NetApp

“Competition We operate in markets characterized by rapid technological change, evolving customer requirements, and frequent introductions of new products, services, and business models. Customer demand continues to be influenced by cloud adoption, digital transformation initiatives, cybersecurity requirements, and increasing use of artificial intelligence and data‑driven applications. We compete in the storage, data management, and AI data pipeline markets, including on-premises infrastructure, hybrid cloud environments, and public cloud services.”

Annual report 2026A · The company itself

“The emergence of artificial intelligence workloads has introduced additional competitive dynamics, particularly in areas related to data readiness, performance, scalability, and integration with compute and cloud ecosystems. In these markets, competition includes both established infrastructure vendors and newer entrants focused on AI-oriented use cases and architectures.”

Annual report 2026A · The company itself

“The growth in our industry and the markets we compete in is driven by the increasing demand for data, which in turn drives the need for storage and data management solutions.”

Annual report 2026A · The company itself

“The rapid emergence of generative artificial intelligence (GenAI), including agentic AI, is reshaping demand patterns for storage and data management infrastructure in ways that are still evolving. Our ability to keep pace with the changing requirements of these technologies, and to adapt our products and go-to-market strategies accordingly, is critical to maintaining our competitive position.”

Annual report 2026A · The company itself

“AI technologies increasingly require seamless data management across hybrid and multi-cloud environments. If we were unable to effectively deliver our solutions across these fragmented environments to address customers’ AI challenges, customers may turn to alternative providers, which could adversely affect our competitive position and revenue.”

Annual report 2026A · The company itself

“Customer demand continues to be influenced by cloud adoption, digital transformation initiatives, cybersecurity requirements, and increasing use of artificial intelligence and data-driven applications, driving significant changes in storage architectures and solution requirements. The emergence of artificial intelligence workloads has introduced additional competitive dynamics, particularly in areas related to data readiness, performance, scalability, and integration with compute and cloud ecosystems.”

Annual report 2026A · The company itself

“Increasing use of AI, such as Anthropic's Claude Mythos, in techniques employed by threat actors will continue to increase the risk of successful attacks that may overwhelm our protection systems faster than we can effectively respond.”

Annual report 2026A · The company itself

“Research and Development Our research and development (R&D) team delivers innovation to help customers make their data intelligent. Our R&D structure supports the execution and acceleration of our strategies and roadmaps across product groups. We use our expertise and shared intellectual property to develop cloud services and hybrid-cloud solutions that help customers adapt to changing business imperatives.”

Annual report 2026A · The company itself

“Well positioned to address these complexities, NetApp empowers Intelligent Data Infrastructure for our customers through our solutions, which seamlessly connect, manage and protect data across any environment. Our first-party native integration with all major hyperscalers—Amazon Web Services (AWS), Microsoft Azure, and Google Cloud—combined with decades of data management leadership, uniquely enables customers to harness these shifts for competitive advantage.”

Annual report 2026A · The company itself

“Accelerating AI Adoption: The rise of AI and machine learning is transforming industries, and NetApp is well positioned to help customers with these next-generation workloads. Our AI-ready infrastructure solutions, including the NetApp AI Data Engine and validated reference architectures with partners like NVIDIA, help organizations streamline data pipelines, accelerate model training, and derive actionable insights from their data.”

Annual report 2026A · The company itself

“We are increasingly building and/or deploying AI technology in certain products, services, and business operations, and our research and development in this area is ongoing.”

Annual report 2026A · The company itself

“Customer demand continues to be influenced by cloud adoption, digital transformation initiatives, cybersecurity requirements, and increasing use of artificial intelligence and data-driven applications, driving significant changes in storage architectures and solution requirements. The emergence of artificial intelligence workloads has introduced additional competitive dynamics, particularly in areas related to data readiness, performance, scalability, and integration with compute and cloud ecosystems.”

Annual report 2026A · The company itself

“In response to evolving and increasing security threats, the U.S. government has imposed, and may impose in the future, requirements relating to product security, supply chain security, and cyber/information security that have impacted, and may in the future impact NetApp. Failure to meet these requirements as they apply to us and our products may result in delays or inability to sell our products to government entities.”

Annual report 2026A · The company itself

“In addition, in the EU, various cyber resilience related laws (for example, the EU Cyber Resilience Act and the Network and Information Systems Directive 2) have been enacted and will be applied in phases. These frameworks essentially oblige those doing business in the EU to implement robust cybersecurity standards with respect to the products and services they provide.”

Annual report 2026A · The company itself

“It is critical to our business strategy that our infrastructure, products, and services remain secure and are perceived as secure by customers, and partners.”

Annual report 2026A · The company itself

“Enabling Resilient and Secure Operations: As cyber threats and regulatory requirements intensify, NetApp’s integrated security and data protection capabilities have become essential for enterprises worldwide. Our solutions offer robust ransomware protection, automated data backup and recovery, disaster recovery, and comprehensive governance features. We continue to innovate in cyber resilience, helping customers safeguard their most valuable digital assets and maintain business continuity.”

Annual report 2026A · The company itself

“Data management software NetApp ONTAP software is our foundational technology that underpins NetApp’s critical storage solutions in the on-premises data center and in private and public clouds. ONTAP includes various data management and protection features and capabilities, including autonomous ransomware detection to protect against cyber-attacks, built-in data transport features, and storage efficiency capabilities.”

Annual report 2026A · The company itself

“Our business is increasingly subject to regulation by various federal, state and international governmental agencies responsible for enacting and enforcing laws and regulations relating to privacy, data protection, and information security. For example, since the GDPR became effective in 2018, the Court of Justice of the EU has issued rulings that have impacted how multinational companies must implement that law and the European Commission (EC) has published new regulatory requirements relating to cross-border data transfers.”

Annual report 2026A · The company itself

“Our business could face stricter obligations, greater fines, and private causes of action under new privacy, data protection, and information security laws and regulations, including the GDPR, which provides for penalties of up to 20 million Euros or four percent of our total worldwide annual turnover of the preceding financial year (whichever is higher), the California Consumer Privacy Act, the California Privacy Rights Act, and a growing number of comprehensive privacy laws enacted by various U.S. states, many of which impose varying and potentially conflicting obligations, as well as new and emerging privacy laws globally.”

Annual report 2026A · The company itself

“In addition, in the EU, various cyber resilience related laws (for example, the EU Cyber Resilience Act and the Network and Information Systems Directive 2) have been enacted and will be applied in phases. These frameworks essentially oblige those doing business in the EU to implement robust cybersecurity standards with respect to the products and services they provide.”

Annual report 2026A · The company itself

“The EU has also enacted a comprehensive law regulating the development and use of AI systems, the EU AI Act, which came into force on August 1, 2024, and will generally become fully applicable after a two-year transitional period, with certain obligations taking effect at a later time. The EU AI Act imposes enhanced requirements on certain “high-risk” AI systems, including obligations relating to risk management, data governance, documentation, human oversight and conformity assessments, and also establishes transparency obligations that apply to a broad range of AI systems.”

Annual report 2026A · The company itself

“As we provide technology services to EU financial institutions, the Digital Operational Resilience Act (DORA) imposes financial and legal risks. These include compliance costs for enhancing cybersecurity, performing resilience testing, requiring comprehensive documentation, increased audits, and detailed reporting.”

Annual report 2026A · The company itself

“The growth in our industry and the markets we compete in is driven by the increasing demand for data, which in turn drives the need for storage and data management solutions.”

Annual report 2026A · The company itself

“Additionally, cloud service providers offer storage on demand without requiring capital expenditure, which meets rapidly evolving business needs and has altered the competitive landscape.”

Annual report 2026A · The company itself

“We offer customers a variety of consumption models, including cloud-based storage services and storage-as-a-service (STaaS) delivered on-premises. As these business models continue to evolve, we may face challenges in competing effectively, generating significant revenues, or maintaining the profitability of our consumption-based offerings.”

Annual report 2026A · The company itself

“Well positioned to address these complexities, NetApp empowers Intelligent Data Infrastructure for our customers through our solutions, which seamlessly connect, manage and protect data across any environment. Our first-party native integration with all major hyperscalers—Amazon Web Services (AWS), Microsoft Azure, and Google Cloud—combined with decades of data management leadership, uniquely enables customers to harness these shifts for competitive advantage.”

Annual report 2026A · The company itself

“Our customers and their customers use our solutions to transmit and store sensitive data. We do not generally have the ability to review the information or content they upload and store, nor do we control the substance of this information or content.”

Annual report 2026A · The company itself

“Our customers, including data centers, SaaS providers, cloud computing services and internet infrastructure and bandwidth providers, rely on our products for their data storage needs.”

Annual report 2026A · The company itself

“As we provide technology services to EU financial institutions, the Digital Operational Resilience Act (DORA) imposes financial and legal risks. These include compliance costs for enhancing cybersecurity, performing resilience testing, requiring comprehensive documentation, increased audits, and detailed reporting.”

Annual report 2026A · The company itself

“For example, we provide our open access data retention solutions to customers within the financial services, healthcare, pharmaceutical and government market segments, industries that are subject to various evolving governmental regulations, certifications and controls with respect to data access, reliability and permanence in the U.S. and in the other countries in which we operate.”

Annual report 2026A · The company itself

“As a technology provider, our customers expect us to demonstrate compliance with privacy, data protection, and information security laws and regulations. Our inability, or perceived inability, to do so may adversely impact sales of our products and services, especially to customers in highly regulated industries.”

Annual report 2026A · The company itself

“For example, we provide our open access data retention solutions to customers within the financial services, healthcare, pharmaceutical and government market segments, industries that are subject to various evolving governmental regulations, certifications and controls with respect to data access, reliability and permanence in the U.S. and in the other countries in which we operate.”

Annual report 2026A · The company itself

“Additionally, government certification requirements for products like ours may change and, in doing so, restrict our ability to sell into the government sector until we have attained revised certifications.”

Annual report 2026A · The company itself

“Selling our products to the U.S. government through channel partners, subjects us to specific regulatory and contractual requirements, which may change or increase at short notice. Some of these requirements may extend past the specific nature and products of the arrangement and impact our broader corporate policies, initiatives and employee resources. Failure to comply with these requirements by either us or our channel partners could lead to investigations, fines, and other penalties (including the loss of access to such government contracts), harming our operating results and financial condition.”

Annual report 2026A · The company itself

“We continuously strive to make our cost structure and business processes more efficient, which includes relocating our business activities from higher-cost to lower-cost locations, outsourcing certain business processes and functions, and implementing changes to our business information systems.”

Annual report 2026A · The company itself

“Quantitative and Qualitative Disclosures about Market Risk We are exposed to market risk related to fluctuations in interest rates and foreign currency exchange rates. We use certain derivative financial instruments to manage foreign currency exchange risks.”

Annual report 2026A · The company itself

“Hybrid Cloud Hybrid Cloud provides a unified data storage portfolio of storage management and infrastructure solutions that helps customers modernize their data centers. By leveraging on-premises, private cloud and public cloud capabilities, we enable customers to modernize applications with a single solution that supports file, block, and object storage. We deliver a versatile data infrastructure solution suitable for all environments and workloads, including the strategic enterprise AI market.”

Annual report 2026A · The company itself

“Failure to comply with new and existing laws and regulations related to privacy, data protection, AI and information security could cause harm to our reputation, result in liability (including regulatory penalties and litigation), and adversely impact our business.”

Annual report 2026A · The company itself

“Our business is increasingly subject to regulation by various federal, state and international governmental agencies responsible for enacting and enforcing laws and regulations relating to privacy, data protection, and information security. For example, since the GDPR became effective in 2018, the Court of Justice of the EU has issued rulings that have impacted how multinational companies must implement that law and the European Commission (EC) has published new regulatory requirements relating to cross-border data transfers.”

Annual report 2026A · The company itself

“The interpretation and application of many privacy, data protection, and information security laws and regulations, along with industry standards, are uncertain. These laws, regulations, or standards may be interpreted and applied in ways that are inconsistent 25 with our data management practices or product features.”

Annual report 2026A · The company itself

“In addition, our reliance on third-party cloud providers also introduces data residency and data sovereignty risks, as data may be stored or processed in jurisdictions with differing or conflicting privacy and data protection requirements. Changes in local data localization laws or government access demands directed at our cloud providers could require costly operational changes or restrict our ability to deliver services in certain markets.”

Annual report 2026A · The company itself

“Compliance with new and evolving laws and regulations, including further regulatory or judicial developments, may require significant changes to our business operations and additional investment, which could adversely affect our revenue and overall business. Non-compliance could harm our reputation and brand, incur significant costs, materially affect our financial and operating results, and require modifications to our products or business practices.”

Annual report 2026A · The company itself

“Regulatory enforcement of privacy, data protection, and information security laws have intensified globally, with regulators imposing increasingly significant fines and pursuing enforcement actions against technology companies. This trend increases the likelihood and potential magnitude of regulatory penalties for non-compliance.”

Annual report 2026A · The company itself

“Stricter contractual obligations will be imposed by financial institution clients, necessitating more robust incident reporting and data protection measures. Non-compliance could result in legal liabilities, suspension of services and reputational damage.”

Annual report 2026A · The company itself

“As a technology company at the forefront of AI innovation, our business faces potential risks associated with the rapidly evolving regulatory landscape for AI. Governments and regulatory bodies worldwide are increasingly enacting new laws and guidelines to address the ethical, privacy, and security implications of AI technologies.”

Annual report 2026A · The company itself

“AI-related issues, deficiencies and/or failures could result in (i) legal or regulatory action, including to enforce new legislation regulating AI in various jurisdictions where we operate, and the application of existing data protection, privacy, intellectual property, and other laws; (ii) damage to our reputation; (iii) time-consuming and costly litigation, including related to intellectual property; (iv) inability to protect our intellectual property, including the inability to claim intellectual property ownership over content or source code generated using AI; (v) disclosure of our confidential information, including the inadvertent input of proprietary, sensitive, or customer data into publicly available third-party AI training models; or (vi) other material harm to our business. If regulation significantly delays or impedes the adoption of AI, we may not be able to meet our development goals or our sales forecasts.”

Annual report 2026A · The company itself

“Failure to comply with new and existing laws and regulations related to privacy, data protection, AI and information security could cause harm to our reputation, result in liability (including regulatory penalties and litigation), and adversely impact our business.”

Annual report 2026A · The company itself

“The EU has also enacted a comprehensive law regulating the development and use of AI systems, the EU AI Act, which came into force on August 1, 2024, and will generally become fully applicable after a two-year transitional period, with certain obligations taking effect at a later time. The EU AI Act imposes enhanced requirements on certain “high-risk” AI systems, including obligations relating to risk management, data governance, documentation, human oversight and conformity assessments, and also establishes transparency obligations that apply to a broad range of AI systems.”

Annual report 2026A · The company itself

“Beyond the EU, other jurisdictions are enacting or proposing AI-specific legislation and regulatory frameworks, including in the United States at both the federal and state level, and in other international markets. These emerging requirements may impose additional or conflicting obligations on our development and deployment of AI technologies, increasing compliance complexity and cost.”

Annual report 2026A · The company itself

“Risks Related to Our Business and Industry Global economic and geopolitical conditions may adversely affect our industry, business operations, and financial performance, including our revenue growth, profitability, financial condition and cash flows.”

Annual report 2026A · The company itself

“Additionally, ongoing trade tensions between the U.S. and China and recent investment restrictions, such as the U.S. Outbound Investment Security Program, could impact our business and operating results. Any increase in tensions between China and Taiwan, including threats of military actions or escalation of military activities, could adversely affect our ability, or the ability of our contract manufacturers, to source key supply chain components included in our products.”

Annual report 2026A · The company itself

“Additionally, the ongoing conflict in the Middle East has disrupted our ability to fulfill customer orders in the region on a timely basis.”

Annual report 2026A · The company itself

“Cyber-attacks and security breaches continue to increase, and of particular concern are supply-chain attacks against software development and breaches of technology service providers. We anticipate that cyberattacks will continue to increase in the future given cyber warfare has become a consistent lever within geopolitical conflicts and increasingly leverages hacktivism.”

Annual report 2026A · The company itself

“We depend on the ability of our personnel, inventory, equipment and products to move reasonably unimpeded around the world. Any political, military, terrorism, global trade, pandemic, widespread health or other issue that hinders this movement or restricts the import or export of materials could lead to significant business disruptions.”

Annual report 2026A · The company itself

“Risks Related to Our Business and Industry Global economic and geopolitical conditions may adversely affect our industry, business operations, and financial performance, including our revenue growth, profitability, financial condition and cash flows.”

Annual report 2026A · The company itself

“Our gross margins are influenced by a variety of factors, including macroeconomic volatility, competitive pricing, customer price sensitivity, component and product design costs, inflation, foreign exchange currency fluctuations, and the volume and relative mix of revenues from product sales, software support, hardware support, and other services offerings. Factors such as increased component, labor, and transportation costs, cost of any substandard materials, pricing and discounting pressures, changes in product prices, or shifts in revenue mix and volume from different offerings could negatively impact our revenues, gross margins or earnings.”

Annual report 2026A · The company itself

“We have experienced, and may continue to experience, negative impacts on our gross margins due to rising component costs, logistics costs, tariffs and other trade barriers, and inflationary pressures. For example, we have experienced inflationary pressure and supply chain constraints beginning in the second half of fiscal 2026, resulting in increased costs for memory and other components, which have affected our gross margins.”

Annual report 2026A · The company itself

“These risks have subjected us, and could in the future subject us, to supply constraints, price increases, and minimum purchase requirements, which could harm our business, operating results, financial condition, and cash flows. For example, we experienced inflationary pressure and supply chain constraints beginning in the second half of fiscal 2026, resulting in increased costs for memory and other components, which have adversely affected our gross margin.”

Annual report 2026A · The company itself

“As a global company, our business is influenced by worldwide economic and market conditions, including, among others, rising inflation, slower growth, economic downturns or recessions, changes in fiscal and monetary policies, higher interest and tax rates, economic uncertainty, political instability, ongoing international and regional conflicts (including conflicts in the Middle East), warfare, extreme weather events and effects from climate change, natural disasters and pandemics, supply chain interruptions and shortages, changes in laws and regulations, reduced consumer confidence and spending, international trade protection measures and disputes (including economic and trade barriers, tariffs, sanctions and export controls), rapid technological changes, and the threat and potential of trade control policies and retaliatory trade control policies (including retaliatory tariffs).”

Annual report 2026A · The company itself

“Additionally, ongoing trade tensions between the U.S. and China and recent investment restrictions, such as the U.S. Outbound Investment Security Program, could impact our business and operating results. Any increase in tensions between China and Taiwan, including threats of military actions or escalation of military activities, could adversely affect our ability, or the ability of our contract manufacturers, to source key supply chain components included in our products.”

Annual report 2026A · The company itself

“Changes in regulations relating to our products or their components, or the manufacture, sourcing, distribution or use thereof, may harm our business, operating results, financial condition and cash flows. The laws and regulations governing the manufacturing, sourcing, distribution and use of our products have become increasingly complex and stringent and costly to comply with. For example, in addition to various environmental laws relating to carbon emissions, the use and discharge of hazardous materials, and the use of certain minerals originating from identified conflict zones, many governments, including the U.S., the United Kingdom, and Australia, have adopted regulations to address the risk of human trafficking in supply chains, which govern how workers are recruited and managed.”

Annual report 2026A · The company itself

“We depend on the ability of our personnel, inventory, equipment and products to move reasonably unimpeded around the world. Any political, military, terrorism, global trade, pandemic, widespread health or other issue that hinders this movement or restricts the import or export of materials could lead to significant business disruptions.”

Annual report 2026A · The company itself

“Risks Related to Our Business and Industry Global economic and geopolitical conditions may adversely affect our industry, business operations, and financial performance, including our revenue growth, profitability, financial condition and cash flows.”

Annual report 2026A · The company itself

“We are exposed to the credit and non-payment risk of our customers, resellers and distributors, especially during times of economic uncertainty and tight credit markets, which could result in material losses. Most of our sales to customers are on an open credit basis, with typical payment terms of 30 days. During periods of economic uncertainty, when access to liquidity may be limited, we may experience increased losses as more customers become unable to pay their obligations to us, either in full or in part.”

Annual report 2026A · The company itself

“If such disruptions result in cancellations of customer orders or 29 contribute to a general decrease in economic activity or corporate spending on IT, or directly impact our marketing, manufacturing, financial and logistics functions, or impair our ability to meet our customer demands, our operating results and financial condition could be materially adversely affected.”

Annual report 2026A · The company itself

“If a material cybersecurity or other security breach impacts our services, systems, supply chain, or end-user customer systems, or if stored data is improperly accessed, our business could suffer significant harm. We store and transmit, and sell products and services that store and transmit, personal, sensitive and proprietary data related to our products, our employees, customers, partners (including third-party vendors such as data centers and providers of SaaS, cloud computing, and internet infrastructure and bandwidth), and their respective customers. This data includes intellectual property, records, and personal information.”

Annual report 2026A · The company itself

“Cyber-attacks and security breaches continue to increase, and of particular concern are supply-chain attacks against software development and breaches of technology service providers. We anticipate that cyberattacks will continue to increase in the future given cyber warfare has become a consistent lever within geopolitical conflicts and increasingly leverages hacktivism.”

Annual report 2026A · The company itself

“In addition, many of our products use open-source software, which generally does not provide any warranty or contractual protection and may be susceptible to compromise and supply-chain attacks by threat actors. Further, open-source or third-party software may contain vulnerabilities, which may or may not be known at the time of our inclusion of the software in a product.”

Annual report 2026A · The company itself

“Any violation of U.S. or international customs or export control laws and other laws affecting the countries in which our products and services may be sold, distributed, or delivered could have a material adverse effect on our business, operating results, financial condition and cash flows. Due to the global nature of our business, we are subject to customs and export restrictions and regulations, including the Export Administration Regulations administered by the Commerce Department’s Bureau of Industry and Security (BIS), customs regulations overseen by U.S. Customs and Border Protection, and the trade and economic sanctions regulations administered by the Treasury Department’s Office of Foreign Assets Control (OFAC).”

Annual report 2026A · The company itself

“In addition, the U.S. has continued to expand and refine export controls, in particular with respect to China, as well as related to semiconductors and other critical technologies.”

Annual report 2026A · The company itself

“Violators of export control and sanctions laws may be subject to significant penalties, which may include significant monetary fines, criminal proceedings against them and their officers and employees, a denial of export privileges, and under U.S. law, suspension or debarment from selling products to the U.S. federal government. Our products could be diverted by third parties (including potentially our channel partners) to countries or end users under sanctions or embargo orders, despite our precautions.”

Annual report 2026A · The company itself

“Third-party component costs make up a significant portion of our product costs. These costs are difficult to manage if supplies of certain components, including NAND, become limited relative to demand or component prices rise significantly.”

Annual report 2026A · The company itself

“These risks have subjected us, and could in the future subject us, to supply constraints, price increases, and minimum purchase requirements, which could harm our business, operating results, financial condition, and cash flows. For example, we experienced inflationary pressure and supply chain constraints beginning in the second half of fiscal 2026, resulting in increased costs for memory and other components, which have adversely affected our gross margin.”

Annual report 2026A · The company itself

“We rely on a limited number of suppliers for critical product components. We depend on a limited number of suppliers for drives and other components used in assembling our products, including some single-source suppliers. This reliance has subjected us, and could in the future subject us, to price rigidity, periodic supply constraints, and challenges in producing our products with the required quality and quantities.”

Annual report 2026A · The company itself

“As a global company, our business is influenced by worldwide economic and market conditions, including, among others, rising inflation, slower growth, economic downturns or recessions, changes in fiscal and monetary policies, higher interest and tax rates, economic uncertainty, political instability, ongoing international and regional conflicts (including conflicts in the Middle East), warfare, extreme weather events and effects from climate change, natural disasters and pandemics, supply chain interruptions and shortages, changes in laws and regulations, reduced consumer confidence and spending, international trade protection measures and disputes (including economic and trade barriers, tariffs, sanctions and export controls), rapid technological changes, and the threat and potential of trade control policies and retaliatory trade control policies (including retaliatory tariffs).”

Annual report 2026A · The company itself

“Furthermore, any economic failure or other material disruption caused by natural disasters, including fires, floods, droughts, hurricanes, tornadoes, earthquakes, and volcanoes; power or water loss or shortages; environmental disasters; telecommunications or business information systems failures or break-ins and similar events could also adversely affect our ability to conduct business. As a result of climate change, we expect the frequency and impact of such natural disasters or other material disruptions to increase.”

Annual report 2026A · The company itself

“Competition We operate in markets characterized by rapid technological change, evolving customer requirements, and frequent introductions of new products, services, and business models. Customer demand continues to be influenced by cloud adoption, digital transformation initiatives, cybersecurity requirements, and increasing use of artificial intelligence and data‑driven applications. We compete in the storage, data management, and AI data pipeline markets, including on-premises infrastructure, hybrid cloud environments, and public cloud services.”

Annual report 2026A · The company itself

“As customers undertake IT transformations, leveraging modern architectures and hybrid cloud environments, they seek simpler solutions and new consumption models. This shift is directing spending towards transformational projects and architectures like flash storage, hybrid cloud, cloud storage, and IT-as-a-service.”

Annual report 2026A · The company itself

“Additionally, we use third-party service providers to provide some services to us that involve the storage or transmission of data, such as SaaS, cloud computing, and internet infrastructure and bandwidth, and they face various 24 cybersecurity threats and also may suffer cybersecurity incidents or other security breaches. Our ability to monitor these third parties’ information security practices is limited, and these third parties may not have adequate information security measures in place. In addition, supply-chain attacks have increased in frequency and severity, and third parties’ infrastructure in our supply chain or our third-party partners’ supply chains may become compromised.”

Annual report 2026A · The company itself

“Additionally, our operations and select cloud services rely on third-party cloud providers, and interruptions due to technical failures such as hardware or software issues or connectivity problems, security incidents, compliance changes, operational challenges and natural disasters could reduce our revenue due to the cloud services’ metered billing. Moreover, our concentration on a limited number of key cloud infrastructure providers carries heightened systemic risks, as a significant disruption to any of these providers could simultaneously impact multiple aspects of our operations and service delivery.”

Annual report 2026A · The company itself

“Manufacturing and Supply Chain We have outsourced manufacturing operations to third parties located in Fremont, California; San Jose, California; Laredo, Texas; Guadalajara, Mexico; Helmond, The Netherlands; Tiszaujvaros, Hungary; Taoyuan, Taiwan; and Singapore. These operations include materials procurement, commodity management, component engineering, test engineering, manufacturing engineering, product assembly, product assurance, quality control, final test, and global logistics.”

Annual report 2026A · The company itself

“As a global company, our business is influenced by worldwide economic and market conditions, including, among others, rising inflation, slower growth, economic downturns or recessions, changes in fiscal and monetary policies, higher interest and tax rates, economic uncertainty, political instability, ongoing international and regional conflicts (including conflicts in the Middle East), warfare, extreme weather events and effects from climate change, natural disasters and pandemics, supply chain interruptions and shortages, changes in laws and regulations, reduced consumer confidence and spending, international trade protection measures and disputes (including economic and trade barriers, tariffs, sanctions and export controls), rapid technological changes, and the threat and potential of trade control policies and retaliatory trade control policies (including retaliatory tariffs).”

Annual report 2026A · The company itself

“We have experienced, and may continue to experience, negative impacts on our gross margins due to rising component costs, logistics costs, tariffs and other trade barriers, and inflationary pressures. For example, we have experienced inflationary pressure and supply chain constraints beginning in the second half of fiscal 2026, resulting in increased costs for memory and other components, which have affected our gross margins.”

Annual report 2026A · The company itself

“Unfavorable macroeconomic conditions, rising interest rates, international trade protection measures and disputes (including economic and trade barriers, tariffs, sanctions and export controls), or other circumstances could lead to an economic slowdown or global recession, potentially causing failures of counterparties, including financial institutions, governments, and insurers.”

Annual report 2026A · The company itself

“Specifically, if we are unable to generate sufficient cash flows from operations or borrow sufficient funds in the future to service or refinance our debt, our business, operating results, financial condition and cash flows may be harmed.”

Annual report 2026A · The company itself

“As of April 24, 2026, we had $2.5 billion aggregate principal amount of outstanding indebtedness for our senior notes that mature at specific dates in calendar years 2027, 2030, 2032 and 2035. We may incur additional indebtedness in the future under existing credit facilities and/or enter into new financing arrangements.”

Annual report 2026A · The company itself

“Our gross margins are influenced by a variety of factors, including macroeconomic volatility, competitive pricing, customer price sensitivity, component and product design costs, inflation, foreign exchange currency fluctuations, and the volume and relative mix of revenues from product sales, software support, hardware support, and other services offerings. Factors such as increased component, labor, and transportation costs, cost of any substandard materials, pricing and discounting pressures, changes in product prices, or shifts in revenue mix and volume from different offerings could negatively impact our revenues, gross margins or earnings.”

Annual report 2026A · The company itself

“Competition for qualified employees, particularly in the technology industry, is intense. Higher compensation costs to retain and recruit qualified employees may not be offset by innovation, improved productivity or increased sales.”

Annual report 2026A · The company itself

“Many jurisdictions require companies to notify regulators or individuals of data security incidents involving certain types of personal data. In addition, regulatory requirements, including SEC cybersecurity disclosure rules, may require us to publicly disclose material cybersecurity incidents within specified timeframes.”

Annual report 2026A · The company itself

“Consolidation among suppliers, particularly within the semiconductor and storage media industries, has led to price volatility and supply constraints. When industry demand is high, supply is constrained, or the supply chain is disrupted, our suppliers may allocate volumes away from us and to others, including our competitors, who depend on many of the same suppliers as we do.”

Annual report 2026A · The company itself

“Many of our employees participate in our hybrid work program and work remotely on a part-time basis. Changes to our office environments, including the adoption of new work models and our requirements and/or expectations about when or how often certain employees work on-site or remotely may not meet the expectations of our employees, and may create challenges in attracting and retaining qualified personnel, adversely affecting our business operations and financial performance.”

Annual report 2026A · The company itself