Risk factor changes · IBM

What changed in IBM's risk factors

Item 1A (Risk Factors) of IBM's FY2025 10-K compared with its FY2024 10-K, sentence by sentence.

Newer: 10-K filed 2026-02-24 · Older: 10-K filed 2025-02-25

New in the latest 10-K 1

• Although the company continuously takes significant steps to mitigate 7 Table of Contents cybersecurity risk across a range of functions, such measures can never eliminate the risk entirely or provide absolute security.

Reworded 28

Removed words are struck through; added words are highlighted.

• Failure of Innovation Initiatives Could Impact the Long-Term Success of the Company: IBM has moved into areas, including those that incorporate or utilize hybrid cloud, AI and generative AI, quantum and other disruptive technologies, in which it can differentiate itself through responsible innovation, by leveraging its investments in R&D and attracting a successful developer ecosystem.
• Risks from Investing in Growth Opportunities Could Impact the Company s Business: The company continues to invest significantly in key strategic areas, including AI and generative AI, to drive revenue growth and market share gains.
• Tariffs and Tariffs, international trade sanctions sanctions, and export controls on goods, technologies, inputs, and raw materials resulting from these disputes could affect the company s ability to move goods and services across borders, or could impose added costs to those activities.
• Measures taken to date by the company to mitigate these impacts could be made less effective should trade sanctions sanctions, export controls, or tariffs change.
• The company s most critical accounting estimates are described in the Management Discussion in IBM s 2024 2025 Annual Report to Stockholders, under Critical Accounting Estimates.
• In addition, as discussed in note Q, Commitments & Contingencies, in IBM s 2024 2025 Annual Report to Stockholders, the company makes certain estimates including decisions related to legal proceedings and reserves.
• Further, many of IBM s 5 Table of Contents key employees receive a total compensation package that includes equity awards.
• Any new regulations, volatility in the 5 Table of Contents stock market and other factors could diminish the company s use or the value of the company s equity awards, putting the company at a competitive disadvantage.
• The Development and Use of AI and Generative AI, including the Company s Increased Offerings AI Solutions and Use of AI-based AI Technologies, Could Impact the Long-Term Success of the Company and its Reputation or Give Rise to Legal or Regulatory Action: IBM is increasingly applying AI-based technologies, including generative AI, AI technologies to its services and products, to how it delivers offerings solutions to IBM clients, and to its own internal operations.
• Additionally, IBM is investing in and offering new products and services associated with AI development, deployment deployment, governance, and management.
• As stated more comprehensively and in context of several risk factors throughout this Item 1A., this increasing mix and application of AI-based technologies may impact IBM s ongoing efforts to maintain and increase its market share and its profit margins or harm IBM s reputation if the company does not continue to be recognized as an AI leader with strong governance processes. processes or if our AI technologies do not work as intended or produce unexpected outcomes, IBM s ongoing efforts to maintain and increase its market share and its profit margins, its reputation, and its competitiveness could be harmed.
• Further, IBM s drive for greater agility, productivity, flexibility and cost savings by continuously transforming with the use of AI may not yield intended gains in speed, quality, productivity and enablement of rapid scaling, which may impact the company s competitiveness. scaling.
• The evolving global AI regulatory environment, including the enactment of the EU AI Act, and legal environment may affect the company s business and the company s overall results of operations.
• Computer hackers and others routinely attack the security of technology products, services, systems and networks using a wide variety of methods, and the increased use of generative AI technologies may introduce novel methods of attack.
• In addition, the failure of ecosystem partners to comply with all applicable laws and regulations may prevent the company from working with them and could subject the company to losses and affect its ability to bring products to market. 6 Table of Contents Risks Related to Cybersecurity and Data Privacy Cybersecurity, Privacy, Protection Cybersecurity and AI Data Protection Considerations Could Impact the Company s Business: There are numerous and evolving risks to cybersecurity and privacy, data protection, including risks originating from intentional acts of individual and groups of criminal hackers, hacktivists, state-sponsored organizations, nation states and competitors; from intentional and unintentional acts or omissions omissions, including the practices and investments, of customers, contractors, business partners, vendors, the open source community, the companies we acquire, employees and other third parties; and from errors in processes or technologies, as well as the risks associated with an increase in the number of customers, contractors, business partners, vendors, employees and other third parties working remotely.
• Computer hackers and others routinely attack the security of technology products, services, systems and networks, like those we offer, using a wide variety of methods, including ransomware or other malicious software and attempts to exploit vulnerabilities in hardware, software, and infrastructure, and the increased use of generative AI technologies may introduce novel methods of attack.
• Attacks may also include social engineering and cyber extortion to induce customers, contractors, business partners, vendors, employees and other third parties to disclose information, transfer funds, or unwittingly provide unauthorized access to systems or data.
• The company s products, services, systems and networks, including cloud-based systems and systems and technologies that the company maintains on behalf of its customers, are used in critical company, customer or third-party operations, and involve the storage, processing and transmission of sensitive data, including valuable intellectual property, other proprietary or confidential data, regulated data, and regulated data including personal information of employees, customers and others.
• Cybersecurity attacks or other security incidents, including industry-wide incidents such as MOVEit, incidents, have or could result in, for example, one or more of the following: unauthorized access to, disclosure, modification, misuse, loss, or destruction of company, customer, or other third-party data or systems; theft or import or export of sensitive, regulated, or confidential data including personal information and intellectual property, including key innovations in AI, quantum, or other disruptive technologies; the loss of access to critical data or systems through ransomware, crypto mining, destructive attacks or other means; and business delays, service or system disruptions or denials of service.
• Cybersecurity attacks or other catastrophic events resulting in disruptions to or failures in power, information technology, communication systems or other critical infrastructure could result in interruptions or delays to company, customer, or other third-party operations or services, financial loss, injury or death to persons or property, potential liability, and damage to brand and reputation. 7 Table of Contents Although the company continuously takes significant steps to mitigate cybersecurity risk across a range of functions, such measures can never eliminate the risk entirely or provide absolute security.
• As a global enterprise, the regulatory environment with regard to cybersecurity, privacy, AI cybersecurity and data protection issues is increasingly complex and will continue to impact the company s business, including through increased risk, increased costs, and expanded or otherwise altered compliance obligations, including with respect to the increased regulatory activity around the security of critical infrastructure, IoT connected devices, customer industries (e.g., financial services) and various customer and government supply chain security programs.
• The enactment and expansion of cybersecurity, AI, cybersecurity and data protection and privacy laws, regulations and standards around the globe will continue to result in increased compliance costs, including due to an increased focus on international data transfer mechanisms and data location; increased cybersecurity requirements and reporting obligations; the lack of harmonization of such laws and regulations; the increase in associated litigation and enforcement activity by governments and private parties; the potential for damages, fines and penalties and debarment; and the potential regulation of new and emerging technologies.
• We do not expect climate change or compliance with environmental laws and regulations focused on climate change or environmental protection to have a disproportionate effect on the company or its financial position, results of operations and competitive position.
• The risks associated with such legal proceedings are described in more detail in note Q, Commitments & Contingencies, in IBM s 2024 2025 Annual Report to Stockholders.
• IBM s 2024 2025 Annual Report to Stockholders includes information about potential impacts from pension funding and the use of certain assumptions regarding pension matters.
• IBM s 2024 2025 Annual Report to Stockholders includes information about the company s liquidity position.
• Since the market price of IBM s common stock fluctuates significantly, stockholders may not be able to sell the company s stock at attractive prices. 9 Table of Contents In addition, changes by any rating agency to the company s outlook or credit ratings can negatively impact the value and liquidity of both the company s debt and equity securities.
• The company does not make a market in either its debt or equity securities and cannot provide any assurances with respect to the liquidity or value of such securities. 9 Table of Contents

Removed since the previous 10-K 2

• Cybersecurity risk to the company and its customers also depends on factors such as the actions, practices and investments of customers, contractors, business partners, vendors, the open source community and other third parties, including, for example, providing and implementing patches to address vulnerabilities.
• Since the market price of IBM s common stock fluctuates significantly, stockholders may not be able to sell the company s stock at attractive prices.

Source: SEC EDGAR filings, compared sentence by sentence by EdgarStack. Sentence matching is automated and may pair or split passages imperfectly; check the linked filings before relying on any passage. A software tool, not financial advice. Not affiliated with the U.S. Securities and Exchange Commission.