Oracle Corporation

“Risk Factor Summary Business and Operational Risks • We may be unsuccessful in developing and selling new products and services, integrating acquired products and services and enhancing our existing products and services. • Our AI products may not operate as anticipated, which could adversely affect our reputation, revenues and profitability. • If we do not successfully execute our Oracle Cloud strategy, including our offerings of Oracle Cloud, our revenues and profitability may decline. • If we are unable to secure data center capacity at affordable rates or do not accurately plan for and manage our infrastructure capacity requirements, our profitability may decline. • Our cloud offerings and hardware offerings are complex, and if we cannot successfully manage this complexity, including the sourcing of technologies and components, the results of these businesses will suffer.”

Annual report 2026A · The company itself

“If we are unable to introduce new AI products, or if our AI products fail to operate as anticipated or as well as competing products or otherwise do not meet customer needs, if our competitors’ AI products achieve higher market acceptance than ours, or if we incur costs higher than expected to build and support our AI products, we may fail to recoup our investments in AI and our business and reputation may be harmed.”

Annual report 2026A · The company itself

“In addition, the adoption and deployment of AI technologies across our operations have resulted, and may continue to result, in reductions to our workforce. These types of restructurings have resulted, and may in the future result, in increased restructuring costs and reduced productivity.”

Annual report 2026A · The company itself

“Evolving restrictions and rules governing access to cloud-based infrastructure or GPU-enabled services by customers in certain jurisdictions, could require additional compliance controls or limit our ability to provide, lease, host or otherwise make available such resources to affected customers.”

Annual report 2026A · The company itself

“Oracle cloud offerings include Oracle Cloud Applications (OCA) and Oracle Cloud Infrastructure (OCI, and collectively with OCA, Oracle Cloud), which provide comprehensive and integrated applications and infrastructure services, enabling our customers to choose the best option that meets their specific business needs.”

Annual report 2026A · The company itself

“Our investments in and innovation with respect to Oracle products and services that we offer through our three businesses (cloud and software, hardware and services businesses, described further below) are another important element of our corporate strategy. In fiscal 2026, 2025 and 2024, we invested $10.3 billion, $9.9 billion and $8.9 billion, respectively, in research and development to enhance our existing portfolio of offerings and to develop new technologies and services.”

Annual report 2026A · The company itself

“If we do not successfully execute our Oracle Cloud strategy, including our offerings of Oracle Cloud, our revenues and profitability may decline. We provide our cloud and other offerings to customers worldwide via a variety of deployment models, including via our cloud-based OCA and OCI offerings.”

Annual report 2026A · The company itself

“We believe that continued investment in research and development is essential to maintaining our competitive position. However, our investments in research and development may fail to yield competitive products and services and we do not expect to receive significant revenues from these investments for several years, if at all.”

Annual report 2026A · The company itself

“Business Oracle provides products and services that build, run and support enterprise information technology (IT) frameworks. Our products and services include enterprise applications and infrastructure offerings that incorporate and are enhanced by artificial intelligence (AI) technologies, including embedded AI-driven automation and analytics and generative AI capabilities.”

Annual report 2026A · The company itself

“Our AI products may not operate as anticipated, which could adversely affect our reputation, revenues and profitability. Machine learning and AI, including generative AI, agentic AI and LLMs, are increasingly driving innovations in technology, and AI technology and services are highly competitive and rapidly evolving. We are building AI into many of our product offerings and we are also making AI available for our customers to use in solutions that they build.”

Annual report 2026A · The company itself

“Our cloud and software business engages in the sale, marketing and delivery of our enterprise applications and infrastructure technologies through cloud and on-premise deployment models, including our cloud offerings and our software offerings.”

Annual report 2026A · The company itself

“We depend on suppliers to develop, manufacture and deliver on a timely basis the necessary technologies and components for our hardware products that we market and sell to our customers and that we use as a part of our cloud infrastructure to deliver our cloud offerings, and there are some technologies and components that can only be purchased from a single vendor due to price, quality, technology, availability or other business constraints. Our supply chain operations are affected by industry consolidation and component constraints or shortages, natural disasters, political unrest (such as conflicts in the Middle East and the tensions between China and Taiwan), public health crises, changes to trade laws or regulations, tariffs and customs controls, port stoppages, shipping interruptions or other transportation disruptions or slowdowns, and other factors affecting the countries or regions where these single source component vendors are located or where the products are being shipped.”

Annual report 2026A · The company itself

“For example, industry supply capacity for AI accelerators, including graphics processing units, as well as memory devices, is competitive, and we at times have to accept less favorable terms with suppliers to minimize supply constraints. While this permits us to secure cloud infrastructure capacity, it has increased excess and obsolescence risk of such hardware products and could adversely impact our profitability and cash flows.”

Annual report 2026A · The company itself

“Table of Contents Oracle hardware products include Oracle Engineered Systems, servers, storage and industry-specific products, among others. Customers generally opt to purchase hardware support contracts when they purchase Oracle hardware products.”

Annual report 2026A · The company itself

“Our hardware business provides infrastructure technologies including Oracle Engineered Systems, servers, storage, industry-specific hardware, operating systems, virtualization, management and other hardware-related software to support diverse IT environments.”

Annual report 2026A · The company itself

“Table of Contents Our products and services may not function properly if we experience significant coding, manufacturing or configuration errors in our cloud, software and hardware offerings. Despite testing prior to the release and throughout the lifecycle of a product or service, our cloud, software and hardware offerings sometimes contain coding, manufacturing or configuration errors that can impact their function, performance and security, and result in other negative consequences.”

Annual report 2026A · The company itself

“Our products and services, including Oracle Cloud, store, retrieve, process and manage third-party data, such as our customers’ data, as well as our own data.”

Annual report 2026A · The company itself

“If we do not successfully execute our Oracle Cloud strategy, including our offerings of Oracle Cloud, our revenues and profitability may decline. We provide our cloud and other offerings to customers worldwide via a variety of deployment models, including via our cloud-based OCA and OCI offerings.”

Annual report 2026A · The company itself

“These models include cloud-based, on-premise and hybrid deployments, such as Oracle Exadata Cloud@Customer and multicloud options that enable customers to use Oracle cloud offerings in conjunction with other public clouds.”

Annual report 2026A · The company itself

“For example, we offer our customers multicloud services whereby our customers can combine cloud services from multiple clouds with the goal of optimizing cost, functionality and performance. OCI’s multicloud services work with a number of our competitors’ products, including Microsoft Azure, Amazon Web Services and Google Cloud.”

Annual report 2026A · The company itself

“Business Oracle provides products and services that build, run and support enterprise information technology (IT) frameworks. Our products and services include enterprise applications and infrastructure offerings that incorporate and are enhanced by artificial intelligence (AI) technologies, including embedded AI-driven automation and analytics and generative AI capabilities.”

Annual report 2026A · The company itself

“Our cloud and software business engages in the sale, marketing and delivery of our enterprise applications and infrastructure technologies through cloud and on-premise deployment models, including our cloud offerings and our software offerings.”

Annual report 2026A · The company itself

“If our cloud infrastructure buildout takes longer than expected, our cloud revenue forecasts will be affected.”

Annual report 2026A · The company itself

“Our data center expansion depends on access to suitable, permitted build sites; reliable and predictable power sources; networking hardware; and server availability, including graphics processing units, memory devices and other critical components. Data centers in geographies that we rely on may be unavailable on commercially reasonable terms or at all.”

Annual report 2026A · The company itself

“To grow our OCI business, which requires increased computing capacity, we must incur significant capital and operating expenditures to increase our existing data center capacity and to establish data centers in new geographic locations. In connection with these investments, we have entered, and expect to continue to enter, into long-term lease commitments with third-party data center providers and other significant commitments with suppliers of chips and other data center infrastructure.”

Annual report 2026A · The company itself

“Additionally, we have approximately 181 data center locations globally, substantially all of which are leased and used to deliver our Oracle Cloud offerings.”

Annual report 2026A · The company itself

“Negative publicity may damage our reputation and expose us to regulatory scrutiny. Table of Contents Complying with healthcare industry regulations globally is expensive and could subject us to unanticipated and significant delays or disruption to availability of our health products/services.”

Annual report 2026A · The company itself

“Our global customer base includes businesses of various sizes and industries, government agencies, educational institutions and resellers that we market and sell to directly through our worldwide sales force or indirectly through the Oracle Partner Network.”

Annual report 2026A · The company itself

“The healthcare industry is highly regulated, and thus, we are subject to several laws, regulations and industry initiatives, non-compliance with certain of which could adversely affect our healthcare business. As a participant in the healthcare industry, certain of our products, operations and relationships, and those of our customers, are regulated by several U.S. federal, state, local and foreign governmental entities. These regulations impact us both directly and indirectly, including government program requirements applicable to our customers for the use of health IT.”

Annual report 2026A · The company itself

“Our global customer base includes businesses of various sizes and industries, government agencies, educational institutions and resellers that we market and sell to directly through our worldwide sales force or indirectly through the Oracle Partner Network.”

Annual report 2026A · The company itself

“Our sales to local, state, federal and foreign government customers expose us to business volatility and risks, including government budgeting cycles and appropriations, government shutdowns, procurement regulations, governmental policy shifts, early termination of contracts, audits, investigations, sanctions and penalties. We derive revenues from contracts with the U.S. government, state and local governments, and foreign governments and are subject to procurement laws relating to the award, administration and performance of those contracts.”

Annual report 2026A · The company itself

“Our global customer base includes businesses of various sizes and industries, government agencies, educational institutions and resellers that we market and sell to directly through our worldwide sales force or indirectly through the Oracle Partner Network.”

Annual report 2026A · The company itself

“Our global customer base includes businesses of various sizes and industries, government agencies, educational institutions and resellers that we market and sell to directly through our worldwide sales force or indirectly through the Oracle Partner Network.”

Annual report 2026A · The company itself

“Our business practices with respect to data could give rise to operational interruption, liabilities or reputational harm as a result of governmental regulation, legal requirements or industry standards relating to privacy and data protection. As regulatory focus on privacy issues continues to increase and worldwide laws and regulations concerning the handling of personal information expand and become more complex and stringent, potential risks related to data collection and use within our business will intensify. In addition, U.S. federal and state as well as foreign governments have enacted or are considering enacting legislation or regulations, or may in the near future interpret existing legislation or regulations, in a manner that could significantly impact our ability, as well as the ability of our customers, partners and data providers, to collect, augment, analyze, use, transfer (including across national borders) and share personal and other information that is integral to certain services we provide.”

Annual report 2026A · The company itself

“Any failure, or perceived failure, by us to comply with these public statements or with U.S. federal, state, or foreign laws and regulations, including laws and regulations regulating privacy, data security, or consumer protection, public perception, standards, self-regulatory requirements or legal obligations, could result in lost or restricted business, proceedings, actions or fines brought against us or levied by governmental entities or others, or could adversely affect our business and harm our reputation.”

Annual report 2026A · The company itself

“Our cloud and hardware operations are subject to extensive, evolving and sometimes inconsistent state, federal and international regulations related to ESG matters. Some of these regulations establish specific metrics, targets, and disclosure frameworks for a variety of ESG issues, including environmental sustainability, supply chain labor practices, workforce health and safety, proper handling and disposal of certain chemicals and materials, and local testing and labeling requirements. Regulatory, market, carbon tax and competitive pressures regarding the greenhouse gas emissions and energy mix for our data center operations have increased and are expected to continue to increase.”

Annual report 2026A · The company itself

“Compliance with these ever-changing and sometimes divergent ESG laws in a timely manner could increase our product design, development, procurement, manufacturing, delivery, cloud operations, insurance premiums and administration costs, limit our ability to manage excess and obsolete inventory, change our sales activities, or otherwise impact future financial results of our cloud and hardware businesses.”

Annual report 2026A · The company itself

“If we fail to meet these goals, or are perceived as failing to meet our ESG goals, our revenues, reputation and brand may be harmed.”

Annual report 2026A · The company itself

“We believe that Oracle has been and is a target for computer hackers, cyberattacks and other perpetrators or threat actors because Oracle stores and processes large amounts of data, including sensitive data such as health sciences (including patient health information), financial services, retail, hospitality, telecommunications and government data. We and our third-party vendors are regularly subject to attacks by third parties (which may include individuals or groups of hackers and sophisticated organizations, such as state-sponsored organizations, nation-states and individuals sponsored by them) designed to identify and exploit product and service vulnerabilities, penetrate or bypass our security measures, and gain unauthorized access to our or our customers’, partners’ and suppliers’ software, hardware and cloud offerings, networks and systems.”

Annual report 2026A · The company itself

“When a cyberattack or other security event or incident results in unauthorized access to, or modification, loss, destruction or exfiltration of, our customers’ or suppliers’ data, other external data, our own data or our IT systems, or if the services we provide to our customers are disrupted, or if our products or services are reported to have (or are perceived as having) security vulnerabilities, we have incurred and may continue to incur significant expenses 24 Table of Contents and may suffer substantial damage to our brand and reputation. If our customers lose confidence in the security and reliability of our products and services, including our cloud offerings, they may reduce or terminate their spending with us.”

Annual report 2026A · The company itself

“Changes in government procurement policy, priorities, regulations, technology initiatives and/or requirements may negatively impact our potential for growth in the government sector. For example, the U.S. government imposes evolving cybersecurity requirements, including the FedRAMP authorization process and the Department of War (DoW) Cybersecurity Maturity Model Certification.”

Annual report 2026A · The company itself

“Our products operate in conjunction with and are dependent on a wide variety of third-party products, components and services. If a security vulnerability exists in one of these components, a targeted exploit could lead to increased costs, liability claims, customer dissatisfaction, reduced revenues, or harm to our reputation or competitive position, including as a result of business interruption, data loss or unauthorized access to, or disclosure of, data.”

Annual report 2026A · The company itself

“If we are unable to secure data center capacity at affordable rates or do not accurately plan for and manage our infrastructure capacity requirements, our profitability may decline.”

Annual report 2026A · The company itself

“We have faced, and may continue to face, challenges with securing reliable and cost-effective power sources for our data center energy demands, which are constrained globally due to the significant increase in demand for and limited availability of energy to power AI compute. These constraints on available power sources could disrupt operations at affected data centers or restrict our capacity to grow, adversely impacting our business, operating results, financial condition and prospects.”

Annual report 2026A · The company itself

“In addition, power prices can be volatile, including due to extreme weather events and market structure in certain regions, and increases in energy costs can adversely affect our margins, particularly where customer pricing is fixed or committed.”

Annual report 2026A · The company itself

“Some of our indebtedness may bear interest at variable rates, and increases in interest rates could increase our debt service obligations.”

Annual report 2026A · The company itself

“In addition, changes in interest rates could adversely affect the economics of certain long-term commitments or customer arrangements, particularly where pricing is fixed or committed.”

Annual report 2026A · The company itself

“Furthermore, if prevailing interest rates or other factors at the time of refinancing result in higher interest rates upon refinancing, then the interest expense relating to that refinanced indebtedness would increase.”

Annual report 2026A · The company itself

“As a participant in the healthcare industry, certain of our products, operations and relationships, and those of our customers, are regulated by several U.S. federal, state, local and foreign governmental entities. These regulations impact us both directly and indirectly, including government program requirements applicable to our customers for the use of health IT. There are significant, wide-ranging and rapidly evolving regulations worldwide, covering healthcare fraud, information sharing, e-prescribing, medical claims processing and transmission, healthcare devices, the use of AI in healthcare, the security and privacy of patient data and interoperability standards, that may be directly or indirectly applicable to our products, operations and relationships or the business practices of our customers.”

Annual report 2026A · The company itself

“Certified electronic health record technology (CEHRT) requirements continue to evolve and remain necessary to participate in federal healthcare programs to receive reimbursement for health items and services provided by certain of our customers to Medicare and Medicaid beneficiaries. Certification involves complex and specific requirements related to various types of requests for the access, exchange or use of Electronic Health Information.”

Annual report 2026A · The company itself

“General Risks • Economic, political and market conditions can adversely affect our business, results of operations and financial condition, including our revenue growth and profitability, which in turn could adversely affect our stock price. • Significant events in certain geographic locations could adversely affect our operating results and disrupt our business.”

Annual report 2026A · The company itself

“Changes to sanctions or export control regulations or their enforcement in the U.S. and the other jurisdictions where we currently operate or have dealings, or in the future may operate or have dealings, can require suspension or termination of business (including financial transactions) in or with certain countries and territories or with certain customers.”

Annual report 2026A · The company itself

“In the technology industry, especially in the AI field, competition for highly skilled business, product development and technical personnel is intense and ongoing. For example, in recent years, recruiting, hiring and retaining employees with expertise in the AI computing industry has become increasingly difficult as the demand for AI computing infrastructure has increased as a result of the increase in AI and machine learning development, deployment and demand.”

Annual report 2026A · The company itself

“We may also face rising compensation costs without corresponding gains in productivity or sales.”

Annual report 2026A · The company itself

“Our international sales and operations and global customer base subject us to additional risks, including trade restrictions, export controls and sanctions, that can adversely affect our operating results. We derive a substantial portion of our revenues from, and have significant operations, outside of the U.S., and in both our U.S. and non-U.S. operations we serve customers based in or with ties to numerous jurisdictions around the world. Compliance with international and U.S. laws and regulations that apply to our international operations increases our cost of doing business.”

Annual report 2026A · The company itself

“Changes to sanctions or export control regulations or their enforcement in the U.S. and the other jurisdictions where we currently operate or have dealings, or in the future may operate or have dealings, can require suspension or termination of business (including financial transactions) in or with certain countries and territories or with certain customers.”

Annual report 2026A · The company itself

“Changes in the values of major foreign currencies, particularly the Australian Dollar, British Pound, Brazilian Real, Canadian Dollar, Euro, Indian Rupee, Japanese Yen and Saudi Riyal, relative to the U.S. Dollar can significantly affect our total assets, revenues, operating results and cash flows, which are reported in U.S.”

Annual report 2026A · The company itself

“Our principal currency exposures include the Australian Dollar, Brazilian Real, British Pound, Euro, Indian Rupee, Japanese Yen and Saudi Riyal.”

Annual report 2026A · The company itself

“Sensitivity Analysis The following table sets forth the hypothetical potential losses that we consider to be the most material to the reported fair values and/or future earnings of our foreign currency influenced holdings, prior to any income tax effects, resulting from hypothetical changes in relevant market rates as of or for the reporting periods below: Year Ended May 31, (in millions) Hypothetical Change Impact 2026 2025 Foreign currency risk: Total revenues 10% decrease in foreign currency exchange rates Earnings $ (2,767 ) $ (2,379 ) Cash, cash equivalents and trade receivables, net 10% decrease in foreign currency exchange rates Fair values $ (2,384 ) $ (1,788 ) Item 8.”

Annual report 2026A · The company itself

“If our competitors offer deep discounts on certain products or services or develop products that the marketplace considers more valuable, we may need to lower prices, introduce pricing models and offerings or offer other terms that are less favorable to us to compete successfully. Any such changes may reduce revenues and margins and could adversely affect operating results.”

Annual report 2026A · The company itself

“If we underestimate customer demand or our data center capacity needs, we may face shortages of available infrastructure, limiting our ability to support customer growth and potentially causing us to lose business to competitors. Conversely, if we overestimate customer demand or any of our key customers are unable to pay or 18 Table of Contents otherwise perform under their contracts with us, we could be locked into multi-year commitments for excess data center space and related capital expenditures, as well as associated financings, without receiving corresponding revenue.”

Annual report 2026A · The company itself

“We outsource most of our manufacturing, assembly, delivery and technology of, and certain component designs for, our hardware products to a variety of companies, many of which are located outside the U.S. From time to time, these partners experience production problems or delays or cannot meet our demand for products on a timely or cost-effective basis, including as a result of changes to trade laws or regulations, tariffs, sanctions and export or import controls.”

Annual report 2026A · The company itself

“Costs associated with our hardware business include the cost of hardware products, which consists of expenses for materials and labor used to produce these products by our internal manufacturing operations or by third-party manufacturers; the cost of materials used to repair customer products with eligible support contracts; the cost of labor and infrastructure to provide support services; and sales and marketing expenses, which are largely personnel-related and include variable compensation earned by our sales force for the sales of our hardware offerings.”

Annual report 2026A · The company itself

“Our ability to build and operate data centers also may be affected by existing and evolving laws, regulations and policies relating to land use and zoning, environmental permitting, energy usage, grid reliability, greenhouse gas emissions, water usage, building codes, health and safety, tax incentives and data localization. These requirements, or changes in their interpretation or enforcement, could increase our capital and operating costs, delay or prevent planned projects, limit where or how we build or operate data centers, or adversely affect our ability to meet customer commitments and anticipated demand.”

Annual report 2026A · The company itself

“The variety of risks and challenges listed above could also disrupt or otherwise negatively impact our supply chain operations and sales of our products and services in affected countries or regions.”

Annual report 2026A · The company itself

“Our principal currency exposures include the Australian Dollar, Brazilian Real, British Pound, Euro, Indian Rupee, Japanese Yen and Saudi Riyal.”

Annual report 2026A · The company itself