third-party technology providers, which may not allow us to maintain the integrity or security of such transmissions or processing.
• Additionally, as our market presence grows, we may face increased risks of cyberattacks or security threats, and as AI technologies, including generative AI models, develop rapidly, threat actors are using these technologies to create new sophisticated attack methods that are increasingly automated, targeted and coordinated and more difficult to defend against.
• A security breach or incident could result in unauthorized parties obtaining access to, or the denial of authorized access to, our IT systems or data, or our customers systems or data, including intellectual property and proprietary, sensitive or other confidential information.
• Finally, the detection, prevention and remediation of known or potential security vulnerabilities, including determining whether a cybersecurity incident is notifiable or reportable, may not be straightforward and may result in additional financial burdens due to additional direct and indirect costs to respond to or alleviate problems caused by the actual or perceived security breach, such as additional infrastructure capacity spending to mitigate any system degradation and the reallocation of resources from development activities.
• We may also encounter difficulties integrating acquired or licensed technologies into our services and in augmenting the technologies we use to meet quality standards that are consistent with our brand and reputation, which may result in our services containing errors or defects.
• They may also be subject to break-ins, sabotage, intentional acts of destruction or vandalism or similar misconduct, as well as local administrative actions, changes to legal or permitting requirements and litigation to stop, limit or delay operation.
• In addition, supply chain disruptions due to geopolitical developments in Europe may lead to power disruptions in regions where our facilities are located.
• Any loss of the right to use any of these hardware, software, data or cloud computing platforms could significantly increase our expenses and disrupt or otherwise result in delays in the provisioning of our services until equivalent technology is either developed by us, or, if available, is identified, obtained through purchase or license and integrated into our services, and no assurance can be provided that such equivalent technology would be developed or obtained in a timely manner or at all.
• We continue to evaluate such opportunities and expect to make such acquisitions in the future.
• Any of these risks could harm our business or negatively impact our results of operations.
• For example, several countries, including the United States and countries in Europe and the Asia-Pacific region, are considering or have adopted restrictions of varying kinds on transactions involving foreign investments and acquisitions.
• Antitrust authorities in a number of countries have also reviewed acquisitions in the technology industry with increased scrutiny.
• We have limited experience with determining optimal pricing for our consumption-based contracts.
• We intend to seek to continue to expand our international sales efforts.
• As we target more of our sales efforts at larger enterprise customers, including governmental entities, and specific industries, such as financial services and healthcare and life sciences, we may face greater costs, longer sales cycles, greater competition and less predictability in completing some of our sales.
• We offer certain products, such as Agentforce and Data Cloud, through a consumption-based pricing model, and we have limited experience with determining the optimal pricing for our consumption-based contracts.
• Due to customer flexibility in the timing of their consumption, we could have lower levels of customer consumption of our products than we expect may result in suboptimal 17 Table of Contents pricing for consumption-based contracts.
• If we do not develop adequate succession planning for our key personnel, the loss of one or more of our key employees or groups of employees could seriously harm our business.
• The workforce reduction was substantially completed by the end of fiscal 2024, and real estate actions are expected to be completed by the end of fiscal 2026.
• Additionally, throughout fiscal 2025 we initiated further targeted workforce and office space reductions.
• For example, we offer certain products, including Agentforce and Data Cloud, through a consumption-based business model and may increase the number of products through which we do so.
• We have limited experience with determining optimal pricing for our consumption-based contracts.
• Additionally, due to customer flexibility in the timing of their consumption, we could have lower levels of customer consumption of our products than we expect which may result in suboptimal pricing for consumption-based contracts.
• In addition, we have secured the naming rights to facilities controlled by third parties, such as office towers and a transit center, and any negative events or publicity arising in connection with these facilities could adversely impact our brand.
• The resulting gains or losses could be material depending on market conditions and events, particularly in periods with economic uncertainty, inflation, geopolitical conflict, volatile public equity markets or unsettled global market conditions.
• Policies we adopt or choose not to adopt on social and ethical issues, especially regarding the use of our products, may be unpopular with some of our employees or with our customers or potential customers, and have in the past impacted and may in the future impact our ability to attract or retain employees and customers.
• For example, we have been subject to allegations in legal proceedings that we should be liable for the use of certain of our products by third parties.
• Although we believe that we have a strong defense against these allegations, legal proceedings can be lengthy, expensive and disruptive to our operations and the outcome of any claims or litigation, regardless of the merits, is inherently uncertain.
• Inadequate or ineffective AI development, deployment, content labeling or governance by us or others that result in controversy could also impair the acceptance of AI solutions or result in unintended performance of the services.
• This in turn could undermine confidence in the decisions, predictions, analysis or other content that our AI applications produce, subjecting us to competitive harm, legal liability and brand or reputational harm.
• The rapid evolution of AI will require the application of resources to develop, test and maintain our products and services to help ensure that AI is implemented ethically in order to minimize unintended, harmful impact.
• Uncertainty around new and emerging AI applications such as generative AI content creation and AI agents will require additional investment in compliance, governance and the licensing or development of proprietary datasets, machine learning models and systems to test for accuracy, bias and other variables, which are often complex, may be costly and could impact our profit margin.
• Moreover, the move from AI content classification to AI content generation through our development of Agentforce and other generative AI products brings additional risks and responsibility.
• Known risks of generative AI currently include risks related to accuracy, bias, toxicity, privacy and security and data provenance.
• For example, AI technologies, including generative AI, may create content that appears correct but is factually inaccurate or flawed, or contains copyrighted or other protected material, and if our customers or others use this flawed or protected content to their detriment, or the owners of such copyrighted material seek to enforce their rights, we may be exposed to brand or reputational harm, competitive harm and/or legal liability.
• These laws continue to evolve, including, for example, India s Digital Personal Data Protection Act 2023, and as various jurisdictions introduce similar proposals, which often include subsequent rules and regulation, we and our customers become subject to additional regulatory burdens.
• In addition, various safe harbors have historically been provided to those who hosted content provided by others, such as safe harbors from monetary damages for copyright infringement arising from copyrighted content provided by customers and others and for defamation and other torts arising from information provided by customers and others.

Source: SEC EDGAR filings, compared sentence by sentence by EdgarStack. Sentence matching is automated and may pair or split passages imperfectly; check the linked filings before relying on any passage. A software tool, not financial advice. Not affiliated with the U.S. Securities and Exchange Commission.