AI regulation

“In January 2025, BIS issued a final rule, commonly referred to as the “AI Diffusion Rule,” that would have imposed new restrictions on the export, reexport and in-country transfer of certain advanced semiconductor devices and technology. In May 2025, BIS announced its intention to rescind the AI Diffusion Rule, publish a regulation formalizing the rescission, and issue replacement rules in the future. The replacement rules may limit our ability to engage in certain business transactions, require new export licenses, delay shipments, or necessitate changes in our compliance processes and product designs to ensure regulatory compliance.”

Annual report 2025A · The company itself

“Given the complexity and rapid development of AI, there are various current and proposed regulatory frameworks relating to the use of AI in products and services. For example, the EU AI Act was adopted in 2024 and its implementation will be phased in over the next few years.”

Annual report 2025A · The company itself

“Such laws and regulations may impede our ability to offer certain products and services in certain jurisdictions if we are unable to comply with them. We expect that the legal and regulatory environment relating to emerging technologies such as AI will continue to develop and could increase costs and burdens to us and our customers, delay or halt deployment of new systems using our products, reduce the number for entrants and customers and create compliance risks and potential liability, all which may have a material adverse effect on our financial condition and results of operations.”

Annual report 2025A · The company itself

“As with many new emerging technologies, AI presents risks and challenges and increasing legal, social and ethical concerns relating to its responsible use that could affect the adoption of AI, and thus our business. Third-party misuse of AI applications, models, or solutions, or ineffective or inadequate AI development or deployment practices by us or our customers, could cause harm to individuals or society and impair the public’s acceptance of AI.”

Annual report 2025A · The company itself

“Moreover, we may be subject to competitive harm, regulatory action and legal liability as a result of new and proposed legislation regulating AI, as well as new applications of existing data protection, privacy and intellectual property and other laws. Such regulations and changes thereto could cause us to incur greater compliance costs, could impact our ability to sell or the ability of our customers and users worldwide to acquire, deploy and use systems that include our AI-related products and services and reduce the number of customers, which could negatively impact our business and financial results.”

Annual report 2025A · The company itself

“Compliance with Laws and Regulations, Litigation and Disputes We are subject to a wide variety of laws, regulations, and rules applicable to short-term rental, experiences, services, long-term rental, and home sharing businesses, or that govern our business practices, including among others, e-commerce, data privacy and cybersecurity, artificial intelligence, payment services, advertising, consumer protection, employment, licensing requirements, and commercial practices. Such laws and regulations are complex, evolving, and sometimes inconsistent and have limited and may continue to limit the ability or willingness of new or existing hosts to list on our platform. These regulations may expose our users or us to regulatory inquiries, litigation, and/or other disputes and to potentially significant liabilities, including taxes, compliance costs, fines, and criminal or other penalties, which have had and could continue to have a material effect on our business, results of operations, and financial condition.”

Annual report 2025A · The company itself

“We are subject to laws and regulations governing our business practices, the Internet, e-commerce, and electronic devices, including those relating to taxation, data privacy, cybersecurity, pricing, content, advertising, discrimination, consumer protection, protection of minors, insurance, copyrights, distribution, messaging, mobile communications, electronic device certification, electronic waste, electronic contracts, communications, Internet access, licensing requirements, competition, AI, and unfair commercial practices as well as federal, state, local, and foreign laws regulating employment, employee working conditions, including wage and hour laws, employment dispute and employee bargaining processes, collective and representative actions, employment classification, and other employment compliance requirements. Violation of these laws could subject us to fines and penalties, including in some cases, criminal penalties, and requirements to change our business practices.”

Annual report 2025A · The company itself

“Increased regulatory interest in technology companies, particularly regarding AI, data privacy, consumer protection, competition, pricing, and sustainability, could lead to further compliance challenges. New or changing laws could impose significant costs and liabilities, affecting our business operations and financial condition.”

Annual report 2025A · The company itself

“The U.S. government, including Congress, the FTC, the CFPB, and the Department of Commerce, has announced that it is reviewing the need for greater regulation for the collection of information concerning personal data processing practices and consumer behavior on the Internet, including regulation aimed at restricting certain targeted advertising practices. In addition, numerous states have enacted or are in the process of enacting state level data privacy laws and regulations governing the processing of state residents’ personal data that have 22 Table of Contents and may continue to require us to modify our data processing practices and policies and incur related costs and expenses.”

Annual report 2025A · The company itself

“We are also subject to evolving privacy laws on cookies, tracking technologies, and e-marketing. In the European Union and United Kingdom, informed consent is required for the placement of certain cookies or similar tracking technologies on an individual’s device and for direct electronic marketing.”

Annual report 2025A · The company itself

“Further, the DSA governs, among other things, our potential liability for illegal services/products or content on our platform, obligations around traceability of business users, and requires enhanced transparency measures. In particular our obligations to diligence the services offered on our platform could require significant additional resources.”

Annual report 2025A · The company itself

“Similarly, in the United Kingdom, the Online Safety Act 2023 (the “OSA”) establishes an extensive regulatory framework for certain user-to-user and search services and imposes obligations to protect users from illegal content. The DSA, and the OSA may increase our compliance costs, expose us to potential regulatory action and liability, require further changes to our user interfaces, processes, operations, and business practices, which may adversely affect our ability to attract, retain, and provide our services to customers, and may otherwise adversely affect our business, results of operations, and financial condition.”

Annual report 2025A · The company itself

“Compliance with numerous and often contradictory requirements of different jurisdictions is particularly difficult for an online business such as ours, which collects personal information from hosts, guests, and other individuals in multiple jurisdictions. If any jurisdiction in which we operate adopts new laws or changes its interpretation of its laws, rules, or regulations relating to data residency or localization such that we are unable to comply in a timely manner or at all, we could risk losing our rights to operate in such jurisdictions.”

Annual report 2025A · The company itself

“In addition, certain existing legal regimes including those related to data privacy, competition, and consumer protection, may also regulate certain aspects of AI and ML Technologies, and new laws may be adopted and interpreted in ways 24 Table of Contents that would limit our ability to use AI and ML Technologies. This may affect our use of AI and ML Technologies and our ability to provide, improve or commercialize our services effectively and efficiently and result in increased costs.”

Annual report 2025A · The company itself

“Several states – such as California, Colorado, Connecticut, and Texas – have enacted or proposed laws governing the development and deployment of AI and ML Technologies at varying degrees, typically focused on high-risk uses of AI. Many U.S. states continue to advance various AI regulatory frameworks, including requirements around transparency, risk management, and accountability for AI and ML Technologies.”

Annual report 2025A · The company itself

“Further, the EU Artificial Intelligence Act (the “EU AI Act”) entered into force in August 2024 (with the majority of substantive requirements applying from August 2026), and establishes a broad, risk-based governance framework for AI use, development, or provision in the EU market. Applicable requirements depend on the risk level of each AI use case, and actual or perceived contraventions could expose us to material penalties, significant legal liability, and may materially adversely affect our business, results of operations, and financial condition.”

Annual report 2025A · The company itself

“With regard to China, the regulatory requirements on AI and ML Technologies, export controls and other relevant regulations are still evolving and have ongoing complexity and uncertainty. The positions and interpretation of these regulations by the authorities may not align with our interpretation or may not be consistent across jurisdictions, which may impact our ability, or require additional resources (which may be substantial), to develop and/or maintain related product features.”

Annual report 2025A · The company itself

“As a result, implementation standards, enforcement practices, and available scope of protection are likely to remain uncertain for the foreseeable future, and we cannot yet determine the impact future laws, regulations, or standards may have on our business (including our positioning with respect to our competition) and may not be able to anticipate how to respond to these laws or regulations.”

Annual report 2025A · The company itself

“While we rely on legal exemptions and protections like the DMCA and CDA in the United States and the E-Commerce Directive and the DSA in the European Union, varying laws and interpretations regarding immunity and responsibility across jurisdictions may limit these exemptions or defenses or create uncertainty regarding liability for information or content uploaded by hosts, guests, or other third parties.”

Annual report 2025A · The company itself

“In the United States, changes to the CDA could reduce protections for online platforms. In the European Union, the DSA brings additional compliance requirements and potential fines.”

Annual report 2025A · The company itself

“Other regions, such as Asia and Latin America, have or are developing regulations that could impose direct or secondary liability on platforms for harmful content.”

Annual report 2025A · The company itself

“The EU Consumer Rights Directive and the Unfair Commercial Practices Directive, the United Kingdom Digital Market, Competition and Consumers Act 2024 (“DMCCA”), and national consumer laws impose strict consumer protection requirements, with potential fines for non-compliance and in the case of the DMCCA, an increased risk of enforcement by the UK regulator in light of enhanced powers. Consumers and certain Consumer Protection Associations may bring individual claims against us, and the Collective Redress Directive allows for class actions across the European Union, increasing our litigation risk.”

Annual report 2025A · The company itself

“Further, the rapid evolution of AI combined with the uncertain, rapidly evolving and often inconsistent regulatory landscape may require significant additional resources and costs and could in some cases limit our ability to implement AI capabilities in our solutions or to use AI to support business operations.”

Annual report 2025A · The company itself

“In Europe, the EU began implementing the Artificial Intelligence Act (the "AI Act") on August 1, 2024, with significant provisions scheduled to take effect in August 2026. The AI Act, which may be amended as part of the EU's Digital Omnibus, imposes significant obligations on providers and deployers of high-risk AI systems, and non-compliance can lead to substantial fines. If we develop or use AI systems governed by these laws or regulations, we may face burdensome and costly compliance obligations relating to data quality, transparency, human oversight, and ethical and administrative requirements, as well as significant enforcement actions or litigation in the event of any perceived non-compliance.”

Annual report 2025A · The company itself

“In addition, enactment and expansion of laws related to the use of AI and machine learning in our operations and increased regulation of cloud service providers also could increase the costs of doing business, subject us to potential liability or regulatory risk and introduce other disadvantages to our business, including brand or reputational harm. U.S. states have advanced and, in some cases, enacted numerous AI governance laws, creating a complicated legislative patchwork that may be litigated in state and federal courts, notwithstanding a December 2025 executive order endorsing a federal moratorium on enforcement of state AI laws.”

Annual report 2025A · The company itself

“Government Regulation We are subject to numerous United States (US) federal, state, and local, as well as foreign laws, and regulations covering a wide variety of subjects, and the scope of this coverage continues to broaden with continuing new legal and regulatory developments in the US and internationally. Like other companies in the technology industry, we face increasingly heightened scrutiny from both US and foreign governments with respect to our compliance with laws and regulations. Many of these laws and regulations are evolving and their applicability and scope, as interpreted by the courts, remain uncertain. Particularly with regard to AI; competition; consumer protection; content moderation, including access restrictions for minors; data privacy and security; intellectual property; news publications; and sustainability and other social matters, we have seen an increase in new and evolving laws and regulations, as well as related enforcement actions and investigations, being proposed and implemented in recent years by legislative and regulatory bodies around the world.”

Annual report 2025A · The company itself

“We are subject to numerous US federal and state as well as foreign laws and regulations covering a wide variety of subjects, and our introduction of new businesses, products, services, and technologies will likely continue to subject us to additional laws and regulations. In recent years, governments around the world have proposed and adopted a large number of new laws and regulations relevant to the digital economy, particularly in the areas of data privacy and security, competition, AI, and online content.”

Annual report 2025A · The company itself

“For example, the EU AI Act came into force on August 1, 2024, and will generally become fully applicable after a two-year transitional period (although certain obligations have already taken effect). The EU AI Act introduces various requirements for AI systems and models placed on the market in the EU, including specific transparency, safety, and copyright requirements for general purpose AI systems and the models on which those systems are based.”

Annual report 2025A · The company itself

“•Content moderation: Various laws covering content moderation and removal, and related disclosure obligations, such as the EU's Digital Services Act, Florida's Senate Bill 7072 and Texas' House Bill 20, and laws and proposed legislation in Singapore, Australia, and the United Kingdom (UK) that impose penalties for failure to remove certain types of content or require disclosure of information about the operation of our services and algorithms, which may make it harder for services like Google Search and YouTube to detect and limit low-quality, deceptive, or harmful content, or, on the other hand, may impinge on the rights of free expression and access to content. Additionally, new regulations apply to online child safety, including access and content restrictions as well as other limitations for minors, which may also conflict with rights of free expression and access to information.”

Annual report 2025A · The company itself

“Compliance with Government Regulation We are subject to various federal, state, and international laws and regulations that affect companies conducting business on mobile platforms, including with respect to intellectual property, securities, privacy, data protection, consumer protection, competition, tax, labor and employment, and commercial and other matters in the United States, Europe, and around the world. Additional laws and regulations relating to these areas likely will be passed in the future, and these or existing laws and regulations may be interpreted or enforced in new or expanded manners.”

Annual report 2025A · The company itself

“We are subject to a variety of laws in the United States and abroad, and it is possible that a number of laws and regulations may be adopted or construed to apply to us in the United States and elsewhere that could affect our business and restrict the advertising ecosystem or development of our technologies, including state and federal laws regarding antitrust, consumer protection, electronic marketing, protection of minors, data protection, privacy, communications, content suitability, distribution, competition, taxation, intellectual property, machine learning and AI, money transmission, money laundering, investment screening, sanctions, export, national security, and climate change, which are continuously evolving and developing and any such policy and regulatory changes could impose operational and compliance burdens.”

Annual report 2025A · The company itself

“As our advertising solutions grow and evolve, including through the use of and integration of AI technologies, and are used in a greater number of countries and on a larger scale, we may also become subject to new laws and regulations in additional jurisdictions or jurisdictions may claim that we are required to comply with their laws and regulations. The regulation of AI technologies is a relatively new and evolving area of law which we may become subject to as we continue to explore the use of AI technologies in our current and future products.”

Annual report 2025A · The company itself

“We also cannot be certain that existing intellectual property laws will provide adequate protection for our products in connection with emerging technologies. For example, laws relating to intellectual property ownership and license rights, including copyright, with respect to AI and the use of tools containing AI have not been fully interpreted by U.S. courts or been fully addressed by federal and state regulations. As a result, our ability to fully protect our products, technologies and solutions under current and future legal regimes, especially as it relates to AI tools and technologies, may be limited or impacted by future laws, regulations, interpretations or other legislative or judicial actions.”

Annual report 2025A · The company itself

“We also expect to be subject to a variety of laws and regulations governing AI, such as the E.U. AI Act which was enacted in 2024 and will gradually enter into force during the next two years, the Colorado AI Act, and the California AI Transparency Act. Further, the issuance of the President‘s AI Executive Order entitled “Ensuring a National Policy Framework for Artificial Intelligence” introduces significant uncertainty in the regulatory landscape for AI across the United States. This uncertainty may lead to a fragmented regulatory environment, complicating compliance efforts, increasing operational risks, and potentially impacting the company’s ability to adapt to evolving legal and regulatory requirements.”

Annual report 2025A · The company itself

“There is also significant uncertainty in the evolving regulatory regime relating to AI, which may require substantial resources to modify and maintain business practices to comply with U.S. and non-U.S. laws. For example, various states have adopted the NAIC’s model bulletin, The Use of Artificial Intelligence Systems by Insurers; and internationally, the European Union Artificial Intelligence Act entered into force in August 2024 with phased obligations. Evolving obligations may negatively impact our development and use of AI in our business and may subject us to regulatory scrutiny, litigation, increased compliance costs, and social and ethical concerns.”

Annual report 2025A · The company itself

“The scope and interpretation of these laws and additional laws that are or may be applicable to us are continuously evolving, often uncertain and may be conflicting, particularly with respect to foreign laws. All of these evolving compliance and operational requirements, including restrictions on cross-border data transfers, impose significant costs that are likely to increase over time and may restrict the way services involving data are offered, all of which may adversely affect our results of operations.”

Annual report 2025A · The company itself

“However, legislation that governs the development and/or use of AI has been adopted or is under consideration in the U.S. at the state and local level, as well as abroad, most notably the European Union’s Artificial Intelligence Act. In addition, self-regulatory frameworks like the National Institute of Standards and Technology AI Risk Management Framework are being promulgated and adherence to these may become an industry standard or a client expectation.”

Annual report 2026A · The company itself

“Table of Contents Privacy and AI Regulation We are subject to evolving U.S. and foreign laws governing the collection, processing, storage, and transfer of personal and sensitive information, as well as the development and deployment of AI systems. AI capabilities are integrated across our product portfolio, and we market AI-enabled functionality to customers as part of our long-term product strategy.”

Annual report 2025A · The company itself

“For example, the AI Act in the European Union imposes compliance requirements on a variety of AI uses by law enforcement, as well as on the companies that develop those products, including us.”

Annual report 2025A · The company itself

“Further, evolving and inconsistent legal frameworks governing AI across different jurisdictions, such as the EU AI Act, other international regimes, and emerging U.S. state regulations may create conflicting compliance obligations, all of which may impose additional costs on us, increase our risk of liability and fines, and may require us to modify, limit, or withdraw certain AI-enabled products or services in particular markets, and adversely affect our ability to scale globally.”

Annual report 2025A · The company itself

“The CCPA, as amended, imposes stringent data privacy and data protection requirements relating to personal information of California residents, and provides for penalties for noncompliance of up to $7,500 per violation.”

Annual report 2025A · The company itself

“Our implementation of AI systems could result in legal liability, regulatory action, brand, reputational, or competitive harm, or subject us to new regulatory frameworks (such as the European Union's ("EU") Artificial Intelligence Act). Such risks are heightened if we or third-party developers or vendors lack sufficient responsible AI development or governance practices.”

Annual report 2025A · The company itself

“The DMA and DSA give EU regulators more instruments to investigate and regulate digital businesses and impose additional rules and requirements on platforms designated as "gatekeepers" under the DMA and online platforms more generally, with separate rules for "Very Large Online Platforms" ("VLOPs") under the DSA. As a result of our designation as a gatekeeper under the DMA and Booking.com's designation as a VLOP under the DSA, we are subject to additional rules and regulations that may not be applicable to our competitors.”

Annual report 2025A · The company itself

“Under the DSA, as a VLOP, Booking.com is required to collect more information from partners, which could disincentivize certain partners from using our services. Booking.com is also subject to additional scrutiny, obligations, and costs, such as payment of an annual supervisory fee, annual risk assessments and independent audits, and maintaining a compliance function.”

Annual report 2025A · The company itself

“We also expect to be subject to a variety of laws and regulations governing AI and RPA, such as the EU AI Act, which was enacted in August 2024. These laws and regulations are still evolving, and while we are assessing how regulators may apply existing consumer protection, data protection and other similar laws to AI, there is uncertainty regarding the scope of new laws and how existing laws will apply.”

Annual report 2025A · The company itself

“The regulatory framework governing the use of AI Technologies is rapidly evolving. Existing laws and regulations, such as data privacy and antitrust regimes, may apply to us or our customers in new ways, and many U.S. federal, state and foreign government bodies and agencies have introduced or are currently considering additional laws and regulations. For example, the EU Artificial Intelligence Act (the "EU AI Act") establishes a comprehensive, risk-based governance framework for AI in the EU market. The EU AI Act applies to companies that develop, use and/or provide AI in the EU and includes fines for breach of up to 7% of worldwide annual turnover.”

Annual report 2025A · The company itself

“In addition, the Federal Trade Commission has required other companies to disgorge valuable insights or trainings generated through the use of AI or machine learning technologies where they allege the company has violated privacy and consumer protection laws.”

Annual report 2025A · The company itself

“We may need to expend resources to adjust our products or services in certain jurisdictions if the laws, regulations or decisions are not consistent across jurisdictions. Further, the cost to comply with such laws, regulations, decisions and/or guidance interpreting existing laws, could be significant and would increase our operating expenses (such as by imposing additional reporting obligations regarding our use of AI Technologies). Such an increase in operating expenses, as well as any actual or perceived failure to comply with such laws and regulations, could adversely affect our business, financial condition and results of operations.”

Annual report 2025A · The company itself

“AI may subject us to new or heightened legal, regulatory, ethical or other challenges, and a negative public opinion of AI could impede the acceptance of AI solutions. If the models or AI solutions that we or a third party create and use or the data inputs, formulas, or algorithms on which such models or AI solutions rely – or if the content, analyses or recommendations that the models or AI solutions produce are (or are perceived to be) deficient, inaccurate, biased, unethical or controversial – we could incur operational inefficiencies, competitive harm, legal liability, or brand or reputational harm.”

Annual report 2025A · The company itself

“The regulation of AI is rapidly evolving worldwide as legislators and regulators are increasingly focused on these powerful, emerging technologies. The technologies underlying AI and its uses are subject to a variety of laws and regulations, including intellectual property, privacy, data protection and data security, consumer protection, competition and equal opportunity laws and regulations. They are expected to be subject to increased regulation and new laws or new applications of existing laws and regulations.”

Annual report 2025A · The company itself

“In particular, several states, including Colorado and California, have passed or are continuing to propose laws and regulations that govern various facets and uses of AI. We may not be able to anticipate how to respond to these rapidly evolving frameworks, and we may need to expend resources to adjust our offerings in certain jurisdictions if the legal frameworks are inconsistent across jurisdictions.”

Annual report 2025A · The company itself

“In 2023, HHS finalized transparency requirements for artificial intelligence and other predictive algorithms used in certified health information technology, such as decision support interventions. Changes to laws and regulations regarding how we may use artificial intelligence could make it harder for us to conduct our business using artificial intelligence; require us to retrain our artificial intelligence; or prevent or limit our use of artificial intelligence.”

Annual report 2025A · The company itself

“We increasingly rely on new and evolving technologies, including those powered by or incorporating artificial intelligence, as part of our internal operations and in the delivery of our products and services. These new technologies could present ethical, technological, legal, regulatory and other risks. We are required by certain regulators to develop and implement policies and procedures to promote and sustain the responsible design, development, and use of artificial intelligence. Any inadequacy or failure in designing, implementing or complying with such policies and procedures, or failure in complying with emerging laws, regulations and standards governing artificial intelligence, could adversely affect our operations that use or rely on artificial intelligence, or could materially and adversely affect our business, reputation, results of operations, financial position and cash flows.”

Annual report 2025A · The company itself

“As a result, policymakers are considering what a regulatory regime for crypto would look like and the elements that would serve as the foundation for such a regime. This less developed consideration of crypto may harm our ability to effectively react to proposed legislation and regulation of crypto assets or crypto asset platforms adverse to our business.”

Annual report 2025A · The company itself

“Evolving legal frameworks and guidance, such as the E.U. AI Act, other international regimes, and emerging developments with respect to U.S. federal and state regulations, rules, and industry standards governing AI may require us and our third-party developers to incur significant costs to modify, maintain, or align our business practices, services, and solutions to comply with rules and regulations, the nature of which cannot be determined at this time and may be inconsistent from jurisdiction to jurisdiction.”

Annual report 2025A · The company itself

“The regulatory framework for AI Technologies is rapidly evolving as many federal, state and foreign government bodies and agencies have introduced or are currently considering additional laws and regulations. Additionally, existing laws and regulations may be enjoined in judicial proceedings from being enforced or may be interpreted in ways that would affect the operation of our AI Technologies, or could be rescinded or amended as new administrations take differing approaches to evolving AI Technologies.”

Annual report 2025A · The company itself

“For example, in Europe, the EU AI Act entered into force and established a comprehensive, risk-based governance framework for AI in the EU market. The majority of the substantive requirements will apply from August 2, 2026.”

Annual report 2025A · The company itself

“The EU AI Act applies to companies that develop, use and/or provide AI in the EU and, depending on the use case, includes requirements around transparency, conformity assessments and monitoring, risk assessments, human oversight, security, accuracy, general purpose AI and foundation models and fines for breach of up to 7% of worldwide annual turnover. Once fully applicable, the EU AI Act will have a material impact on the way AI is regulated in the EU, and together with developing guidance and/or 32 decisions in this area, may affect our use of AI Technologies and our ability to provide, improve, or commercialize our services, and could require additional compliance measures and changes to our operations and processes.”

Annual report 2025A · The company itself

“In particular, the EU’s Digital Services Act and the EU’s Data Act both entered into force in 2024 and impose certain content moderation, notice and transparency obligations on digital platforms and intermediaries and certain data and cloud service interoperability and switching obligations to enable users to switch between cloud service providers (as well as certain requirements concerning cross-border international transfers of non-personal data outside the EEA), respectively.”

Annual report 2026A · The company itself

“Our business is subject to regulation by various federal, state, local and foreign governmental agencies, including agencies responsible for monitoring and enforcing data privacy and security laws and regulations, employment and labor laws, workplace safety, product safety, environmental laws, consumer protection laws, anti-bribery laws, import and export controls, federal securities laws and tax laws and regulations. In certain jurisdictions, these regulatory requirements may be more stringent than in the United States. Increased scrutiny may also lead to new laws and regulations, or new applications of existing laws and regulations, that target topics such as AI, critical infrastructure software resiliency, digital sovereignty requirements and concentration risk.”

Annual report 2026A · The company itself

“The introduction of AI, and particularly generative AI, a relatively new and emerging technology in the early stages of commercial use, into new or existing products, and our operations, may result in new or enhanced governmental or regulatory scrutiny, litigation, confidentiality, ethical concerns, or other complications that could adversely affect our business, reputation, or financial results. For example, generative AI has been known to produce false or “hallucinatory” interferences or outputs, and certain generative AI uses machine learning and predictive analytics, which may be flawed, insufficient, of poor quality, reflect unwanted forms of bias, or contain other errors or inadequacies, any of which may not be easily detectable. Our customers or others may rely on or use this flawed content to their detriment, which may expose us to brand or reputational harm, competitive harm, and/or legal liability.”

Annual report 2026A · The company itself

“AI is the subject of ongoing review by various U.S. governmental and regulatory agencies, and various U.S. states and other foreign jurisdictions are applying, or are considering applying, their cybersecurity and data protection laws to AI or are considering general legal frameworks for AI. For example, in the EU, the first set of provisions under the EU’s AI Act became effective in February 2025, with additional provisions becoming effective on later dates. The AI Act establishes, among other things, a risk-based governance framework for regulating AI systems in the EU by categorizing AI systems, based on the risks associated with such AI systems’ intended purposes, as creating unacceptable or high risks, with all other AI systems being considered low risk. This regulatory framework is expected to have a material impact on the way AI is regulated in the EU and beyond.”

Annual report 2026A · The company itself

“There is also a continuing trend of states enacting more comprehensive privacy laws and regulations addressing consumer rights to data access, deletion, protection or transparency, such as the California Consumer Privacy Act (“CCPA”). States also are starting to issue regulations and proposed regulations specifically related to cybersecurity, such as the regulations issued by the New York Department of Financial Services, as well as regulating use of artificial intelligence technologies. Complying with conflicting cybersecurity regulations, which may differ from state to state, requires significant resources.”

Annual report 2025A · The company itself

“Risks Related to Our Operations •Data governance failures, the failure or disruption of our information technology or infrastructure, a cyberattack or other information security incident can adversely affect our reputation, businesses and prospects.”

Annual report 2025A · The company itself

“For example, potential efforts to reform federal government processes and reduce expenditures as well as pressures on and uncertainty surrounding the U.S. federal government’s budget and potential changes in budgetary priorities could adversely affect the funding for individual programs, including government programs, upon which our business depends. Executive orders covering health care and other subjects including immigration, AI, energy and the federal workforce as well as the workforce of public and private companies, if implemented through agency action, may also impact the Company.”

Annual report 2025A · The company itself

“Several jurisdictions around the globe, including Europe and certain U.S. states, have proposed, enacted, or are considering laws governing the development and use of AI and machine learning technologies. For example, the European Union's Artificial Intelligence Act, which would apply beyond the European Union’s borders, came into effect in August 2024. It contains numerous requirements regarding the development and use of AI and imposes significant monetary fines.”

Annual report 2025A · The company itself

“The use of AI in our products, services, and internal processes presents ethical and legal risks to our business, financial condition, and results of operations. If our use of AI becomes controversial, we may experience loss of user trust, as well as brand or reputational harm, competitive injury, or legal liability.”

Annual report 2026A · The company itself

“AI is the subject of evolving review by various domestic and international governmental and regulatory agencies, and laws, rules, directives and regulations governing the use of AI are rapidly proliferating and evolving. We may not always be able to anticipate how to respond to these legal frameworks for AI use and we may have to expend resources to adjust or audit our products, services, and internal use in certain jurisdictions, especially if the legal frameworks are not consistent across jurisdictions.”

Annual report 2026A · The company itself

“As a global enterprise, we face compliance risks under a significant and increasing number of laws and regulations in the United States, the European Union, China, and numerous other jurisdictions relating to cybersecurity, product security, software supply chain security and AI, and the collection, use, residency, transfer, and protection of data. Such laws and regulations continue to evolve, may be applied differently in different jurisdictions, and could result in increased costs in the event of a significant disruption of our operations, data or privacy breach, loss, or other compromise of proprietary or confidential information as a result of a cyber-attack or insider activity.”

Annual report 2026A · The company itself

“The legal and regulatory landscape surrounding AI technologies is rapidly evolving and uncertain. The rapid advancement of these technologies entails risks, including potential deficiencies in AI-generated information and increased regulatory, cybersecurity, privacy, intellectual property and data-related risks. Another risk may arise if we are unable to timely utilize AI for technological innovation and business operation efficiency in a manner that is faster and more effective than our competitors. In addition, compliance with new or changing laws, regulations or industry standards relating to AI may impose significant costs on us and limit our ability to effectively develop, deploy or use AI technologies.”

Annual report 2025A · The company itself

“The European Commission has finalized the EU AI Act, which establishes requirements for the provision and use of products that leverage AI systems, including in credit scoring. The EU AI Act entered into force on August 1, 2024 and its provisions take effect between six and 36 months after that date, with most of those provisions becoming effective in 2026.”

Annual report 2025A · The company itself

“Consumer Credit Directive). •Fair lending laws (e.g., the Equal Credit Opportunity Act and Regulation B, and the Fair Housing Act) and laws and regulations that may impose requirements relating to algorithmic fairness or accountability. •Laws and regulations related to data and cybersecurity, such as the Cybersecurity Act of 2015; the U.S.”

Annual report 2025A · The company itself

“•AI Regulation. Lawmakers and regulators around the world are considering legislation or rules to govern the use and deployment of AI. The EU AI Act, Regulation (EU) 2024/1689, is now in effect and has requirements for risk assessment, data quality, logging, transparency and restrictions on cognitive behavioral interference or automated decision making.”

Annual report 2025A · The company itself

“Table of Contents Further, our business may be constrained by current and future laws and regulations governing the development, use and deployment of AI (including machine learning) technologies. These laws and regulations are continuously and rapidly evolving, and there is no single global regulatory framework for AI, creating further uncertainties regarding compliance with such laws and regulations.”

Annual report 2025A · The company itself

“The regulatory landscape surrounding AI is evolving quickly, and the jurisdictions in which we operate are increasingly implementing new, complex and sometimes conflicting compliance requirements. For instance, the E.U. AI Act imposes a number of requirements (some of which took effect in August 2025 and will take effect in August 2026 and August 2027) that differ depending on the type and use of a particular AI system, but which will at a minimum include extensive documentation and transparency requirements.”

Annual report 2025A · The company itself

“The Company could be adversely affected by new laws and regulations, changes in existing laws and regulations, changes in judicial and regulators’ interpretations of laws and regulations or in regulators’ priorities or activities, as well as by the threat that additional laws or regulations may be forthcoming. In particular, the legal and regulatory landscape governing new technologies such as AI remains unsettled and is an area of 29 increasing regulatory focus. Developments in this area may adversely impact the Company’s business, including through increased legal liability risk and compliance costs associated with the use of AI and large language models.”

Annual report 2026A · The company itself

“AI can present ethical issues and may subject us to new or heightened legal, regulatory, ethical, or other challenges, including issues relating to discrimination, intellectual property infringement or misappropriation, violation of rights of publicity, inability to assert ownership of inventions and works of authorship, loss of trade secrets, defamation, data privacy, and cybersecurity; and inappropriate or controversial data practices by third-party partners, developers and end-users, or other factors adversely affecting public opinion of AI, could impair the acceptance of AI solutions, including those incorporated in our products and services.”

Annual report 2026A · The company itself

“In addition, regulation of Gen AI is rapidly evolving worldwide as legislators and regulators are increasingly focused on these powerful emerging technologies. The technologies underlying Gen AI and its uses are currently subject to a variety of laws and regulations, including intellectual property, privacy, data protection and information security, consumer protection, competition, and equal opportunity laws, and are expected to be subject to increased regulation and new laws or new applications of existing laws and regulations.”

Annual report 2026A · The company itself

“For example, the EU AI Act, which came into force on August 1, 2024, will generally become fully applicable after a two-year transitional period, with certain obligations taking effect at an earlier or later time. The EU AI Act introduces various requirements for AI systems and models placed on the market or put into service in the EU, including specific transparency and other requirements for general purpose AI systems and the models on which they are based.”

Annual report 2026A · The company itself

“In addition, several U.S. states, such as California and Colorado, have proposed or enacted laws regarding automated decision‑making, deepfakes, algorithmic discrimination and so called “high‑risk” AI technologies (mandating, among other provisions, requirements for risk management, impact assessments, consumer notices and human oversight).”

Annual report 2026A · The company itself

“For example, the regulatory frameworks for an open banking paradigm and AI and machine learning technology are evolving and remain uncertain and may affect the operation of our platform and the way in which we use consumer data, AI and machine learning technology, including with respect to consumer protection laws and the laws and regulations governing financial services products.”

Annual report 2026A · The company itself

“For example, the E.U. has enacted the EU AI Act, which regulates the development, deployment and use of AI systems with broad extra-territorial effect.”

Annual report 2025A · The company itself

“In the U.S., various laws, regulations, rules, orders and directives have been proposed or implemented relating to the development, deployment, and use of AI.”

Annual report 2025A · The company itself

“It is not possible to predict all risks related to the use of AI, and changes in laws, rules, directives and regulations governing AI may adversely affect our development, adoption, use, deployment and maintenance of AI or subject us to legal liability, regulatory action or brand and reputational harm.”

Annual report 2025A · The company itself

“Congress or other legislative bodies in the U.S. or in other countries could adopt laws that erode the safe harbors from third-party liability in the CDA (Section 230) and the Digital Millennium Copyright Act; •ICANN could fail to maintain its role, potentially resulting in instability in DNS services administration and operation; 42 Table of Contents •our business as a vertically integrated operation of a registrar and registry could lead to increased regulatory scrutiny; •ICANN, TLD operators, governments and governmental authorities may impose requirements for verification of domain name registrant information that are inconsistent with our current business practices or that result in inconsistency among industry participants, including but not limited to changes under the E.U.”

Annual report 2025A · The company itself

“These evolving laws may increase our costs and limit our ability to use personal data for new products, including but not limited to products that rely on AI-related technologies.”

Annual report 2025A · The company itself

“We are subject to international laws, rules and regulations relating to content moderation. Various jurisdictions have enacted laws that impose requirements related to content moderation, transparency and advertising practices. For example, the European Union's Digital Services Act (DSA) includes provisions related to notice and takedown obligations, advertising restrictions, reporting obligations, and content moderation processes. Other frameworks, such as Germany's NetzDG and the UK's Online Safety Act (OSA), also establish requirements related to the handling of online content.”

Annual report 2025A · The company itself

“While there is currently no comprehensive federal legislation in the U.S. concerning the use, development or deployment of AI, regulators pursue AI-related enforcement actions under existing federal consumer protection laws and have issued related guidance. Further, state privacy, consumer protection and AI-specific laws are proliferating and may be applicable to our business. Other countries are also applying their data and consumer protection laws to AI, particularly generative AI, and are considering and implementing specific legal frameworks with respect to AI. Regulation (EU) 2024/1689 on harmonized rules on artificial intelligence (the EU AI Act), for example, establishes a comprehensive regulatory framework for AI that became law in August 2024 with implementation phased through into 2027.”

Annual report 2025A · The company itself

“AI and the use thereof is also subject to a variety of existing laws and regulations, including fair lending, consumer protection, intellectual property, cybersecurity, data privacy, and equal opportunity, and is expected to be subject to new laws and regulations or new applications of existing laws and regulations. AI is the subject of evolving review by various governmental and regulatory agencies, and changes in laws and regulations governing AI may adversely affect our ability to use AI.”

Annual report 2025A · The company itself

“Table of Contents The regulatory landscape surrounding AI is also evolving, and the use of machine learning technologies may expose us to an increased risk of regulatory enforcement and litigation. As the FDA and other regulatory authorities continue to develop and incorporate such principles into their regulation of MLMDs, it is possible that medical products using AI and machine learning will become subject to significant additional oversight, including with respect to premarket review, modification, monitoring, maintenance, and device performance.”

Annual report 2025A · The company itself

“In particular, the AI Act, European Health Data Space Regulation, and Data Act and Data Governance Acts regulate personal and non-personal data as well as artificial intelligence. These obligations may be interpreted in ways that require us to modify our business practices and products to maintain compliance, potentially increasing costs and operational complexity. Moreover, some of the AI features of our products involve, or may involve, the processing of personal data and may be subject to laws, policies, legal obligations, and codes of conduct related to privacy and data protection, each of which may be interpreted in ways that may affect the way in which we engage with machine learning and require us to make changes to our business practices and products to comply with such obligations.”

Annual report 2025A · The company itself

“The legal and regulatory environment relating to AI is rapidly evolving, in the U.S., E.U., and internationally, and includes regulation targeted specifically at AI technology, including the EU AI Act, portions of which have already come into force with more to follow this year and in future years, as well as provisions in intellectual property, privacy, consumer protection, employment and other laws applicable to the use of AI. Global divergence in AI regulations and evolving standards could create conflicting requirements across jurisdictions, increase compliance costs, and heighten enforcement risk. These evolving laws and regulations could require changes in our implementation of AI technology, increase our compliance costs and the risk of non-compliance, and restrict or impede our ability to develop, adopt and deploy AI technologies efficiently and effectively.”

Annual report 2025A · The company itself

“Current and anticipated regulatory developments include requirements related to AI, cybersecurity, and digital operational resilience, as well as evolving ESG disclosure standards and cross-border data transfer restrictions. Global divergence in these regulations could create conflicting obligations and increase compliance complexity. These changes may require significant investment of management time and resources, impact product design and distribution, and materially increase compliance costs or capital requirements.”

Annual report 2025A · The company itself

“The costs to comply with, or our failure to comply with, U.S. and foreign laws related to privacy, data security and data protection, such as the EU's General Data Protection Regulation (GDPR) and the California Consumer Privacy Act, as amended by the California Privacy Rights Act, (CCPA), Australia's CPS 234, as well as emerging AI-related laws such as the EU's AI Act, could adversely affect our financial condition, operating results and our reputation.”

Annual report 2025A · The company itself

“Given the complexity of operationalizing the various privacy, data security, data protection and AI laws and regulations mentioned above, the complexity of proposed compliance frameworks and the continued lack of certainty on how to implement their requirements, we and our clients are at risk of enforcement actions taken by applicable regulators or authorities around the world or litigation from third parties, including consumer advocacy groups acting on behalf of data subjects. Additionally, due to the ongoing fast pace of legislative and regulatory activity, we may not be able to respond quickly or effectively to new legislative, regulatory and other developments.”

Annual report 2025A · The company itself

“While we have implemented certain mitigation measures and governance related to the proliferation of AI tools, these measures may be inadequate or may not satisfy a growing number of legal and regulatory requirements related to AI. Moreover, if we are perceived to exaggerate the effectiveness, safety or ethical design of AI systems, this could lead to regulatory enforcement, litigation or reputational harm.”

Annual report 2025A · The company itself

“Privacy, Data, AI and Information Security Regulation and enforcement of privacy, data, AI, information security and the digital economy could increase our costs and lead to legal claims and fines, as well as negatively impact our growth and reputation.”

Annual report 2025A · The company itself

“New requirements and rules, or changing interpretations of existing requirements in these areas, or the development of new regulatory schemes related to the digital economy in general, may also increase our costs and/or restrict our ability to leverage data or use AI for innovation. This could impact the products and services we offer and other aspects of our business, such as fraud monitoring, the need for improved data management, governance, quality and accuracy practices, the development of information-based products and solutions, and technology operations. In addition, these requirements may increase the costs to our customers of issuing payment products or using information products, which may, in turn, decrease the number of our products that they offer.”

Annual report 2025A · The company itself

“As a result of the complexity and rapid development of AI, it is also the subject of evolving review and investigation by various governmental and regulatory agencies in jurisdictions around the world, which are applying, or are considering applying, platform moderation, intellectual property, products liability, cybersecurity, export controls, consumer protection, and data protection laws to AI and/or are considering general legal frameworks on AI (such as the EU AI Act).”

Annual report 2025A · The company itself

“Table of Contents Our business is subject to complex and evolving U.S. and foreign laws and regulations regarding privacy, data use, data combination, data protection, content, AI, competition, youth, safety, consumer protection, advertising, e-commerce, and other matters. Many of these laws and regulations are subject to change and uncertain interpretation, and could result in claims, changes to our products and business practices, monetary penalties, increased cost of operations, or declines in user growth or engagement, or otherwise harm our business.”

Annual report 2025A · The company itself

“New and existing frameworks in the United States, the European Union and China - including the EU AI Act’s risk‑based approach - may impose additional compliance, transparency, conformity assessment, monitoring or usage‑restriction obligations on AI‑enabled products. Conflicting regulatory requirements across jurisdictions increase compliance complexity and costs, and failure or perceived failure to comply could result in fines, penalties, investigations, restrictions on product offerings, reputational harm, or lost sales or talent.”

Annual report 2026A · The company itself

“Additionally, new and updated AI regulations could impose onerous obligations that may disadvantage us and require us to change our business practices.”

Annual report 2026A · The company itself

“New technology trends, such as cyber resiliency and security requirements and the rapid adoption of AI, require us, and our customers and suppliers, to keep pace with evolving regulations and industry standards. In the U.S., the EU, and China, there are various current and proposed regulatory frameworks relating to cybersecurity, AI development, and the deployment of automation and AI in products, services and operations, including the EU AI Act, China’s generative AI regulations, and various current or proposed U.S. federal and state AI and/or cybersecurity legislative or governance frameworks, executive orders, rules, regulations and laws.”

Annual report 2026A · The company itself

“New and evolving laws and regulations relating to cybersecurity, data privacy, digital products, and AI impose requirements for information confidentiality, integrity, availability, personal and proprietary data collection, storage, use, sharing, deletion, and AI systems to be appropriately transparent, fair, secure, responsibly deployed, and accountable. Along with these laws and regulations, standards and market expectations could cause us to incur additional direct costs for compliance, as well as increased indirect costs resulting from our customers, suppliers, or partners reluctance to share information or solutions due to actual or perceived inadequate controls. As a result of these considerations, we could experience a reduction of production or sales of our products; remediation costs and activities; increased compliance costs; regulatory penalties, fines, civil or criminal sanctions, and other legal liabilities; and reputational challenges.”

Annual report 2025A · The company itself

“They are further compounded by the evolving regulatory landscape, with new laws emerging globally and increased scrutiny from regulators and lawmakers. Certain AI technologies and use cases present ethical issues or may have broad or uneven impacts on society or vulnerable groups within society. There is also rising divergence globally in how to address these issues and impacts, with the result that we will need to navigate a web of different tensions across geographies.”

Annual report 2026A · The company itself

“AI: Legislative and regulatory action is evolving with respect to AI, which could increase costs or restrict opportunity. For example, the EU’s AI Act may increase costs or impact the provision or operation of our AI models and services in the European market. In addition, governments may impose restrictions on the development, deployment, availability, or cross-border access to advanced AI models based on safety, cybersecurity, or national security or may apply laws to AI models in ways we cannot anticipate.”

Annual report 2026A · The company itself

“The potential replacement of the rescinded AI Diffusion Rule, expanded export license conditions, and other potential AI-related rulemakings could adversely affect Microsoft’s business, strategy, and operations.”

Annual report 2026A · The company itself

“Governments around the world have adopted, and may continue to adopt, laws and regulations related to AI, including the European Union’s (“EU”) Artificial Intelligence Act. Federal and state agencies in the U.S. have enacted or are considering enacting new laws and regulations regarding the use of AI, and there are increased investigations and enforcement efforts related to the use of AI technology, all of which could increase our compliance costs and affect our ability to use AI in the development of our products and in our operations.”

Annual report 2025A · The company itself

“Our success depends on us investing significant amounts of resources in research and development. We expect to continue investing heavily in research and development in the future in order to keep innovating and introducing new products in a timely manner and increase our revenue and profitability.”

Annual report 2025A · The company itself

“The Firm and its employees are subject to wide-ranging regulation and supervision, which, among other things, subject us to intensive scrutiny of our businesses and any plans for expansion of those businesses through acquisitions or otherwise, limitations on activities, a systemic risk regime that imposes heightened capital and liquidity and funding requirements, including the global implementation of capital standards established by the Basel Committee, and other enhanced prudential standards, resolution regimes and resolution planning requirements, requirements for maintaining minimum amounts of TLAC and external long-term debt, restrictions on activities and investments imposed by the Volcker Rule, comprehensive derivatives regulation, commodities regulation, market structure regulation, consumer protection regulation, AML, terrorist financing and anti-corruption rules and regulations, tax regulations and interpretations, antitrust laws, trade and transaction reporting obligations, requirements related to preventing the misuse of confidential information, including material non-public information, record-keeping requirements, broadened fiduciary obligations and disclosure requirements and laws and regulations related to new technologies, including artificial intelligence and tokenization.”

Annual report 2025A · The company itself

“Artificial Intelligence and Biometrics Regulations The U.S. federal government and many state and local governments have adopted or are considering laws or regulations governing the use of AI and biometrics, including facial recognition, license plate recognition technology and AI-generated police reports, which in some instances cover certain products and services we offer. Similar laws and regulations are being enacted or considered in some jurisdictions outside the U.S., including the EU. Such regulation could impact a number of our products.”

Annual report 2025A · The company itself

“We use AI in our products and services, and challenges related to the use of AI could subject us to legal liability or additional regulatory oversight, or adversely affect our business, financial condition, results of operations or business reputation. We expect to increasingly leverage AI, including generative AI, in our products and services.”

Annual report 2025A · The company itself

“For example, the AI Act in the EU became law in August 2024, with key obligations applying in stages through August 2027. The AI Act places significant restrictions on the use of AI for real-time “biometric identification” by law enforcement, and implements significant compliance requirements on the development and use of AI for biometric identification of any kind. Once fully implemented, the AI Act will also place compliance requirements on a variety of other AI uses by law enforcement, as well as on the companies that develop those products, including us.”

Annual report 2025A · The company itself

“With respect to biometrics and other analytics, laws such as the Biometric Information Privacy Act in Illinois have restricted the collection, use and storage of biometric information and provide a private right of action of persons who are aggrieved by violations of the act. Additionally, laws such as the California automatic license plate recognition (“ALPR”) statute regulate the use of ALPRs and provide a private right of action to persons who have suffered actual damages from violation of the statute, and we expect to see an increase in state ALPR legislation going forward.”

Annual report 2025A · The company itself

“Laws and regulations applicable to AI, including intellectual property, data privacy and security, consumer protection, competition and equal opportunity laws, continue to develop and may be inconsistent from jurisdiction to jurisdiction.”

Annual report 2025A · The company itself

“Laws, rules, regulations and standards governing privacy, data collection and AI impact our ability to collect, manage, store, use and otherwise process personal data and other information. We operate across jurisdictions with differing and often conflicting data privacy laws, including extraterritorial requirements, which continue to expand in scope and complexity.”

Annual report 2025A · The company itself

“Emerging AI regulations, such as the European Union’s Artificial Intelligence Act, impose requirements for transparency, fairness and oversight of AI systems. These regulations may directly affect our operations, including the use of AI in hiring, employee performance monitoring and client-facing applications, by requiring audits, documentation and human oversight. Compliance with evolving AI regulatory frameworks may increase costs, impact our product development, restrict the use of certain applications of AI and expose us to liability for violations of applicable laws, regulations or contracts.”

Annual report 2025A · The company itself

“As a technology company at the forefront of AI innovation, our business faces potential risks associated with the rapidly evolving regulatory landscape for AI. Governments and regulatory bodies worldwide are increasingly enacting new laws and guidelines to address the ethical, privacy, and security implications of AI technologies.”

Annual report 2026A · The company itself

“AI-related issues, deficiencies and/or failures could result in (i) legal or regulatory action, including to enforce new legislation regulating AI in various jurisdictions where we operate, and the application of existing data protection, privacy, intellectual property, and other laws; (ii) damage to our reputation; (iii) time-consuming and costly litigation, including related to intellectual property; (iv) inability to protect our intellectual property, including the inability to claim intellectual property ownership over content or source code generated using AI; (v) disclosure of our confidential information, including the inadvertent input of proprietary, sensitive, or customer data into publicly available third-party AI training models; or (vi) other material harm to our business. If regulation significantly delays or impedes the adoption of AI, we may not be able to meet our development goals or our sales forecasts.”

Annual report 2026A · The company itself

“Failure to comply with new and existing laws and regulations related to privacy, data protection, AI and information security could cause harm to our reputation, result in liability (including regulatory penalties and litigation), and adversely impact our business.”

Annual report 2026A · The company itself

“The EU has also enacted a comprehensive law regulating the development and use of AI systems, the EU AI Act, which came into force on August 1, 2024, and will generally become fully applicable after a two-year transitional period, with certain obligations taking effect at a later time. The EU AI Act imposes enhanced requirements on certain “high-risk” AI systems, including obligations relating to risk management, data governance, documentation, human oversight and conformity assessments, and also establishes transparency obligations that apply to a broad range of AI systems.”

Annual report 2026A · The company itself

“Beyond the EU, other jurisdictions are enacting or proposing AI-specific legislation and regulatory frameworks, including in the United States at both the federal and state level, and in other international markets. These emerging requirements may impose additional or conflicting obligations on our development and deployment of AI technologies, increasing compliance complexity and cost.”

Annual report 2026A · The company itself

“Regulation of AI is rapidly evolving in the U.S. and worldwide as legislators and regulators are increasingly focused on these powerful emerging technologies. The technologies underlying AI and its uses are subject to a variety of laws and regulations, including intellectual property, privacy, data protection, cybersecurity, consumer protection, competition, and equal opportunity laws, and are expected to be subject to increased regulation and new laws or new applications of existing laws and regulations. Additionally, several U.S. states, including Colorado and California, have passed or are continuing to propose laws and regulations that govern various facets and uses of AI, including consequential decisions, and, in Europe, the EU’s Artificial Intelligence Act (EU AI Act) entered into force on August 1, 2024.”

Annual report 2025A · The company itself

“The final text of the EU AI Act was published in the Official Journal of the European Union in July 2024 and entered into force in August 2024. Most of the EU AI Act’s substantive obligations will apply following a two-year implementation period, beginning in August 2026. The EU AI Act will have a significant impact on organizations that develop, deploy, or use AI systems both inside and outside the EU.”

Annual report 2025A · The company itself

“Further, the regulatory framework for AI and similar technologies, and automated decision making, is changing rapidly. It is possible that new laws and regulations will be adopted in the U.S. and in non-U.S. jurisdictions, or that existing laws and regulations may be interpreted, in ways that would affect the operation of our products and services and the way in which we use AI and similar technologies.”

Annual report 2025A · The company itself

“Northern Trust has certain processes and controls in place designed to mitigate the risks associated with the use of AI solutions, including monitoring the development and applicability of such evolving laws and regulations, and has taken, and will continue to take steps designed to comply with laws and regulations applicable to Northern Trust’s use of AI.”

Annual report 2025A · The company itself

“Our position in markets relating to AI has led to increased interest in our business from regulators worldwide, including the European Union, the United States, the United Kingdom, South Korea, Japan, and China. For example, the French Competition Authority collected information from us regarding our business and competition in the graphics card and CSP market as part of an ongoing inquiry into competition in those markets. We have also received, and continue to receive, broad requests for information from competition regulators in the European Union, the United States, the United Kingdom, China, and South Korea regarding our sales of GPUs and other NVIDIA products, our efforts to allocate supply, foundation models and our investments, partnerships and other agreements with companies developing foundation models, the markets in which we compete and our competition, our strategies, roadmaps, and efforts to develop, market, and sell hardware, software, and system solutions, and our agreements with customers, suppliers, and partners.”

Annual report 2026A · The company itself

“Governments and regulators are also considering, and in certain cases, have imposed restrictions on the hardware, software, and systems used to develop frontier foundation models and generative AI. For example, the EU AI Act became effective on August 1, 2024 and will be fully applicable after a two-year transitional period. The EU AI Act may impact our ability to train, deploy, or release AI models in the EU.”

Annual report 2026A · The company itself

“Several states are considering enacting or have already enacted regulations concerning AI technologies, with new state laws that took effect on January 1, 2026, which may impact our ability to train, deploy, or release AI models, and increase our compliance costs. Restrictions under these and any other regulations, if implemented, could increase the costs and burdens to us and our customers, delay or halt deployment of new systems using our products, and reduce the number of new entrants and customers, negatively impacting our business and financial results.”

Annual report 2026A · The company itself

“Concerns regarding third-party use of AI for purposes contrary to local governmental interests, including concerns relating to the misuse of AI applications, models, and solutions, has resulted in and could in the future result in unilateral or multilateral restrictions on products that can be used for training, modifying, tuning, and deploying LLMs and other AI applications. Such restrictions have limited and could in the future limit the ability of downstream customers and users worldwide to acquire, deploy and use systems that include our products, software, and services, and negatively impact our business and financial results.”

Annual report 2026A · The company itself

“Any regulatory control or other restriction that limits our ability to provide products and services that support third-party applications and models, including applications built on foundation models originating in China such as DeepSeek, Qwen, or KIMMI, could have a material impact on our business, operating results, and financial condition.”

Annual report 2026A · The company itself

“Issues relating to the responsible use of our technologies, including AI in our offerings, may result in reputational or financial harm and liability. Concerns relating to the responsible use of new and evolving technologies, such as AI, in our products and services may result in reputational or financial harm and liability and may cause us to incur costs to resolve such issues.”

Annual report 2026A · The company itself

“Complying with multiple regulations from different jurisdictions related to AI may further increase our cost of doing business, may change the way that we operate in certain jurisdictions, and may impede our ability to offer certain products and services in certain jurisdictions if we are unable to comply with regulations. Compliance with existing and proposed government regulation of AI, including in jurisdictions such as the European Union, may further increase the cost of related research and development, and create additional reporting and/or transparency requirements.”

Annual report 2026A · The company itself

“Additionally, several states and localities have enacted measures related to the use of AI and machine learning in products and services.”

Annual report 2026A · The company itself

“Furthermore, the EU AI Act and similar legislation could impose onerous obligations that may disproportionately impact and disadvantage us and require us to change our business practices.”

Annual report 2026A · The company itself

“If the recommendations, forecasts, or analyses that AI applications assist in producing are deficient, unreliable, or inaccurate, we could be subject to competitive harm, potential legal liability, including under existing, forthcoming, or proposed legislation regulating AI in jurisdictions such as the EU, and brand or reputational harm.”

Annual report 2025A · The company itself

“For example, our platforms include data and AI use case governance, machine learning modeling, as well as model testing and evaluation tools which help to regulate 33 Table of Contents and limit user access to data sets and develop, deploy, and manage more effective and responsible AI capabilities. However, if these controls are not properly implemented by, or for, our customers, or if we enable or offer AI solutions that are controversial or problematic because of their purported or real impact on fundamental rights, privacy, employment, or other societal issues, we may experience brand or reputational harm, as well as regulatory or legal scrutiny.”

Annual report 2025A · The company itself

“Some countries and regions, including the EU, are considering or have passed legislation that imposes significant obligations in connection with privacy, data protection, and information security that could increase the cost and complexity of delivering our platforms and services, including the European General Data Protection Regulation (“GDPR”) which took effect in May 2018; the EU AIA, which entered into force in August 2024 but continues to be phased in and establishes a risk-based framework for AI systems; and the Network and Information Security Directive 2 (“NIS2”), which replaced the original NIS Directive as of October 2024, and imposes additional cybersecurity risk management and incident reporting obligations. The EU also implemented the Digital Operational Resilience Act (“DORA”), which introduces new standards for Information and Communication Technology risk management and incident reporting for financial and insurance entities, and the European Union’s Data Act (the “Data Act”) became applicable on September 12, 2025.”

Annual report 2025A · The company itself

“For example, governmental bodies have implemented laws and are considering further regulation of AI (including machine learning), which could negatively impact our ability to use and develop platforms and products incorporating these technologies. The European Union Parliament adopted the EU AIA, that, despite recent moves to delay the implementation of some provisions, when effective, will likely impose onerous obligations related to the development, sale and use of AI-related systems. In addition, Colorado has passed a Consumer Protections for Artificial Intelligence bill introducing state-level oversight of “high-risk” AI systems, which mirrors language and several provisions appearing in the EU AIA.”

Annual report 2025A · The company itself

“The rapid evolution of AI, including current and future government regulation of AI, requires us to invest significant resources to develop, test, and maintain AI in our products and services in a manner that meets evolving requirements and expectations. The laws, rules, and regulations that have and continue to be adopted by policymakers, and the manner in which such requirements are interpreted or enforced, may require us to incur additional costs to comply with such requirements or make changes to our business practices, including our products and services that incorporate AI.”

Annual report 2026A · The company itself

“Moreover, new legislation affecting the scope of personal data and information, especially relating to IP addresses, machine identification, AI and machine learning, location data, health information, and other information, may limit or inhibit our ability to operate or expand our business and may require significant additional expenditures to comply. Data localization laws may mandate that personal data collected in a foreign country be processed and stored within that country, potentially requiring costly restructuring of our cloud infrastructure.”

Annual report 2026A · The company itself

“These laws and regulations may also impact our ability to develop new technologies, including emerging technologies such as AI.”

Annual report 2026A · The company itself

“In recent years, legislation, regulatory measures, and voter initiatives have been introduced, and in some cases adopted, which deal with use of consumer information, cybersecurity, use of credit and other information in underwriting and rating, insurance rate development, use of artificial intelligence and algorithms, rate of return limitations, and the ability of insurers to cancel or non-renew insurance policies.”

Annual report 2025A · The company itself

“Insurance laws and regulations may, among other things, limit an insurer’s ability to underwrite and price risks accurately, prevent the insurer from obtaining timely rate changes to respond to increased or decreased costs, delay or restrict the ability to discontinue or exit unprofitable businesses or jurisdictions, limit the profit an insurer may earn, impose marketing restrictions or requirements related to the use of artificial intelligence and third-party data, prevent insurers from terminating policies under certain circumstances, dictate or limit the types of investments that an insurance company may hold, and impose specific requirements relating to information technology systems and related cybersecurity risks.”

Annual report 2025A · The company itself

“Additionally, we are subject to new AI-focused regulations and regulatory expectations that could impose varied compliance and reporting requirements and challenges that could impact our operations or ability to write business profitably in one or more jurisdictions.”

Annual report 2025A · The company itself

“We are committed to using AI in an ethical, responsible and compliant way. We have implemented a formal AI governance oversight committee and established multiple AI safeguards to minimize risks associated with AI, including, but not limited to, expanded security and privacy measures, increased user access controls, employee and other end user training and certification, and standard operating procedures.”

Annual report 2025A · The company itself

“Using AI successfully will require significant resources, including having the technical expertise required to develop, test and maintain AI-based testing services and continually developing the appropriate governance and oversight of our use of AI. In addition, we anticipate that there will continue to be new regulatory requirements concerning the use of AI, which may aim to regulate, limit, or block the use of AI in our testing and other services or otherwise impose other restrictions that may hinder their usability or effectiveness.”

Annual report 2025A · The company itself

“(p) Challenges, including the associated competitive pressures, with properly managing the development, implementation, oversight and use of AI.”

Annual report 2025A · The company itself

“The legal and regulatory environment governing AI is rapidly evolving. Emerging laws and regulations in jurisdictions where we operate may impose new obligations, limit the use of AI, or require changes to our products, processes, or controls.”

Annual report 2026A · The company itself

“Risks Related to Governmental Regulation and Litigation Our business is subject to increasingly complex and evolving laws, rules, regulations, industry standards, and other legal obligations regarding content, consumer protection, competition, privacy, and other matters. Our existing and future products and services may subject us to additional regulatory requirements that could be costly and difficult to comply with or may subject us to other risks that could result in additional liability, reputational harm, or other consequences that could adversely affect our business, results of operations, financial condition, and prospects.”

Annual report 2025A · The company itself

“We expect increasing legal complexity and uncertainty regarding the use and regulation of content made available on platforms such as ours. We have faced, currently face, and will continue to face claims and governmental scrutiny relating to information or content that is published or made available on our platform. In particular, the nature of our business exposes us to claims and governmental scrutiny related to defamation, dissemination of misinformation or news hoaxes, discrimination, harassment, intellectual property rights, rights of publicity, data privacy and security, personal injury torts, laws regulating hate speech or other types of content, online safety, sex trafficking, consumer protection, and breach of contract, among others.”

Annual report 2025A · The company itself

“For example, the EU AI Act came into effect in August 2024 and applies to companies that develop, use, and/or provide AI in the EU and includes requirements around transparency, conformity assessments and monitoring, risk assessments, human oversight, security, and accuracy, and includes substantial penalties for non-compliance. This regulatory framework is expected to have a material impact on the way AI is regulated in the EU, and together with developing guidance and decisions in this area, may affect our use of AI and our ability to provide and to improve our services, require additional compliance measures and changes to our operations and processes, result in increased compliance costs and potential increases in civil claims against us, and could adversely affect our business, results of operations, financial condition, and prospects.”

Annual report 2025A · The company itself

“Legal and Regulatory Risks •Privacy concerns and laws as well as evolving regulation of cloud computing, AI services, increased restriction of cross-border data transfers and other regulatory developments. •Evolving industry-specific regulations, requirements, interpretive positions or standards. •Lawsuits against us by third parties for various claims, including alleged infringement of proprietary rights. •Any failure to obtain registration or protection of our intellectual property rights. •Risks related to government contracts and related procurement regulations. •Governmental sanctions and export and import controls that could impair our ability to compete in international markets and may subject us to liability.”

Annual report 2026A · The company itself

“Social, ethical, and regulatory issues, including the development, deployment, use or capabilities of AI in our offerings, may result in reputational harm, legal liability and increased compliance costs.”

Annual report 2026A · The company itself

“Regulatory frameworks such as the EU Digital Services Act (“DSA”), the EU AI Act and other rapidly evolving and sometimes conflicting global laws and regulations related to AI, privacy and consumer protection could increase compliance costs, restrict features or data flows, delay launches and expose us to penalties or litigation.”

Annual report 2026A · The company itself

“The rapid evolution of AI technologies and related regulatory requirements will require the allocation of significant resources to develop, test, monitor and maintain our products and services in order to comply with applicable laws and regulations and to address concerns relating to accuracy, bias, transparency, explainability, security and data provenance. Uncertainty surrounding new and emerging AI applications, including generative AI content creation and AI agents, may require additional investment in compliance programs, governance frameworks, licensing arrangements, documentation, auditing and risk mitigation processes, which may be complex, costly and could impact our profit margins.”

Annual report 2026A · The company itself

“Legal and Regulatory Risks Privacy concerns and laws as well as evolving regulation of cloud computing, AI services, cross-border data transfers and other domestic or foreign regulations may limit the use and adoption of our services and adversely affect our business.”

Annual report 2026A · The company itself

“Regulation related to the provision of services over the Internet continues to evolve, as federal, state and foreign governments adopt new, or modify existing, laws and regulations addressing data privacy, cybersecurity, data protection, data sovereignty and the collection, storage, hosting, transfer, use and other processing of data. The volume, complexity and scope of these regulatory requirements may continue to increase, including in response to heightened geopolitical tensions.”

Annual report 2026A · The company itself

“In some cases, data privacy laws and regulations, such as the EU’s General Data Protection Regulation (“GDPR”), impose obligations directly on us as both a data controller and a data processor, as well as on many of our customers. In addition, domestic data privacy laws, such as the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA”), and similar laws that have passed, gone into effect or are being considered in numerous other U.S. states, impose obligations on us and many of our customers, potentially as both a covered business and service provider.”

Annual report 2026A · The company itself

“These laws continue to evolve and expand, including through the adoption of new comprehensive data protection regimes such as India’s Digital Personal Data Protection Act 2023, and through the introduction of additional implementing rules and regulations in various jurisdictions. As a result, we and our customers may become subject to additional regulatory burdens.”

Annual report 2026A · The company itself

“New EU laws, including the DSA, the Data Act and the AI Act, have also been adopted and, depending on how they are implemented, interpreted and enforced, may impose additional rules, restrictions or compliance requirements on the development, deployment or use of our products and services, including AI-enabled features.”

Annual report 2026A · The company itself

“Table of Contents Compliance with these laws and regulations may require us to make changes to our practices, products or services to enable us or our customers to meet applicable legal requirements, and may increase our potential liability exposure through new or higher potential penalties, fines, investigations or litigation, including in connection with data breaches.”

Annual report 2026A · The company itself

“These developments could reduce demand for our services, require us to take on more onerous contractual obligations, restrict our ability to store, transfer and otherwise process data or, in some cases, limit our or our customers’ ability to offer our services in certain locations, deploy our solutions, reach current or prospective customers, or derive insights from customer data on a global basis.”

Annual report 2026A · The company itself

“Even though the CJEU decision upheld the use of Standard Contractual Clauses (“SCCs”) as a lawful transfer mechanism, the decision created ongoing uncertainty regarding EU-to-U.S. data transfers. While the EU and U.S. governments have since adopted the EU-U.S. Data Privacy Framework to facilitate such transfers and address the concerns raised by the CJEU, it remains uncertain whether this framework will withstand future legal challenges. As a result, regulators may continue to interpret the CJEU’s decision and the reasoning underlying it as significantly restricting certain cross-border data transfers increasing the cost and complexity of providing our services in certain markets.”

Annual report 2026A · The company itself

“Certain countries outside of the EEA have enacted or are considering enacting laws that require varying degrees of local data residency or localization.”

Annual report 2026A · The company itself

“The costs of compliance with, and other burdens imposed by, privacy laws, regulations and standards may limit the use and adoption of our services, reduce overall demand for our services, make it more difficult to meet expectations from our commitments to customers and our customers’ customers, lead to significant fines, penalties or liabilities for noncompliance, impact our reputation or slow the pace at which we close sales transactions particularly where customers request specific warranties or broad indemnities for noncompliance with privacy laws, any of which could harm our business.”

Annual report 2026A · The company itself

“Furthermore, the uncertain and evolving regulatory environment and broader trust climate may heighten concerns regarding data privacy, cybersecurity, and artificial intelligence, particularly where advanced analytics or automated functionality is involved, which could cause our customers or their end users to limit the data they provide or their use of our products and services. Even the perception that personal data is not adequately protected or that our products or services do not comply with applicable regulatory requirements could inhibit sales, reduce adoption of our offerings or otherwise adversely affect our business.”

Annual report 2026A · The company itself

“Further, jurisdictions are increasingly applying existing data privacy, consumer protection and other laws to AI, including emerging AI technologies such as generative AI, and are also enacting, or considering enacting, AI-specific legal frameworks, such as the EU AI Act, and the Utah Artificial Intelligence Policy Act, the Colorado Artificial Intelligence Act and the draft CCPA regulations on automated decision-making technology. As these laws and regulations are implemented, interpreted and enforced, they may impose additional compliance obligations or restrictions on our products, services or business practices.”

Annual report 2026A · The company itself

“SDG&E and SoCalGas are increasingly required to disclose large amounts of data (including customer personal information and energy use data) to support state energy initiatives, increasing the risks of inadvertent disclosure or unauthorized access of sensitive information. Our businesses operating in California are subject to the California Consumer Privacy Act, which requires companies that collect information about California residents to, among other things, disclose their data collection, use and sharing practices; allow consumers to opt out of certain data sharing with third parties; and assume liability for unauthorized disclosure of certain highly sensitive personal information.”

Annual report 2025A · The company itself

“Beginning in January 2027, our businesses that are subject to the California Consumer Privacy Act will also be subject to new regulations related to, among other things, the use of artificial intelligence tools to automate certain decisions. These regulations may limit some potential applications of such technologies, particularly with respect to previously collected personal data. The regulations require companies to disclose any covered use of such technologies and how the relevant decisions will be made and to allow consumers to opt out of such use, subject to limited exceptions.”

Annual report 2025A · The company itself

“Similarly, the legal and regulatory landscape surrounding AI is rapidly evolving and uncertain and includes an increasingly large amount of complex, stringent, and inconsistent global regulations, including with regard to certification requirements in many of the countries in which Solventum's customers are located.”

Annual report 2025A · The company itself

“We are subject to the standard policies and terms of service of third-party platforms, which govern the promotion, distribution, content and operation generally of games on the platform. Each platform provider has broad discretion to change and interpret its terms of service and other policies with respect to us and other developers, and those changes may be unfavorable to us. A platform provider may also change its fee structure, add fees associated with access to and use of its platform, alter how we are able to advertise on the platform, change how the personal information of its users is made available to application developers on the platform, limit the use of personal information for advertising purposes, or restrict how players can share information with their friends on the platform or across platforms.”

Annual report 2026A · The company itself

“As a global company, we are subject to a variety of regulations and laws in the U.S. and abroad, including regarding consumer protection (including the use of prepaid cards, online safety, and the protection of minors), subscriptions, advertising, electronic marketing, privacy (including verified parental consent and age assurance), biometrics, cybersecurity, data protection and data localization or data transfer requirements, AI, online services, online gaming or gambling, anti-competition, freedom of speech, labor, real estate, taxation, social media and content moderation, escheatment, intellectual property ownership and infringement, tax, export and national security, tariffs and other trade restrictions, anti-corruption and telecommunications, all of which are continuously evolving and developing.”

Annual report 2026A · The company itself

“The regulatory landscape governing AI is rapidly evolving. Several jurisdictions around the globe, including the European Union and several U.S. states, have proposed or enacted laws governing AI, including the European Union AI Act and enacted or potential U.S. federal and state AI legislation. These obligations and restrictions may lead to regulatory fines or penalties for non-compliance, make it harder for us to conduct our business using AI, require us to change our business practices, or prevent or limit our use of AI.”

Annual report 2026A · The company itself

“We are subject to a broad and evolving set of global requirements related to data privacy, cybersecurity and the responsible use of emerging technologies such as generative artificial intelligence (AI). These include comprehensive frameworks such as the EU’s General Data Protection Regulation (GDPR), the EU’s AI Act, U.S. federal and state privacy and security laws (including the Health Insurance Portability and Accountability Act of 1996 (HIPAA) for certain operations), and data-localization or cross-border transfer restrictions in various international markets. Governments in the EU, U.S. and other jurisdictions are also advancing new regulations that govern transparency, risk management and data practices associated with AI systems.”

Annual report 2025A · The company itself

“These regulatory systems also address authorization for lines of business, statutory capital and surplus requirements, limitations on the types and amounts of certain investments, underwriting limitations, transactions with affiliates, dividend limitations, changes in control, premium rates and a variety of other financial and non-financial components of an insurer’s business including, recently, cyber-security and the use of artificial intelligence and models.”

Annual report 2025A · The company itself

“Uncertainty regarding the regulation of AI and other burgeoning technologies may require significant resources to modify and maintain business practices to comply with U.S. and non-U.S. laws, the nature of which cannot be determined at this time. An increasing number of jurisdictions around the globe, including several U.S. states, have already proposed or enacted laws governing AI. Other jurisdictions may decide to adopt similar or more restrictive legislation that may render the use of such technologies challenging. These obligations may make it harder for us to conduct our business using AI, lead to regulatory fines or 17 Table of Contents penalties, require us to change our business practices, or prevent or limit our use of AI.”

Annual report 2026A · The company itself

“As we increase the number of products we offer, increase the number of countries in which we operate, and incorporate new technologies and capabilities into our products (including the use of AI and machine learning technologies), the complexity of adjusting our solutions to comply with legal and regulatory changes will increase. If we are unable to effectively manage this increased complexity or if we are not able to provide solutions that can be used in compliance with applicable laws and regulations, customers may be unwilling to use our solutions, and any such non-compliance could result in the termination of our customer agreements or claims arising from such agreements with our customers.”

Annual report 2026A · The company itself

“Furthermore, new and evolving regulations relating to the use of data in AI and machine learning technologies, such as the EU AI Act, are creating an increasingly complex and fragmented regulatory framework.”

Annual report 2026A · The company itself

“The legal, regulatory, and policy environments around AI are evolving rapidly, such as the EU AI Act and legislation proposed and adopted in certain states in the U.S., and we may become subject to new and evolving legal and other obligations. These and other developments may require us to make significant changes to our use of AI, including by limiting or restricting our use of AI or AI-enabled processes, and which may require us to make significant changes to our policies and practices, which may necessitate expenditure of significant time, expense, and other resources.”

Annual report 2026A · The company itself

“We expect to incur significant future expenditures related to: •developing new solutions and enhancing our existing solutions, and investment in our product development teams; •data acquisition costs associated with our Veeva Compass offering and costs incurred with our use of large language models associated with our Veeva AI offering; •improving the technology infrastructure, scalability, availability, security, and support for our solutions; •sales and marketing, including expansion of our direct sales organization and global marketing programs; •expansion of our professional services organization; •acquisitions and investments; and •general operations, IT systems, facilities, and administration, including legal and accounting expenses.”

Annual report 2026A · The company itself

“The legal and regulatory landscape surrounding AI technologies is rapidly evolving and uncertain, including in the areas of intellectual property, cybersecurity and privacy and data protection. Compliance with new or changing laws, regulations or industry standards relating to AI may impose significant costs and may limit our ability to develop, deploy or use AI technologies.”

Annual report 2025A · The company itself

“In particular, the adoption of agentic commerce, in which autonomous AI agents initiate and execute transactions on behalf of users, presents novel and complex regulatory, privacy and cybersecurity risks. Legal frameworks governing such autonomous agents remain nascent, with limited direct guidance specific to payments. The interplay between payments regulations, data privacy laws and evolving AI regulations may create uncertainty around compliance obligations and potential liability exposure as more participants (including sellers, fintechs, AI developers and enablers) enter the agentic commerce ecosystem.”

Annual report 2025A · The company itself

“Further, ongoing changes in the legal and regulatory requirements surrounding data privacy, online tracking technologies such as cookies, digital advertising and other eCommerce matters could require Grainger to modify its eCommerce strategy, incur significant additional costs to comply with such changes or otherwise adversely affect Grainger’s business, results of operations or financial condition.”

Annual report 2025A · The company itself

“These deficiencies and other failures of AI systems could subject Grainger to competitive harm, regulatory action, legal liability, including under new and proposed legislation regulating AI in jurisdictions such as the U.S. and European Union, new applications of existing data protection, privacy, intellectual property, and other laws, and brand or reputational harm.”

Annual report 2025A · The company itself

“Additionally, Grainger’s obligations to comply with the evolving legal and regulatory landscape could entail significant costs or limit its ability to incorporate certain AI capabilities into its digital platforms.”

Annual report 2025A · The company itself

“For example, the European Union’s (“EU”) AI Act (“EU AI Act”) puts new requirements on providers and deployers of AI technologies and we are currently working to ensure compliance with corresponding deadlines.”

Annual report 2026A · The company itself

“Additionally, existing laws and regulations apply to the development and deployment of AI in new ways, the nature and extent of which are difficult to predict and subject to change over time.”

Annual report 2026A · The company itself

“In addition, as AI technologies are increasingly used across the industry, including in connection with data analytics, automation, customer service, and decision-support features, the speed, scale, and complexity of data processing may increase, which may heighten data privacy risks. AI-enabled or agentic AI features may be targeted, misused, or produce outputs or inferences that implicate personal data in ways that are difficult to anticipate or control, potentially resulting in regulatory scrutiny, litigation, or reputational harm, even in the absence of a data breach.”

Annual report 2026A · The company itself

“Many of our products and services currently utilize or will utilize new and evolving technologies such as AI. The overall regulatory environment governing these types of technologies is likely to evolve as government interest in these technologies increases.”

Annual report 2026A · The company itself

“AI is the subject of ongoing review by various U.S. and international governmental and regulatory agencies, and various U.S. states and other foreign jurisdictions are applying, or are considering applying, their cybersecurity, data protection, and product safety laws to AI and its uses or are considering general legal frameworks for AI and its uses, such as the EU AI Act. Any failure by us to comply with applicable laws, regulations, guidance, or other rules could result in costly litigation, penalties, or fines.”

Annual report 2026A · The company itself

“Moreover, AI technology is subject to rapidly evolving domestic and international laws and regulations, which could impose significant costs and obligations on the company. For example, in 2024 the European Artificial Intelligence Act (EU) 2024/1689 went into force and established requirements and obligations for developers and deployers of AI systems.”

Annual report 2025A · The company itself

“Data Privacy, Cyber and Artificial Intelligence Laws We are subject to evolving national, state, international and other data privacy and security laws and regulations that govern the collection, use, disclosure, transfer, location, storage, disposal and protection of health-related and other personal information, including laws and regulations that regulate and restrict cross-border data transfers. Certain of these laws and regulations impose time-sensitive notification requirements to governmental authorities or consumers. We are also subject to emerging regulations, directives, voluntary commitments and guidance governing data security and cyber risk management for medical devices as well as emerging regulations, directives, voluntary commitments and guidance relating to artificial intelligence.”

Annual report 2025A · The company itself

“Emerging and evolving regulations related to AI use, transparency, safety, and accountability may require additional investment, changes to existing processes, or limitations on the development and application of these technologies.”

Annual report 2025A · The company itself

“Evolving rules, regulations and industry standards governing AI may require us to incur significant costs to modify, maintain, or align our business practices, solutions and services to comply with U.S. and non-U.S. rules and regulations, the nature of which cannot be determined at this time and may be inconsistent from jurisdiction to jurisdiction. Several jurisdictions where we operate are considering or have proposed or enacted legislation and policies regulating AI and non-personal data, such as the European Union’s AI Act.”

Annual report 2025A · The company itself

“We are subject to numerous, changing, and sometimes conflicting, legal regimes on matters as diverse as anticorruption, import/export controls, content requirements, trade restrictions, tariffs, taxation, sanctions, boycotts, immigration, internal and disclosure control obligations, securities regulation, including ESG regulation and reporting requirements, anti-competition, anti-money-laundering, data privacy and protection, government compliance, wage-and-hour standards, employment and labor relations, product liability, health and safety, environmental, human rights and AI regulations, such as the European Union’s AI Act.”

Annual report 2025A · The company itself

“GOVERNMENT REGULATION We operate globally and are subject to a wide range of laws and regulations in the U.S. and other countries where we operate, covering a wide variety of subject matters, including, but not limited to, those related to antitrust and competition, consumer protection, data privacy and security, and AI.”

Annual report 2025A · The company itself

“These local, state, federal and international laws and regulations relate to a number of aspects of our business, including trade laws such as import and export controls, anti-boycott, economic sanctions and embargoes, data and transaction processing security, payment card industry data security standards, antitrust and competition, consumer protection, records management, user-generated content hosted on websites we operate, privacy practices, data residency and transfer, AI, corporate governance, employment practices, immigration, employee and third-party complaints, anti-corruption, conflicts of interest, securities regulations, sustainability and other regulatory requirements affecting trade and investment.”

Annual report 2025A · The company itself

“The laws, regulations and codes above may impact our innovation and business drivers in developing new and emerging technologies (for example, AI and machine learning) and may impact demand for our solutions and has resulted in more onerous obligations in our contracts and changes to our business practices, and may require us to bear additional burdensome contractual obligations and make additional changes to our business practices in the future.”

Annual report 2025A · The company itself

“Moreover, AI is subject to a dynamic and rapidly evolving legal and regulatory environment, which, without appropriate review, governance and risk management, could expose the company to unforeseen legal or regulatory scrutiny and liabilities. As such, it remains uncertain how AI laws and regulations will impact our business or the associated cost or risks related to compliance therewith or with respect to embedding compliance mechanisms appropriately and effectively into our operations.”

Annual report 2025A · The company itself

“Our AI‑related activities also expose us to legal risks, as global regulatory frameworks—including U.S. federal and state initiatives, the European Union Artificial Intelligence Act, and other international laws—continue to evolve and impose new obligations concerning transparency, data governance, safety testing, human oversight, and vendor management. Compliance with these requirements could necessitate operational changes, delay deployments, increase costs, or limit our ability to use certain AI systems. Failure to successfully deploy AI technologies may result in missed innovation opportunities and competitive disadvantage.”

Annual report 2025A · The company itself

“Inadequate intellectual property protections •The products and services provided by some of our technology industry tenants and venture investment portfolio companies are subject to the threat of piracy and unauthorized copying, and inadequate intellectual property laws and other inadequate protections could prevent them from enforcing or defending their proprietary technologies. These tenants and venture investment portfolio companies may also face legal risks arising out of user-generated content.”

Annual report 2025A · The company itself

“In the U.S., federal, state, and local governments have enacted numerous data privacy and security laws. For example, the California Consumer Privacy Act of 2018, as amended (“CCPA”), applies to personal information of job applicants, employees, and independent contractors who are California residents and requires businesses to provide specific disclosures in privacy notices and honor requests of such individuals to exercise certain privacy rights. The CCPA provides for fines and allows private litigants affected by certain data breaches to recover significant statutory damages.”

Annual report 2025A · The company itself

“Our employees and personnel use generative artificial intelligence (“AI”) and/or automated decision-making technologies to perform their work, and the disclosure and use of personal information in AI technologies is subject to various privacy laws and other privacy obligations. Governments have passed and are likely to pass additional laws and regulations regulating AI and/or automated decision-making technologies. Our use of this technology could result in additional compliance costs, regulatory investigations and actions, and lawsuits. If we are unable to use AI and/or automated decision-making technologies, it could make our business less efficient and result in competitive disadvantages.”

Annual report 2025A · The company itself

“The frameworks often define requirements for marketing authorizations which vary by country. Failure to obtain appropriate marketing authorization and meet all local requirements, including specific quality and safety standards and new software and AI standards in any country in which we market our products, could cause commercial disruption and/or subject us to sanctions and fines.”

Annual report 2025A · The company itself

“Governments and regulators are actively developing new competition laws, regulations and actions aimed at the technology sector, AI and digital platforms, and global activities and expansion, including in large markets such as the United States, the EU, and China.”

Annual report 2025A · The company itself

“AI innovation presents risks and challenges that could impact our business. Our or our vendors’ AI technologies may be developed using inaccurate, incomplete, flawed or biased algorithms, training methodologies or data, which could lead to the dissemination of false information and result in competitive harm, regulatory penalties, legal liability, or brand or reputational harm.”

Annual report 2025A · The company itself

“Although we do not engage in developing or providing AI systems for which their placement on the market, putting into service, or use would qualify as “prohibited AI practices,” restrictions and obligations under this regulation, to the extent applicable to us, could have a negative impact on our business, global systems, financial condition and results of operations. Additionally, other jurisdictions have proposed, and in certain cases enacted, laws and regulations addressing aspects of the use and development of AI.”

Annual report 2025A · The company itself

“Regulatory restrictions or potential delays in the regulatory approval process for new products and features or the use of advanced technologies, non-traditional data sources, or large language models may impact our ability to innovate and enhance the competitiveness of our product offerings in the marketplace.”

Annual report 2025A · The company itself

“Regulatory restrictions on the use or development of artificial intelligence may impose additional compliance or reporting obligations, which may materially adversely affect our operations or ability to write business profitably in one or more jurisdictions.”

Annual report 2025A · The company itself

“Certain U.S. states have adopted or are considering regulations and guidance relating to the use of “big data,” AI, machine learning and other technology innovations in the insurance marketplace. For example, in December 2023, the NAIC adopted a model bulletin on the use of AI by insurers that sets forth governance, risk management and other requirements that insurers using AI are expected to establish.”

Annual report 2025A · The company itself

“The EU has also taken steps to regulate the use of data and algorithms used for the purpose of AI and automated decision-making. For example, the European Union Artificial Intelligence Act, which entered into force on August 1, 2024, with various requirements becoming effective at different points in time, broadly regulates the use of AI.”

Annual report 2025A · The company itself

“Furthermore, several of our businesses are required to comply with laws and regulations enacted by U.S. federal and state governments, the EU or other jurisdictions, or enacted by various regulatory organizations or exchanges relating to the privacy and security of the information of clients, employees or others. The variety of applicable privacy and information security laws and regulations exposes us to heightened regulatory scrutiny, requires us to incur significant technical, legal and other expenses in an effort to achieve and maintain compliance and will continue to impact our business in the future by increasing legal, operational and compliance costs.”

Annual report 2025A · The company itself

“There has also been increased regulatory scrutiny of the use of AI, data analytics, and predictive models, including in the insurance industry. Certain insurance regulators have developed, and others are developing, regulations or guidance applicable to insurance companies that use AI, data analytics, and predictive models in their operations. We cannot predict the impact of the regulatory actions that have been or may in the future be taken with regard to AI, data analytics, and predictive models, but any limitations or restrictions could have a material impact on our business, processes, results of operations and financial condition.”

Annual report 2025A · The company itself

“Globally and regionally, we continue to see enhanced legislative and regulatory interest regarding retirement investing and fiduciary initiatives, cybersecurity, technology, and operational resilience; the use of artificial intelligence (“AI”); responsible information and data collection, storage and use; financial crime prevention; and privacy matters, and we will continue to closely review and monitor any legislative or regulatory proposals and changes.”

Annual report 2025A · The company itself

“For example, the enacted European Union (“EU”) Artificial Intelligence Act and other laws related to AI are likely to influence how financial services firms design, build and deploy products and services incorporating AI, and process non-personal data.”

Annual report 2025A · The company itself

“We believe that genetics, together with the benefit of artificial intelligence and computational evidence, could meaningfully aid our search for new medicines and help guide our R&D decisions and investments, and have focused our R&D strategy on drug targets validated by genetic or other compelling human evidence. We have invested considerable time, energy and resources into developing our expertise in human genetics and acquiring access to libraries of genetic information, and are applying artificial intelligence to our R&D activities, including applying such technologies to advance our human data efforts and our generative biology platform that seek to discover and design new drugs.”

Annual report 2025A · The company itself

“Evolving rules, regulations and industry standards governing AI may require us to incur greater compliance costs and restrict the use of AI in our products or 18 technologies. Several jurisdictions where we operate are considering or have proposed or enacted legislation and policies regulating AI, including the European Union’s AI Act, and lack of consistency among different regulatory regimes may increase our regulatory and compliance burdens.”

Annual report 2025A · The company itself

“Our businesses are subject to extensive legal and regulatory oversight throughout the world, including the Irish Companies Act, the U.S. securities laws, rules, and regulations, the rules and regulations promulgated by the FCA and a variety of other laws, rules, and regulations addressing, among other things, licensing, data privacy, data management and data protection, artificial intelligence, trade sanctions laws, restrictions and export controls, anti-money laundering, wage-and-hour standards, employment and labor relations, antitrust and competition, anti-corruption, currency, reserves, government contracting, and the amount of local investment with respect to our operations in certain countries.”

Annual report 2025A · The company itself

“Changes in laws and regulations could mandate significant and costly changes to the way we implement our services and solutions, impose additional licensure requirements or costs to our operations, workforce and services, or cause us to cease offering certain services or solutions.”

Annual report 2025A · The company itself

“In addition to federal and other financial institution-specific privacy laws and regulations, an increasing number of states are considering and passing comprehensive privacy legislation, as well as laws or regulations around automated decision making or 31 Table of Contents artificial intelligence (“AI”) technologies. Moreover, the issues surrounding data security and the safeguarding of consumers’ protected information are under increasing regulatory scrutiny by state and federal regulators.”

Annual report 2025A · The company itself

“Regulations related to AI Technologies continue to evolve and may also impose on us certain obligations and costs related to monitoring and compliance. The costs of preparing for, monitoring and complying with laws and regulations related to AI Technologies, and any claims or penalties as the result of any use of or reliance on AI Technologies, could, if applicable, adversely affect us, us and/or third parties connected to us (whether directly or indirectly), which could adversely affect our business and results of operations.”

Annual report 2025A · The company itself

“Risks and costs related to new and changing laws, regulations, executive orders, directives, and enforcement priorities increase as the Company’s products and services are introduced into specialized applications, including health and financial services, or as the Company expands the use of technologies, such as machine learning and artificial intelligence features, and must navigate new legal, regulatory and ethical considerations relating to such technologies.”

Annual report 2025A · The company itself

“The risks of inadvertent disclosure of personal data can increase with the introduction of new and complex technologies, such as artificial intelligence features, further exacerbating such risks.”

Annual report 2025A · The company itself

“At the state level, in 2025, several hundred bills related to AI were introduced across all 50 states in the U.S.”

Annual report 2025A · The company itself

“Additionally, the regulatory landscape surrounding traditional AI and generative AI is evolving, and the expanded use of these technologies may become subject to regulatory scrutiny under new or existing laws. Moreover, the intellectual property and ownership rights associated with both forms of artificial intelligence have not been fully addressed by courts in the U.S. or in other jurisdictions that we operate in.”

Annual report 2025A · The company itself

“The EU has also adopted the EU Artificial Intelligence Act, which applies on a phased basis beginning in 2025 and is intended to regulate certain artificial intelligence systems based on their level of risk. Depending on our and our portfolio companies’ use of artificial intelligence technologies, we may be required to implement additional governance, risk management, documentation and compliance measures to comply with the EU Artificial Intelligence Act.”

Annual report 2025A · The company itself

“Finally, governments and regulators in the U.S. and abroad have proposed, adopted or are considering laws, regulations and guidance governing the development, deployment and use of artificial intelligence systems, including requirements relating to transparency, accountability, data governance, risk management, human oversight, cybersecurity, intellectual property and recordkeeping. For example, the European Union has adopted the EU Artificial Intelligence Act, which applies on a phased basis that began in 2025 and a numbers of U.S. states have enacted general artificial intelligence laws.”

Annual report 2025A · The company itself

“AI-related laws and regulations continue to remain uncertain and may vary from jurisdiction to jurisdiction.”

Annual report 2025A · The company itself

“Government regulation addressing AI ethics, transparency requirements, or other aspects of the development, or use, or deployment of AI may also increase the burden and cost of research, development, and other activities, which may increase our costs, limit our ability to leverage AI, and subject us to brand or reputational harm, competitive harm, or legal liability. For example, the European Union’s Artificial Intelligence Act (the “AI Act”), which achieved approval by the European Council on February 2, 2024, and the European Parliament on March 13, 2024, imposes obligations on providers and users of AI technologies.”

Annual report 2026A · The company itself

“Under 2025 visar marknadsanalyser en tydlig ökning i behovet av expertis inom följande områden: • Informationssäkerhet och regelefterlevnad: – Ökandesäkerhetshotgörattföretagmåstestärkaskyddet av känslig information och säkerställa robusta IT-system. – Striktarelagstiftning,såsomEU:sAI-förordning,NIS2- direktivet och GDPR, ställer högre krav på säkerhetsrutiner, riskhantering och efterlevnad. – Organisationerbehöverförbättrasinförmågaatthantera dataintrång och säkerställa regelefterlevnad. • AI och dataanalys: Företag investerar i AI och avancerad dataanalys för att stärka sin beslutsförmåga och skapa affärsvärde. • Molntjänster och IT-infrastruktur: Ökad efterfrågan på flexibla och skalbara lösningar driver behovet av expertis inom moln arkitektur och drift. • Automatisering och digital transformation: Företag fokuserar på att effektivisera verksamheten genom automatiserade processer och innovativa digitala lösningar.”

Annual report 2024A · The company itself

“Regelverken för medicintekniska produkter blir allt striktare, vilket innebär att Bactiguards starka kliniska evidens blir en ännu viktigare konkurrensfördel.”

Annual report 2024A · The company itself

“Regulation General BD's operations are global and are affected by complex state, federal and international laws relating to healthcare, environmental protection, occupational health and safety, antitrust, anti-corruption, marketing, fraud and abuse (including anti-kickback and false claims laws), export control, transportation, product safety and efficacy, employment, labor, privacy and data protection, customs, exports, artificial intelligence (“AI”) and other areas. Many of the agencies enforcing these laws have increased their enforcement activities with respect to medical device manufacturers in recent years.”

Annual report 2025A · The company itself

“These laws, rules and regulations require, among other things, proactive implementation of comprehensive compliance programs, continuous enhancement of internal policies, business practices, processes, and integration of technical and organizational safeguards across all assets and activities that process personal data. These requirements often entail operational constraints and higher compliance costs and may require us to modify existing or future products, potentially impacting innovation timelines and financial performance.”

Annual report 2025A · The company itself

“Since the use of AI is subject to new or evolving laws and regulations, compliance may impose operational costs and limit our ability to use AI-based software, and failure to comply may result in potential government actions, litigation, fines, penalties or adverse publicity.”

Annual report 2025A · The company itself

“Digital Omnibus In November 2025, the EC proposed a Digital Omnibus package intended to take a holistic view across digital legislation at the EU level, including the EU AI Act, GDPR, Data Act, ePrivacy Directive and cybersecurity laws to reduce complexity and duplication. The package proposes a delay to the introduction of rules relating to high-risk AI uses pending development of compliance guidance, targeted changes to data protection rules under GDPR to facilitate data use in the development and operation of AI models and systems, and streamlining incident reporting obligations.”

Annual report 2025A · The company itself

“The regulatory landscape related to AI remains uncertain, and we may be required to devote significant resources to comply with developing laws and address ethical concerns.”

Annual report 2025A · The company itself

“These technologies are subject to an evolving and fragmented legal and regulatory landscape. The absence of a unified regulatory framework, and the risk of divergent or conflicting regulations across jurisdictions applicable to our business, could increase the complexity and costs of compliance for us and our clients. New or changing legal requirements may limit or restrict our use of AI, impose burdensome obligations, or require us to modify or discontinue certain offerings.”

Annual report 2026A · The company itself

“Hårdare krav på miljö, socialt ansvar och bolagsstyrning (ESG) kan öka kostnaderna för Carasent. Exempelvis kan bolagets energiförbrukning, avfall och AI-användning bli föremål för regleringar som innebär sanktionsavgifter vid bristande efterlevnad. Detta kan påverka resultatet och renomméet negativt.”

Annual report 2024A · The company itself

“The laws, rules, standards, and guidance relating to AI are developing rapidly and vary across jurisdictions. We may be subject to evolving requirements regarding transparency, fairness, explainability, safety, data usage and provenance, content integrity, consumer protection, and algorithmic accountability. If we use AI in ways that regulators view as unfair, deceptive, discriminatory, or otherwise noncompliant, we could face heightened scrutiny, investigations, enforcement actions, private litigation, or requirements to modify, suspend, or cease certain AI-enabled practices.”

Annual report 2025A · The company itself

“The rapid development and deployment of tools that leverage AI is also causing governments to consider and implement regulation of AI. Such increased focus and potential government regulation of AI may also increase the burden and cost of compliance in this area, subjecting us to brand or reputational harm, competitive harm, and legal liability.”

Annual report 2025A · The company itself

“Colorado passed the Colorado Artificial Intelligence Act (“CAIA”) which will take effect on June 30, 2026. The CAIA governs the use of certain Artificial Intelligence systems.”

Annual report 2025A · The company itself

“AI-related issues, deficiencies or failures could give rise to legal or regulatory action, including with respect to proposed legislation regulating AI or as a result of new applications of existing data protection, privacy, intellectual property and other laws, and could damage our reputation or otherwise materially harm our business.”

Annual report 2025A · The company itself

“Moreover, AI technology is subject to rapidly evolving domestic and international laws and regulations, including executive orders by the U.S. government and the EU’s Artificial Intelligence Act, which could impose significant costs and obligations on the Company.”

Annual report 2025A · The company itself

“The regulatory environment governing AI is rapidly evolving in the U.S. and internationally. Existing and new laws, regulations, industry standards and governmental guidance relating to AI, data privacy, cybersecurity, intellectual property, transparency, consumer protection, employment practices and automated decision-making may increase our compliance costs, restrict our ability to develop and deploy AI solutions, require changes to our business practices or expose us to regulatory investigations, enforcement actions, penalties or litigation.”

Annual report 2026A · The company itself

“Government Regulation We are subject to numerous regulations and laws in the United States and abroad that involve matters central to our business. Many of these regulations and laws are evolving and their applicability and scope, as interpreted by courts and regulators, remain uncertain. These regulations and laws involve a variety of matters including privacy, data protection and personal information, cybersecurity, operational resilience, AI, tax, trade, encryption technology, environmental sustainability (including climate change), human rights, product certification, and national security.”

Annual report 2026A · The company itself

“The AI-related legal and regulatory landscape is complex and constantly evolving and therefore remains uncertain and may be inconsistent from jurisdiction to jurisdiction. Our obligations to comply with this complex and evolving legal and regulatory landscape could entail significant compliance or other costs or limit our ability to incorporate certain AI capabilities into our offerings.”

Annual report 2026A · The company itself

“Additional areas of uncertainty that could impact sales of our products and services include laws, regulations, or customer procurement requirements related to encryption technology, data, AI, privacy, cybersecurity, sovereignty, localization, operational resilience, environmental sustainability (including climate change), human rights, product certification, product and digital accessibility, country of origin, sourcing, national security, and other security controls applicable to our offerings and supply chain.”

Annual report 2026A · The company itself

“The regulatory environment related to information security, privacy, data collection, data usage and use of artificial intelligence is increasingly rigorous and complex, and any failure to comply may carry significant penalties and reputational damage.”

Annual report 2025A · The company itself

“New and evolving laws and regulations relating to cybersecurity, data privacy, and AI impose requirements for information confidentiality, integrity, availability, personal and proprietary data collection, storage, use, sharing, deletion, and AI solutions that must be safe, transparent, fair, secure, human-focused, and accountable. Such laws, standards, and market expectations could cause us to incur additional direct costs for compliance, as well as increased indirect costs resulting from our customers, suppliers, or partners reluctance to share information or solutions due to actual or perceived inadequate controls.”

Annual report 2026A · The company itself

“In addition, the legal, regulatory and ethics landscape around the use of AI continues to rapidly evolve.”

Annual report 2025A · The company itself

“We continue to evaluate emerging technologies like artificial intelligence, machine learning, and generative artificial intelligence for incorporation into our business to augment our products and services. Such technologies present unique business opportunities along with ever-changing legal and regulatory risks. Both state and federal regulations relating to these emerging technologies are quickly and constantly evolving and may require significant resources to modify and maintain business practices to comply with laws, the nature of which cannot be determined at this time. Our failure to accurately identify and address our responsibilities and liabilities in this new environment could negatively affect any solutions we develop incorporating such technology and could subject us to reputational harm, regulatory action, or litigation, which may harm our financial condition and operating results.”

Annual report 2025A · The company itself

“Data protection and privacy laws and regulations are evolving globally, and may continue to add additional compliance costs and legal risks to our operations. The costs of compliance with, and other burdens imposed by these data protection laws and regulations and other new laws, regulations and policies implementing these regulations may impact our operations and may limit the ways in which we can provide services and operate, use or otherwise process personal data collected while providing services. For example, data protection and privacy laws and regulations regarding the use of artificial intelligence and machine learning continue to evolve and mature, and as our use of such technologies increases, we may be required to invest additional resources, expend additional compliance costs and assume additional legal risk to our operations.”

Annual report 2025A · The company itself

“The rapid evolution of AI, including the development of government regulation of AI and automated decision-making technology more generally, may require significant resources to continually develop, test, and maintain our platform, offerings, services, and features so that we can implement AI and automated decision-making technology in a manner that complies with applicable laws and regulations and ethically in order to minimize unintended, harmful impact. Increased regulation could also limit or impair our ability to develop and deploy AI technology within our platform that would otherwise be beneficial to us or merchants, consumers and Dashers.”

Annual report 2025A · The company itself

“For example, the EU has recently enacted, and is in the process of enacting, various laws and regulations that govern digital services and AI, and impose environmental sustainability obligations and disclosure requirements on businesses like ours.”

Annual report 2025A · The company itself

“However, the introduction of AI technologies, particularly generative AI, into internal processes and/or new and existing offerings may result in new or expanded risks and liabilities, including due to enhanced governmental or regulatory scrutiny, litigation, compliance issues, ethical concerns, confidentiality or security risks, as well as other factors that could adversely affect our business, reputation, and financial results. Furthermore, any confidential information that is disclosed to a third-party generative AI platform could be leaked or disclosed to others, which could result in loss or theft of intellectual property, as well as subject us to risks related to intellectual property infringement or misappropriation, data privacy and cybersecurity.”

Annual report 2025A · The company itself

“We are subject to a variety of continuously evolving federal, state and international laws and rules regarding collection, dissemination, receipt, maintenance, protection, use, transmission, disclosure, privacy, confidentiality, security, availability, integrity, creation, processing and disposal of sensitive or confidential information that, depending on the specific business and intended data use, include without limitation, HIPAA's privacy and security rules, HIPAA's HITECH rule, the Gramm-Leach-Bliley Act, the General Data Protection Regulation and numerous state laws governing personal information, including the California Consumer Privacy Act, as amended by the California Privacy Rights Act. Regulators are also imposing new and greater monetary fines or penalties for privacy violations, and jurisdictions where we operate have passed, and continue to propose, data privacy legislation and/or regulations related to Artificial Intelligence (“AI”).”

Annual report 2025A · The company itself

“Our AI-related efforts may give rise to risks related to accuracy, harmful bias, discrimination, intellectual property infringement, data privacy, and cybersecurity, among others. In addition, we may be subject to new or enhanced governmental or regulatory scrutiny, litigation or other liability and ethical concerns, and negative consumer perceptions as to the use of automation and AI, or other complications that could adversely affect our business, reputation, or financial results.”

Annual report 2025A · The company itself

“Betydande resurser har lagts på att stärka cybersäkerhetsfunktionaliteten och möta de krav som införs med NIS2-direktivet i EU AFFÄRSENHET WESTERMO Fokussegment 2025 Marknadsposition Potential Tåg stod för 34 procent av försäljningen 2024.”

Annual report 2024A · The company itself

“Our use of artificial intelligence could lead to new or enhanced governmental or regulatory scrutiny, litigation or other legal liability, concerns about ethical use and privacy, negative consumer and customer impacts, and negative perceptions of artificial intelligence generally, all of which could adversely affect our business, reputation or financial results.”

Annual report 2025A · The company itself

“We expect there may also be forthcoming regulation in areas of regulating the responsible use of AI, such as the proposed EU Artificial Intelligence Act and the introduction of heightened measures to be adopted with respect to cybersecurity, operational resilience, data privacy, sustainability, taxation and data security, any of which could impact us and our customers.”

Annual report 2025A · The company itself

“Vårt mål är att optimera och förbättra den interna verksamheten genom AI och avancerade analyser, samt att öka automatisering och robotisering av produktion, distribution, logistik och administration. Under 2024 undertecknade Essity EU:s AI-pakt som stärker vårt åtagande om en ansvarsfull AI-utveckling och förbereder oss för EU:s AI-rättsakt. För att uppfylla EU:s standarder om säkerhet, rättvisa och ansvarsskyldighet har vi inrättat styrningsstrukturer, infört åtgärder för ökad transparens och främjat AI-kunskap, allt i enlighet med vår AI-etikpolicy.”

Annual report 2024A · The company itself

“In addition, evolving laws, regulations, and governmental guidance relating to AI may require us to incur additional compliance costs, change our business practices, or limit our ability to develop or use AI technologies.”

Annual report 2026A · The company itself

“In addition, in the United States and internationally, there has been increased legislative and regulatory activity related to Cybersecurity and AI and the risks and challenges AI poses, including the European Union’s Artificial Intelligence Act, the Colorado AI Act, and other similar state laws that have been or will be enacted.”

Annual report 2026A · The company itself

“Laws and regulations regarding data privacy, data security, cybersecurity, and AI in North America continue to be updated and expanded. Enforcement actions relating to these areas continue to increase and be an area of focus.”

Annual report 2026A · The company itself

“AI also presents emerging ethical issues and if our use of AI becomes controversial, we -12- Table of Contents may experience brand or reputational harm, competitive harm, or legal liability. The rapid evolution of AI, including potential government regulation of AI, may require us to dedicate significant resources to develop, test, implement, and maintain our AI solutions.”

Annual report 2026A · The company itself

“Legislation and regulations governing the development or use of artificial intelligence and automated-decision making have been implemented or are under consideration in the U.S. at the state and local level, as well as internationally. Such legislation and regulations may impose obligations related to our development, offering, and use of artificial intelligence, particularly those use cases that are deemed by the law to be “high risk”, and expose us to increased risk of regulatory enforcement and litigation. As a result, our ability to use artificial intelligence and machine learning may be constrained by current or future laws, regulatory or self-regulatory requirements.”

Annual report 2025A · The company itself

“Shifting public policy regarding data privacy and the effects of artificial intelligence has caused and may in the future cause us to incur substantial costs to modify our operations or business practices, reduce consumers’ willingness to engage with our offerings, or cause delays or lapses in the availability of our products or services in various jurisdictions.”

Annual report 2025A · The company itself

“In addition, autonomous vehicle and driver assist technologies, including BlueCruise, continue to be scrutinized by government regulators and consumers, and actual or perceived failures or misuse of these technologies and features have led to government investigations and inquiries, including of Ford. Such negative publicity of our products or those of our competitors could undermine consumer trust and negatively impact our subscription rates.”

Annual report 2025A · The company itself

“The rapid evolution of AI, including potential government regulation of AI, may require significant additional resources related to AI in our solutions. Our AI-related initiatives may result in new or enhanced governmental or regulatory 36 Table of Contents scrutiny, including regarding the use of AI in our solutions and the marketing of products using AI, litigation, customer reporting or documentation requirements, ethical or social concerns, or other complications.”

Annual report 2025A · The company itself

“•Third parties may claim that we are infringing or misappropriating their intellectual property rights and we could suffer significant litigation expenses, losses, or licensing expenses or be prevented from selling products or services. •Our restructuring activities could have long-term adverse effects on our business. •We are subject to a variety of litigation and other legal and regulatory proceedings in the course of our business that could adversely affect our financial results. •Climate change, or legal or regulatory measures to address climate change, may negatively affect us. •We use artificial intelligence in our business and in certain of our products, and challenges with properly managing its use could result in reputational harm, competitive harm, and legal liability, and adversely affect our results of operations.”

Annual report 2025A · The company itself

“Globally, courts and regulatory agencies are developing approaches to dealing with AI-related issues, which creates uncertainty around the use of the technology.”

Annual report 2025A · The company itself

“As AI is an emerging area, we expect to see increased legislation, such as the EU Artificial Intelligence Act, and additional regulatory obligations across the jurisdictions in which we operate.”

Annual report 2025A · The company itself

“Additionally, we are subject to an increasing number of laws in the various jurisdictions in which we operate as well as governmental regulations relating to taxes, environmental protection, product quality standards, cybersecurity, machine learning, artificial intelligence, data privacy, building and zoning requirements, and employment law matters.”

Annual report 2025A · The company itself

“Lovkrav og forordninger vil påvirke bransjen i tiden fremover, særlig når det gjelder IT-sikkerhet, kunstig intelligens, personvern og bærekraft (klima, miljø, arbeidstakerrettigheter, helse, mangfold med mer).”

Annual report 2024A · The company itself

“Tabell: Tiltak og ressurser for risiko knyttet til forbrukere og sluttbrukere Risiko Tiltak/strategi Status Evaluering Tidshorisont Endrede rammebetingelser og håndhevelsen av disse kan medføre betydelig kostnadspåslag samt behov for å forenkle tilbudet av multimediale læremidler.”

Annual report 2024A · The company itself

“Pålitelighet og kvalitet er kjernen i det vi gjør, og ved å benytte ny teknologi som KI, er vi forpliktet til å sikre at implementering og eksperimentering følger våre verdier. Gyldendal har overordnede retningslinjer for ansvarlig bruk av KI med mål om å gi støtte på tvers av våre virksomheter og merkevarer.”

Annual report 2024A · The company itself

“There has also been increased regulatory scrutiny of the use of emerging technologies related to artificial intelligence, including machine learning, predictive analytics and other “big data" techniques, and the potential for unfair discrimination or unintended bias arising from such use. We may be subject to new regulations that could materially adversely affect our operations or ability to write business profitably in one or more jurisdictions.”

Annual report 2025A · The company itself

“In addition, our digital games and online services are subject to evolving laws and regulations relating to online safety (including protections for minors), digital 29 Table of Contents content and in-game purchases, advertising and consumer disclosures, and the use of player data, and increased regulatory scrutiny in these areas could increase compliance costs, restrict certain features or monetization practices, or subject us to investigations, enforcement actions, fines or litigation.”

Annual report 2025A · The company itself

“The legal requirements relating to AI continue to evolve and remain uncertain, including how legal developments could impact our business and ability to enforce our proprietary rights or protect against infringement of those rights, and may expose us to claims, inquiries, demands and proceedings by private parties and global regulatory authorities and subject us to legal liability as well as reputational harm. New laws and regulations governing AI use are being adopted, and existing laws and regulations may be interpreted in ways that would affect our business operations and the way in which we use AI.”

Annual report 2025A · The company itself

“In addition, there is uncertainty around the validity and enforceability of intellectual property rights related to our use, development, and deployment of AI and AI systems and solutions. Our use of AI technologies, whether created by us for internal or customer use cases or otherwise incorporated from external sources into our offerings, could lead to claims of infringement of third-party intellectual property rights, or allegations of non-compliance with the law.”

Annual report 2025A · The company itself

“Till exempel har strängare regler antagits som till exempel i EU, eller håller på att utvecklas i flera jurisdiktioner avseende användningen av artificiell intelligens i produktutveckling och lösningsdistribution.”

Annual report 2024A · The company itself

“As our customers expect a more personalized experience, our ability to collect, use, retain, and protect relevant customer data is important for effectively meeting their expectations. Our ability to collect and use that data, however, is subject to a number of external factors, including the impact of legislation or regulations governing data privacy, data-driven technologies such as AI, and data security, as well as customer expectations around data collection, retention, and use.”

Annual report 2026A · The company itself

“These deficiencies and other failures of AI systems, or the use of AI systems, could subject us to competitive harm, regulatory action, legal liability, including under new proposed legislation regulating AI in jurisdictions such as the U.S. and European Union, new applications of existing data protection, privacy, intellectual property, and other laws, and brand or reputational harm. Additionally, our obligations to comply with the evolving legal and regulatory landscape could entail significant costs or limit our ability to incorporate certain AI capabilities into our products and solutions.”

Annual report 2025A · The company itself

“Additionally, the rapid evolution and increased adoption of AI technologies and our obligations to comply with emerging laws and regulations may require us to develop additional AI-specific governance programs, which could entail significant costs or limit our ability to incorporate certain AI capabilities into our products and solutions.”

Annual report 2025A · The company itself

“Hubbell is also subject to an increasing number of evolving data privacy and security laws and regulations that impose requirements on the Company and our technology prior to certain use or transfer, storing, processing, disclosure, and protection of data and prior to sale or use of certain technologies. Failure to comply with such laws and regulations could result in the imposition of fines, penalties and other costs.”

Annual report 2025A · The company itself

“These systems require an ongoing commitment of significant resources to maintain, protect, and enhance existing systems and develop and integrate new systems, including systems powered by or incorporating artificial intelligence and machine learning (including generative AI) (AI/ML), to keep pace with continuing changes in information processing technology, evolving industry and regulatory standards, and changing customer preferences, and even with such resources there is no assurance that we will be able to do so. In addition, changes to laws, regulations and guidance regarding how we may use AI/ML could make 22 it harder for us to conduct our business using AI/ML, require us to retrain our AI/ML, delete data produced by our AI/ML, or prevent or limit our use of AI/ML. Our use of AI/ML technologies could also result in additional compliance costs, regulatory investigations, actions, fines or penalties, and consumer or other lawsuits.”

Annual report 2025A · The company itself

“Further, as the company expands its customer base and the scope of its offerings, both within the U.S. and globally, it may be impacted by additional regulatory or other risks, including, compliance with U.S. and foreign data privacy requirements, outbound investment restrictions, AI and cloud regulations, data localization requirements, labor relations laws, enforcement of IP protection laws, laws relating to anti-corruption, anti-competition regulations, and import, export and trade restrictions.”

Annual report 2025A · The company itself

“Our products that use generative or other forms of artificial intelligence (“AI”) may also be subject to new and emerging law and regulations, including the European Union’s Artificial Intelligence Act enacted in August 2024.”

Annual report 2025A · The company itself

“AI systems are currently deployed in our business operations and any additional AI systems to the extent developed or deployed in our business operations or in our products, we will be subject to AI regulations governing AI systems. We are engaged in regular reviews of development and licensing of software used in the business for compliance with relevant AI regulations.”

Annual report 2025A · The company itself

“The digital asset industry is subject to rapidly evolving and uncertain regulations at both the state and federal levels. Changes in laws or enforcement patterns, such as those related to anti-money laundering (AML) and tax reporting, could impact our ability to operate the business.”

Annual report 2025A · The company itself

“The recently enacted GENIUS Act in the U.S. establishes a framework for regulating stablecoins and legislative proposals in the U.S. and EU that, if enacted, will regulate digital assets and could adversely affect our ability to compete if they permit different standards or requirements for certain entities or technologies.”

Annual report 2025A · The company itself

“In addition, the use of such technologies is governed by an evolving set of laws and regulations, and there is no single global regulatory framework for artificial intelligence, which creates further uncertainties regarding compliance with such laws and regulations. As a result, our ability to leverage artificial intelligence could be restricted by burdensome and costly legal requirements.”

Annual report 2025A · The company itself

“Multiple jurisdictions, including Europe, the U.S. federal government, and certain U.S. states, have already proposed or enacted laws, regulations, and other requirements governing AI. In Europe, the EU AI Act, adopted in May 2024, entered its implementation phase in 2025 and imposes extensive transparency, risk management and data governance obligations for AI systems, particularly those classified as high risk, with significant fines for noncompliance.”

Annual report 2025A · The company itself

“K AI-risk (artificiell intelligens) AI-system kan användas inom specifika områden, men om de inte kontrolleras på rätt sätt kan AI medföra risker som på ett negativt sätt kan påverka kunders och anställdas hälsa, säkerhet eller grundläggande rättigheter. Intrum har inlett ett AI-projekt för att säkerställa en säker, trovärdig, transparent och respektfull användning av AI-system.”

Annual report 2024A · The company itself

“Our new Center for Defensible Data and AI and our AI Governance Council support employee compliance with our guiding principles of Defensible AI, Trustworthy AI, and Responsible and Ethical AI. This helps us to maintain high standards across the business, and supports our compliance with existing laws (e.g., clinical, employment, intellectual property, consumer protection, competition) and emerging AI regulation such as the European Union’s Artificial Intelligence Act (the "EU AI Act") and the Colorado AI Act.”

Annual report 2025A · The company itself

“Finally, emerging AI technology, such as AI and generative AI systems, have become subject to regulation under new laws and new applications of prior existing laws which require additional resources and increase compliance risks as we integrate AI into our services.”

Annual report 2025A · The company itself

“The use of AI in our product initiatives and offerings or services, or in our internal business operations, may give rise to risks related to accuracy, bias, discrimination, intellectual property infringement, misappropriation or leakage of proprietary, confidential and personal information, defamation, data privacy, and cybersecurity. Any error, defect, or vulnerability in our AI-powered products or business processes could undermine the quality of our products and services, adversely impact our clients’ businesses, subject us or our clients to regulatory scrutiny, fines or litigation and cause reputational harm.”

Annual report 2025A · The company itself

“The legal and regulatory environment relating to AI is uncertain and evolving, and any changes to applicable laws and regulations could require changes to our use of AI technology and could cause an increase in associated costs and expenses.”

Annual report 2025A · The company itself

“In an effort to improve information security, governments may enact rules, regulations, standards and attestation requirements. These requirements may be unclear, onerous, and compliance may be burdensome and costly.”

Annual report 2025A · The company itself

“Legal and regulatory obligations related to artificial intelligence may prevent or limit our ability to use artificial intelligence in our business, lead to regulatory fines or penalties, require implementation of costly compliance measures, or require us to change our business practices. If we cannot use artificial intelligence, or that use is restricted, our business may be less efficient, or we may be at a competitive disadvantage.”

Annual report 2025A · The company itself

“Moreover, regulation of artificial intelligence, including generative artificial intelligence, machine learning, and similar data-driven technologies (collectively, “AI”) is rapidly evolving and legislators and regulators worldwide are increasingly focused on these powerful emerging technologies. The technologies underlying AI and its uses are subject to a variety of laws and regulations, including intellectual property, data privacy (including automated decision making), cybersecurity, consumer protection, competition and equal opportunity laws and regulations, and are expected to be subject to additional regulation, new legal frameworks or new application of existing frameworks. In particular, several states, including Colorado and California, have passed or proposed laws and regulations that specifically address various facets and uses of AI. In Europe, the EU’s Artificial Intelligence Act (the “AI Act”), which began phasing-in in 2025, establishes, among other things, a risk-based governance framework for regulating AI systems operating in the EU.”

Annual report 2026A · The company itself

“In addition, developing laws and regulations related to AI or other emerging technologies create uncertainty, may require significant resources to adjust business practices for compliance, and in some cases, may limit our ability to use AI-based software. Several governmental authorities have already proposed or enacted laws and other guidance governing AI, such as the EU Artificial Intelligence Act.”

Annual report 2025A · The company itself

“We are required to comply with federal, state and international laws regarding privacy and the storing, sharing, use, disclosure and protection of personally identifiable information and user data, an area that is increasingly subject to legislation and regulations in numerous jurisdictions around the world, including the European Union’s GDPR (as defined and discussed below in Item 1A.—Risk Factors) and the California Consumer Protection Act. In addition, the Digital Services Act (“DSA”) in the European Union came into force in November 2022 and the majority of its substantive provisions took effect in February 2024. The DSA imposes new obligations around illegal services or content on our sites, traceability of business users, and enhanced transparency measures.”

Annual report 2025A · The company itself

“In addition, rules and regulations are being introduced, or are being considered, in the areas of AI, information security and climate change, which may also affect CNA’s business.”

Annual report 2025A · The company itself

“Further, the rapidly evolving legal and regulatory environment relating to AI and privacy could impact our implementation of AI technology and increase compliance costs and the risk of non-compliance. Flaws, breaches, or malfunctions in these systems could lead to operational disruptions, data loss, erroneous decision-making, regulatory scrutiny, reputational harm, or legal liability.”

Annual report 2026A · The company itself

“New technology trends, such as AI, require us to keep pace with evolving regulations and industry standards. Various current and proposed regulatory frameworks in the U.S., the European Union, China and other jurisdictions address the development and use of AI in products and services. We expect that the legal and regulatory environment relating to emerging technologies such as AI will continue to develop and could increase the cost of doing business, and create compliance risks and potential liability, all which may have an adverse effect on our financial condition and results of operations.”

Annual report 2026A · The company itself

“In addition, the complex and dynamic regulatory environment surrounding artificial intelligence (“AI”), including generative AI, subjects us to a variety of risks. These risks include, but are not limited to, data privacy and security vulnerabilities, intellectual property patent, copyright, and misappropriation claims, unauthorized third-party usage of data associated with training models, and malicious use and advanced deceitful communication methods.”

Annual report 2025A · The company itself

“The legal and regulatory environment relating to AI is uncertain and rapidly evolving, and includes regulation targeted specifically at AI as well as provisions in intellectual property, privacy, consumer protection, employment and other laws 38 applicable to the use of AI. These evolving laws and regulations could require changes in the Company’s or third parties’ implementation of AI technology and increase the Company’s compliance costs and risk of non-compliance.”

Annual report 2025A · The company itself

“We are subject to numerous, complex, and frequently changing laws, regulations, and contractual obligations designed to protect personal information. Various U.S. federal and state laws, non-U.S. laws, payment card industry security standards, and other information privacy and security standards are all applicable to us.”

Annual report 2025A · The company itself

“Further, emerging global and U.S. regulations governing AI use – including requirements for responsible use, transparency, bias mitigation, accountability, and explainability – may impose significant compliance obligations and increase reputational risk. Failure to comply with these standards or to effectively manage associated risks, including ethical considerations such as fairness, non-discrimination, and responsible deployment, could result in regulatory penalties, litigation, operational setbacks, or adverse brand perceptions.”

Annual report 2025A · The company itself

“Additionally, AI laws and guidance are rapidly expanding and changing, with potential differences or conflicts across jurisdictions. This creates uncertainty and regulatory risk, including for healthcare-related uses of AI. If we or our third-party providers are restricted from using AI as a result of any laws, regulatory views, or other measures, it could impact our operations and competitiveness, increase our compliance expense and burden (including related to any documentation, risk management, or transparency measures), and cause us to modify our use, development, or deployment of AI and incur substantial costs.”

Annual report 2026A · The company itself

“In addition, as a result of the release and availability of AI technologies, including generative AI platforms, we have seen a global trend toward more comprehensive regulation of AI designed to ensure the ethical use, security, and privacy of AI and create standards for transparency, accountability, and fairness, including the EU AI Act, which may impact our business.”

Annual report 2026A · The company itself

“Furthermore, consumer protection laws, big data, artificial intelligence (“AI”), cybersecurity, privacy and data protection, anti-money laundering, securities, commodities, broker-dealer and investment adviser regulations, environmental and unclaimed property laws and regulations, and the Employee Retirement Income Security Act of 1974 (“ERISA”) also apply to some of MetLife’s operations, products and services.”

Annual report 2025A · The company itself

“For instance, it is expected that laws and regulations around the use of AI and machine learning tools will increase over the next few years, but it is unknown at this time what these laws and regulations will address and how and whether they will be adopted globally. As we introduce AI and machine learning into our technology platform (as well as those of our customers through provision of our services), we could become subject to these new regulations, which may be difficult to comply with.”

Annual report 2025A · The company itself

“Furthermore, as the legal and regulatory environment for artificial intelligence and other emerging technologies continues to evolve, our compliance obligations may significantly increase our costs or limit the extent to which we are able to use these technologies.”

Annual report 2025A · The company itself

“We operate in a global market, and our use of AI is subject to different levels of regulations in different markets. These differences, as well as changes in the way AI is regulated—including potential new requirements governing transparency, accountability, data usage, and model controls—could increase our compliance costs, limit the use of certain technologies, or require changes to our products and processes.”

Annual report 2025A · The company itself

“Speculation concerning the impact of legislative, regulatory and government initiatives, including initiatives related to the emerging technology of AI systems, operational resilience, data privacy and climate-related risks, among others, that our products and services incorporate, and the increased uncertainty over potential liability and adverse legal or judicial determinations may negatively affect Moody's stock price, affect demand for our products and services, increase our costs of operations and impact our future business plans.”

Annual report 2025A · The company itself

“Certain products currently offered by MIS may fall into scope of the EU Regulation on ESG Rating Activities, which could impose new substantive and procedural requirements on MIS relating to those products similar to those applicable to credit ratings. In addition, EU CRAs are also subject to DORA, which imposes a range of requirements in relation to the management of ICT risk, regulatory reporting, testing and the management of risks related to ICT services provided by third-parties.”

Annual report 2025A · The company itself

“The EU AI Act has introduced a risk-based framework for regulating AI systems which applies different obligations to various participants in the AI supply chain. Compliance with the regulation, in its current form, could increase the Company’s costs and expose it to the risk of penalties or fines for noncompliance; however, the ultimate impact of the EU AI Act on the Company remains uncertain, as the European Commission has proposed measures intended to reduce the regulatory burden on businesses.”

Annual report 2025A · The company itself

“In the past year, Netcompany has further enhanced its approach to AI management and compliance in alignment with the EU AI Act and our obligations as an AI system provider. We have introduced structured compliance procedures to assess prohibited practices, high-risk AI systems, and core AI obligations across AI-related projects and services, and we are strengthening our commitment to AI literacy and transparency, by developing tailored training materials for customers and end users. We are including contractual warranties regarding the intended use of AI systems, with mechanisms in place for notification and review if the use case changes during the lifecycle of a system.”

Annual report 2025A · The company itself

“For example, the development and use of generative AI tools remain subject to uncertain legal frameworks, and the availability of copyright and other intellectual property protection for AI-generated material is uncertain.”

Annual report 2025A · The company itself

“The use of AI may implicate intellectual property, data protection and employment laws and regulations, impact the Company’s ability to protect its data and intellectual property and raise cybersecurity, confidentiality and technical risks. Regulation of AI is evolving rapidly, including the increasing adoption of AI-focused consumer protection and data privacy laws in certain jurisdictions, and the Company’s use of AI will continue to require resources to address changing and disparate regulatory requirements, implement appropriate governance practices and minimize associated risks. The Company’s obligations to comply with the evolving legal and regulatory landscape could limit its ability to incorporate certain AI solutions into its products and services.”

Annual report 2026A · The company itself

“For example, the European Union adopted the General Data Protection Regulation (the "GDPR"); the United Kingdom enacted the UK General Data Protection Regulation (which implements the GDPR into UK law); several U.S. states have passed data privacy laws; China enacted the Data Security Law and Personal Information Protection Law; and additional jurisdictions have adopted or are considering proposing or adopting similar regulations. These laws, together with a growing patchwork of laws and regulations governing AI, automated decision-making, targeted advertising, profiling and consumer protection, impose additional obligations regarding the handling of personal data and other information, and these requirements continue to evolve.”

Annual report 2026A · The company itself

“Additionally, emerging and potential regulations governing the use of artificial intelligence could impose additional requirements that may increase our costs or adversely impact our speed of delivery. Further, improper use of, or failure to adequately integrate, artificial intelligence could increase costs and lead to data breaches, reputational risks and otherwise negatively impact our business.”

Annual report 2025A · The company itself

“The regulatory landscape surrounding AI, including GenAI, is evolving, and the use of such technologies may become subject to regulation under new laws or new applications of existing laws. If the Company’s use of the recommendations, content, or analyses that AI applications produce is, or is alleged to be, deficient or inaccurate, or involve breaches of licenses, tort claims, violations of privacy, consumer protection, or other laws, NRG could be subjected to legal liability, brand or reputational harm and operational interruptions that ultimately have a material adverse effect on NRG’s results of operations.”

Annual report 2025A · The company itself

“As a result, we are subject to environmental, data privacy, export controls and sanctions, AI technologies, cybersecurity, disclosure and reporting (including reporting of ESG-related data), labor and health and safety laws and regulations in each jurisdiction in which we operate.”

Annual report 2025A · The company itself

“Evolving rules, regulations and industry standards governing AI may require us to spend significantly to modify, maintain, or align our business practices, solutions and services, the nature of which cannot be determined at this time and may be inconsistent from region to region.”

Annual report 2025A · The company itself

“The topics which are of most strategic importance to us are; innovation, clinical trial conduct, business ethics, economic performance and patient health and safety.”

Annual report 2024A · The company itself

“As global standards and regulations relating to AI increase and change, they could result in additional costs, regulatory scrutiny, legal liability and reputational harm, including if we fail to comply with such standards and regulations.”

Annual report 2025A · The company itself

“The legal landscape continues to evolve with respect to the development and increased prevalence of certain new technologies, including AI Technologies. As a consequence, we face uncertainty with respect to our ability to protect our intellectual property and brands from unauthorized use, misappropriation, and infringement utilizing such technologies, and an increased risk of being subjected to claims brought by third-party rights owners with respect thereto.”

Annual report 2024A · The company itself

“Laws and regulations governing new technologies, including AI Technologies, remain unsettled and are an area of increasing regulatory focus, and legal and regulatory developments in this area could also impact our business. Changes in the legal or regulatory landscape could require us to change or limit certain of our business practices, which could impact our ability to generate revenues.”

Annual report 2024A · The company itself

“The regulatory framework for privacy, AI, and machine learning issues is rapidly evolving and future enactment of more restrictive laws, rules, or regulations and/or future enforcement actions or investigations could have a materially adverse impact on us through increased costs or restrictions on our business and noncompliance could result in regulatory penalties and significant legal liability.”

Annual report 2026A · The company itself

“We use AI and machine learning technologies in various aspects of our business, including fraud prevention, risk management, product optimization and customer service. Governments and regulators globally are increasingly focused on the oversight of AI technologies and have proposed or enacted laws aimed at ensuring transparency, fairness, and accountability.”

Annual report 2025A · The company itself

“For example, existing regulatory frameworks governing the use, development, and deployment of AI, including regulatory guidance on the use of AI in medical products, remain uncertain and subject to significant change. New regulatory requirements could impose significant compliance costs, limit our ability to deploy AI, require changes to our practices (including documentation, risk management, testing, or transparency measures), or increase litigation and enforcement risk.”

Annual report 2025A · The company itself

“Rapid advances in AI capabilities, as well as the emerging regulatory landscape in the United States and internationally, may also require modifications to our systems, adoption of enhanced governance processes or implementation of new safeguards. Future laws, regulations, Executive Orders, or industry standards relating to AI (which may be conflicting), including those addressing transparency, data usage, cybersecurity, accountability, or risk management, could materially affect how we design, procure, or use AI technologies and could increase compliance costs.”

Annual report 2025A · The company itself

“Compliance with new or changing laws, regulations, or industry standards relating to AI may impose significant operational costs and limit our ability to develop, deploy, or use AI and machine learning technologies.”

Annual report 2025A · The company itself

“In addition, uncertainty in the legal and regulatory regime relating to AI may require significant resources to modify and maintain business practices to comply with applicable law, the nature of which cannot be determined at this time. Several jurisdictions have already proposed or enacted laws governing AI and may decide to adopt similar or more restrictive legislation that may render the use of such technologies challenging. These obligations may prevent or limit our ability to use AI in our business, lead to regulatory fines or penalties for AI use that does not meet certain standards, and require us to change our business practices.”

Annual report 2025A · The company itself

“For example, the Colorado AI Act, or the Act, with compliance obligations taking effect on February 1, 2026, regulates the development, substantial modification, or deployment of AI in Colorado. The Act regulates the use of high-risk AI systems, defined as systems that make or are a substantial factor in making a decision that has a material legal or similarly significant effect on the provision or denial to any consumer of, or the cost or terms of: education enrollment or opportunity, employment or an employment opportunity, a financial or lending service, an essential government service, healthcare services, housing, insurance, or legal services.”

Annual report 2026A · The company itself

“The legal and regulatory framework governing AI continues to evolve globally. New or changing laws, regulations or industry standards may increase our compliance obligations, require modifications to existing products, delay product introductions or enhancements, or increase development and operating costs.”

Annual report 2026A · The company itself

“Table of Contents PART I Item 1A RESMED INC. AND SUBSIDIARIES Our use of artificial intelligence in certain products, software solutions and business operations may expose us to operational, regulatory and reputational risks that could adversely affect our business, financial condition and results of operations. We increasingly incorporate artificial intelligence, or AI, including machine learning, into certain products, software solutions and business processes to enhance patient engagement, support clinical workflows and improve operational efficiencies. AI-enabled features may not perform as intended and could produce inaccurate, inconsistent or unintended outputs.”

Annual report 2026A · The company itself

“Laws, regulations or industry standards that develop in response to the use of AI may be burdensome or may restrict our ability to use, develop, or deploy AI, particularly generative AI technologies, in our products or processes, or our efforts to expand our business. For example, the EU's AI Act, which became effective on August 1, 2024, governs the development, marketing and use of AI in the EU and could impose significant additional costs on us to comply or significant fines for failing to comply.”

Annual report 2025A · The company itself

“In the U.S., a patchwork of emerging AI-related laws and regulations could also require us to modify our practices or increase compliance costs. For example, on December 11, 2025, the President issued an executive order to establish a national policy framework for AI intended to preempt state AI laws and regulations. Among other things, the executive order directs the Federal Communications Commission to initiate a proceeding to determine whether to adopt a federal reporting and disclosure standard for AI models, which could impose significant additional costs on us to comply or significant fines for failing to comply.”

Annual report 2025A · The company itself

“Our success and ability to compete depend in part upon our ability to obtain, maintain, protect, defend and enforce our intellectual property rights and technology. The steps we take to protect our intellectual property rights might not be sufficient to effectively prevent third parties from infringing, misappropriating, diluting, or otherwise violating our intellectual property rights or to prevent unauthorized disclosure or unauthorized use of our trade secrets or other confidential information. We make business decisions about when to seek patent protection for a particular technology, obtain trademark or copyright protection 85 Table of Contents and when to rely upon trade secret protection, and the approach we select might ultimately prove to be inadequate.”

Annual report 2025A · The company itself

“Regulation limiting or controlling the use of AI may restrict our ability to use AI, our ability to create new products, and create increased compliance costs. We are subject to an evolving landscape of laws and regulations governing the use of AI.”

Annual report 2025A · The company itself

“These risks relate to, among other things, product safety and reliability, personal injuries, intellectual property rights, contract-related claims, government contracts, taxes, environmental matters, the use of chemical substances, the use of artificial intelligence, export control, sanctions, employment matters, securities laws, competition laws, and laws governing improper business practices.”

Annual report unknown yearA · The company itself

“Cybersecurity, artificial intelligence, and data security and protection laws and regulations are evolving and present increasing compliance challenges, which may increase our costs, affect our competitiveness, cause reputational harm, and expose us to substantial fines or other penalties.”

Annual report unknown yearA · The company itself

“We are also subject to a variety of evolving laws and regulations regarding AI in an increasing number of jurisdictions. Further, global AI legislation, regulatory, enforcement, and policy activity is rapidly and continually evolving and creating a complex regulatory compliance environment.”

Annual report 2025A · The company itself

“Several laws and regulations in the European Union, the U.K. and the U.S. have been adopted but not yet implemented, or have been proposed or are being considered, to which Market Intelligence, or its clients, will or may become subject, including laws and regulations related to pricing providers, sustainability, credit rating data, data privacy and cyber security and technology and organizational resilience. For example, the EU passed the Digital Operational Resilience Act in December 2022 (“DORA”), which became effective in early 2025. DORA imposes operational resilience and cyber security standards and obligations, including technical and organizational standards and responsibilities which require technology and/or organizational investment, upon (i) many Market Intelligence financial market clients, who aim to pass such obligations onto vendors like Market Intelligence, and (ii) information and communications technology providers designated by the EU as “Critical Third Party Providers,” which in certain instances includes Market Intelligence.”

Annual report 2025A · The company itself

“Increasing use of AI across our Market Intelligence business subjects Market Intelligence to evolving and potentially complex legal requirements. For example, the European Union Artificial Intelligence Act ("EU AI Act"), adopted in 2024, establishes a legal framework for the development and use of AI in the EU. The EU AI Act classifies AI systems by risk and imposes strict requirements on high-risk applications. We continue to evaluate the potential implications for our products and services and practice to ensure compliance with the EU AI Act, including transparency and data governance obligations in respect of any AI we utilize.”

Annual report 2025A · The company itself

“Similarly, other laws, regulations and rules are being adopted or considered or are likely to be considered in the future that may impact ancillary and other services provided by Ratings in addition to its credit rating products and services, for example regulatory oversight regimes for ESG ratings providers such as the EU regulation on the transparency and integrity of ESG rating activities that was adopted by the European Parliament and Council in November 2024 (the "EU ESG Ratings Regulation"), or legislation and draft rules published by the U.K. FCA in 2025 to supervise ESG ratings providers from June 2028 (the “UK ESG Ratings Regulatory Framework”). The impact on us of the adoption of any such laws, regulations or rules remains uncertain, but could increase the costs and legal risks relating to Ratings’ activities, or adversely affect our ability to compete and/or our remuneration, or result in changes in the demand for our products and services.”

Annual report 2025A · The company itself

“Increasing use of AI across our Ratings business subjects Ratings to evolving and potentially complex legal requirements, which may result in additional compliance obligations for our Ratings business operations that leverage AI technologies.”

Annual report 2025A · The company itself

“We may be adversely affected by the risks, challenges, and evolving regulatory landscape associated with the use of AI in our operations, product development, and business practices. We are increasingly leveraging AI technologies, including generative AI applications and tools, to support and enhance our various operational processes. While AI may promote efficiency and offer analytical advantages, it is complex and rapidly-changing, and its implementation carries inherent risks.”

Annual report 2026A · The company itself

“In Learning, changes in e.g. the regulation related to education, digital platforms or AI could have a material effect on Sanoma’s commercial propositions, technology or content investment needs, or financial performance.”

Annual report 2025A · The company itself

“Regulatory changes and new guidance by authorities or regulatory enforcement actions regarding the use of consumer or cookie data, or the development or use of AI, could, therefore, have an adverse effect on Sanoma’s ability to utilise data in its business.”

Annual report 2025A · The company itself

“The EU’s AI Act entered into force in all 27 EU member states on 1 August 2024. The enforcement of the majority of its provisions will commence on 2 August 2026, and could potentially have some impacts on certain products of Learning.”

Annual report 2025A · The company itself

“For example, the EU AI Act places new requirements on providers of AI technologies that will need to be addressed in alignment with various deadlines.”

Annual report 2025A · The company itself

“Artificial generative intelligence technologies present risks related to the control of our proprietary business information, keeping such information confidential, and emerging regulatory risk, any or all of which may adversely affect our business and results of operations. There are risks associated with artificial intelligence (“AI"), any or all of which could adversely affect our business. Issues in the development and use of AI, combined with an uncertain regulatory environment, may result in reputational harm, liability, or other adverse consequences to our business operations.”

Annual report unknown yearA · The company itself

“Information Technology, Cybersecurity, and Data Privacy Risks •The Company is heavily dependent on technology to operate its business; any failure, disruption, breach, or delay in the Company’s information systems or in implementation of necessary changes could materially adversely affect its operations. •The Company is increasingly exposed to cybersecurity attacks and data incidents impacting its IT Systems, and such incidents could have a disruptive and material adverse effect on the Company’s business, financial position, or results of operations. •The Company is expanding its use of AI and machine-learning, and any failure in its related strategy, compliance with regulations, or risk management could materially adversely affect its operations, reputation, and/or financial position.”

Annual report 2025A · The company itself

“Although the Company believes it diligently evaluates, governs, tests, and deploys AI-related technologies, the Company could face numerous AI-related challenges, such as cybersecurity vulnerabilities, algorithmic biases or errors, evolving regulatory requirements across jurisdictions, and potential competitive disadvantage if the Company’s competitors deploy AI technologies more quickly or more successfully. The complex and evolving regulatory landscape surrounding AI technologies, including regarding violations of intellectual property rights and data privacy concerns, creates additional compliance challenges and potential liability.”

Annual report 2025A · The company itself

“The regulatory landscape surrounding artificial intelligence is rapidly evolving and the Company’s use of artificial intelligence may be subject to new legal or regulatory requirements, which may impose prohibitions or additional compliance burdens on the Company. For example, the Company’s artificial intelligence efforts may subject it to heightened compliance and legal as well as other risks related to technology integration, accuracy, program bias, data sourcing, intellectual property infringement or misappropriation, data privacy, and cybersecurity, among others. Moreover, the Company may experience brand or reputational harm if it fails to appropriately manage its use of artificial intelligence in compliance with applicable laws and regulations or successfully execute on strategies leveraging artificial intelligence.”

Annual report 2026A · The company itself

“Widespread adoption and rapid evolution of emerging technologies, including with respect to digital assets, such as stablecoins, as well as developments in the regulatory landscape relating to emerging technologies, such as the enactment and implementation of the Guiding and Establishing National Innovation for U.S. Stablecoins Act of 2025 (GENIUS Act) and potential enactment of the Digital Asset Market Clarity Act of 2025 (CLARITY Act) or similar market structure legislation or regulation, may affect our clients’ needs and expectations for products and services.”

Annual report 2025A · The company itself

“Likewise, governments and regulatory bodies worldwide are actively developing new laws, regulations and ethical guidelines governing AI use, including the European Union’s Artificial Intelligence Act. Compliance with evolving and potentially inconsistent AI regulations across jurisdictions may be costly and complex. Failure to comply could result in significant penalties, restrictions on our use of AI, or reputational harm.”

Annual report 2026A · The company itself

“The legal and regulatory landscape surrounding AI technologies is rapidly evolving and uncertain, including in the areas of intellectual property, cybersecurity and privacy and data protection. Compliance with new or changing laws, regulations or industry standards relating to AI may impose significant costs on us and limit our ability to effectively develop, deploy or use AI technologies.”

Annual report 2025A · The company itself

“The technologies underlying AI and its uses are expected to be subject to new laws and regulations or new applications of existing laws and regulations, including in the areas of intellectual property, privacy, data protection and cybersecurity, among others. In addition, unfavorable developments with evolving laws and regulations affecting AI-related products may limit global adoption, impede our strategy and negatively impact our long-term expectations in this area.”

Annual report 2025A · The company itself

“For example, there is significant uncertainty in the U.S. courts as to how AI technologies affect IP ownership, including copyright protections, and the use of AI-related technology in the development of our products or implementation of AI features in our products could expose us or our customers to claims of copyright infringement or misappropriation.”

Annual report 2025A · The company itself

“The legal and regulatory landscape and industry standards surrounding artificial intelligence technologies are rapidly evolving and remain uncertain, and compliance may impose significant operational costs and may limit our ability to develop, deploy or use artificial intelligence technologies. Furthermore, the deployment of artificial intelligence systems could expose us to increased cybersecurity threats, such as data breaches and unauthorized access leading to financial losses, legal liabilities, and reputational damage.”

Annual report 2026A · The company itself

“We are subject to regulatory oversight by various federal, state, and local agencies, as well as judicial review and actions, on issues related to the telecommunications industry that include, but are not limited to, roaming, interconnection, spectrum allocation and licensing, facilities siting, pole attachments, intercarrier compensation, Universal Service Fund (“USF”), 911 services, robocalling/robotexting, consumer protection, consumer privacy, and cybersecurity.”

Annual report 2025A · The company itself

“AI-related laws and regulations continue to remain uncertain and may vary from jurisdiction to jurisdiction. Our obligations to comply with the evolving legal and regulatory landscape may require us to incur significant additional costs or limit our ability to incorporate certain AI capabilities into our business operations or product offerings.”

Annual report 2025A · The company itself

“New EU cybersecurity requirements are expected to come into effect in 2026, which may impact our ability to market our products and services in the EU.”

Annual report 2025A · The company itself

“The jurisdictions in which we conduct business have and may adopt laws and regulations related to AI, which could cause us to incur greater compliance costs, limit our use of AI tools, or subject us to legal liabilities.”

Annual report 2025A · The company itself

“Non-compliance with AI regulations may result in financial penalties, legal exposure, and reputational risks.”

Annual report 2025A · The company itself

“RISKER KOPPLADE TILL REGELEFTERLEVNAD Regelefterlevnad Regelverken skärps och utökas snabbt på flera marknader. Bristande efterlevnad kan leda till förlorade affärsmöjligheter, kundbortfall, regulatoriska sanktioner och skada företagets anseende.”

Annual report 2024A · The company itself

“•AI-related laws and regulations in the U.S. and other countries are rapidly evolving and are subject to significant uncertainty, and could impose significant compliance costs, restrict certain AI applications, or require us to alter our AI-related practices. •AI may produce erroneous or misleading content, and outputs that infringe on the IP or data privacy rights of others.”

Annual report 2026A · The company itself

“There is uncertainty about the extent to which privacy and data protection laws apply to artificial intelligence technologies, and any delay in addressing those concerns may result in liability or regulatory investigations and fines, as well as harms to our business and reputation. In addition, issues related to intellectual property rights in artificial intelligence technologies have not been fully addressed by the courts or regulators. As such, to the extent we implement generative artificial intelligence technologies into our products and/or services, we may face resulting exposure to claims related to copyright infringement or other intellectual property misappropriation.”

Annual report 2025A · The company itself

“•Our growing use of artificial intelligence (“AI”) and machine learning may present additional risks, including risks associated with algorithm development or use, the tools and data sets used, and/or a complex, developing regulatory environment. •We are subject to climate risks, including physical and transitional risks, and if we are unable to manage such risks, our business may be adversely impacted. •Increased attention to, and evolving expectations regarding environmental and social matters may adversely impact our business, reputation and liabilities, including in the context of certain goals we have announced. •Occurrence of a catastrophic event, including but not limited to disease, a weather event, war, or terrorist attack, could adversely impact our business, financial condition and results of operation. •We rely on third parties maintaining open marketplaces to distribute our platform and to provide the software we use in certain of our products and offerings.”

Annual report 2025A · The company itself

“The rapid evolution of AI, including current and proposed government regulation of AI, may require significant resources to develop, test and maintain our AI platform and services to help us implement AI in a compliant and ethical manner in order to minimize any adverse impact to our business.”

Annual report 2025A · The company itself

“Changes in laws, rules, directives, and regulations governing the use of AI may adversely affect our ability to develop and use AI or subject us to legal liability. The cost of complying with laws and regulations governing AI could be significant and would increase our operating expenses, which could adversely affect our business, financial condition, results of operations and cash flows.”

Annual report 2025A · The company itself

“Various laws and governmental regulations, both in the U.S. and abroad, governing Internet-related services, related communications services, information technologies, artificial intelligence, and the construction and location of data centers and other critical infrastructure remain largely unsettled, even in areas where there has been some legislative action. There are anticipated regulations forthcoming in the U.S. and other countries where our customers operate in the areas of cybersecurity, data privacy and data security, artificial intelligence, and critical infrastructure construction, permitting and energy consumption, any of which could impact us and our customers.”

Annual report 2025A · The company itself

“In addition, AI technologies may be misused, and that risk is increased by the relative newness of the technology, the speed at which it is being adopted, and ongoing uncertainty with respect to the laws, regulations, and standards governing its development and deployment federally, across states, and internationally. Such misuse, and a realization of the previously mentioned risks, could negatively impact our reputation, financial condition and results of operations, the demand for our products and services, otherwise cause competitive harm, and/or draw adverse legal and regulatory scrutiny.”

Annual report 2025A · The company itself

“A growing patchwork of AI laws and targeted privacy and consumer protection statutes may also create varying obligations around notice, customer rights and appeals, data minimization, restrictions on sensitive data, targeted advertising and certain forms of profiling, and these requirements continue to evolve.”

Annual report 2026A · The company itself

“The impact of new laws, regulations and policies and the related interpretations, as well as changes in enforcement practices or regulatory scrutiny as to existing laws and regulations (including, but not limited to, in the U.S., shifting enforcement priorities for existing antitrust, competition and pricing laws (including new or expanded laws relating to dynamic and algorithmic pricing), use and disposal of plastics, recycled plastics or other packaging materials, social and environmental initiatives, consumer protection and AI technology, as well as proposed new rules and regulations) generally cannot be predicted, and changes in applicable laws, regulations and policies and the related interpretations and enforcement practices of existing laws and regulations may require extensive system and operational changes, be difficult to implement, increase our operating costs, require significant capital expenditures, adversely impact the cost or attractiveness of the products or services we offer, or result in adverse publicity and harm our reputation.”

Annual report 2026A · The company itself

“Regulations governing new technological developments, such as developments in artificial intelligence (AI), including generative AI and large language model tools, remain unsettled, and these developments may affect aspects of our existing business models, including revenue streams for the use of our IP, how we create our entertainment offerings and the competition we face.”

Annual report 2025A · The company itself

“Laws and regulations arising from the use and development of AI technology present additional uncertainties and risks to the Company. In particular, the use and development of AI implicates risks related to intellectual property, data protection and privacy laws and regulations and may also cause compliance issues or raise ethical concerns. Due to the rapid developments being made in AI technology, the legal and regulatory landscape related to AI is constantly evolving. Complying with developing laws, regulations and standards could significantly burden the Company, and failures to comply could result in legal liability, regulatory action or reputational harm.”

Annual report 2025A · The company itself

“States have also passed and proposed new statutes and regulations that may affect the use of artificial intelligence in healthcare. As we use data to better inform our investments and the efficacy of care in our communities and as we and our tenants and operators consider whether to invest in new tools, these developments may add potential uncertainty and costs towards compliance obligations, business operations or transactions that depend on data.”

Annual report 2025A · The company itself

“New laws and regulations are being adopted in the U.S. and in non-U.S. jurisdictions, and existing laws and regulations may be interpreted in ways that would affect our business operations and the way in which we use AI. Future regulations could impose restrictions on the use of AI technology and require us to incur significant costs to implement compliance measures or change the way in which we use AI.”

Annual report 2025A · The company itself

“Responsible Business: We build trust through principled leadership, embedding accountability, integrity, and sustainability into decision-making processes. •We establish policies and practices to support the responsible, ethical, and secure development, deployment, and usage of AI. As AI becomes a greater part of our daily experience and product offerings, we implemented an AI policy to effectively manage and mitigate AI-related risks.”

Annual report 2026A · The company itself

“Governments worldwide are adopting or proposing AI-specific regulations, including the European Union’s Artificial Intelligence Act, as well as various proposed frameworks in the U.S., China, and other jurisdictions. These regulations may impose requirements on the development, deployment, and use of AI systems in our products or operations, require jurisdiction-specific product configurations, increase compliance costs, or limit our ability to leverage AI technologies. The evolving and potentially divergent nature of these regulations creates uncertainty and could adversely affect our business.”

Annual report 2026A · The company itself

“Additionally, as a part of our efforts to implement innovative technology, data and analytic solutions, we may invest in and develop technologies such as AI, digital platforms, data analytics, robotics and blockchain. The technologies underlying such technological innovations and their use cases are rapidly developing, and remain subject to existing laws, including privacy, consumer protection and federal equal opportunity laws.”

Annual report 2025A · The company itself

“Moreover, these technologies are the subject of evolving review by various regulatory agencies, including the SEC and the U.S. Federal Trade Commission, and changes in the regulation of the use these technological innovations may adversely affect our ability to use them in a manner that is cost- and resource-effective, the nature of which cannot be determined at this time.”

Annual report 2025A · The company itself

“Additionally, we are subject to increasing legal requirements with respect to the use of AI and machine learning applications and tools (including in relation to hiring and 14 employment practices and in digitally marketing our Concepts), data collected from minors, and biometric information. These legal requirements are rapidly changing and are not consistent across jurisdictions, and our inability to adapt to or comply with such legal requirements may adversely impact us, including as the result of liabilities or penalties as the result of any such non-compliance.”

Annual report 2025A · The company itself

“We continue to allocate significant resources to develop, accelerate and implement our digital, technology, and innovation capabilities, including various AI capabilities. The development of such AI initiatives is complex and uncertain, and presents various risks and uncertainties, including as the result of the rapidly evolving legal, regulatory and ethical landscape associated with the use of AI. Our efforts to integrate AI capabilities into our business may result in unanticipated consequences and complications, and if we do not successfully implement our AI initiatives, or if we encounter other failures in our AI systems or initiatives, this could result in legal and regulatory risk, brand or reputational harm, and other adverse impacts.”

Annual report 2025A · The company itself

“In addition, we are subject to a growing number of cybersecurity and AI safety laws in markets in which we operate. For example, some of our European operations are subject to NIS2 which imposes cybersecurity requirements on “essential entities.” The EU AI Act prohibits certain AI systems that are categorized as “High Risk,” and requires certain disclosures about the use of AI tools.”

Annual report 2025A · The company itself

“Our business involves using AI to provide faster, more accurate in-clinic diagnostic results and improve research efficiency and accelerated animal health drug discovery. We also incorporate (and expect to continue incorporating) the use of AI in our operations. We are increasingly subject to a rapidly evolving legal and regulatory environment relating to the development, deployment, and use of AI, machine learning, automated decision-making systems, and related technologies.”

Annual report 2025A · The company itself

“Additionally, certain states are adopting the NAIC Model Bulletin on the Use of Artificial Intelligence Systems by Insurers and, in limited cases, passing their own laws related to artificial intelligence.”

Annual report 2025A · The company itself

“The Company is subject to a variety of laws and regulations in the United States and other jurisdictions regarding artificial intelligence (AI), privacy, data protection, and data security, including those related to the collection, storage, handling, use, disclosure, transfer, and security of personal data. Compliance with and interpretation of various data privacy regulations continue to evolve, and any violation could subject the Company to legal claims, regulatory penalties, and damage to its reputation.”

Annual report 2025A · The company itself

“In addition, laws and regulations, including FTC enforcement, are rapidly evolving to govern social media platforms and communications.”

Annual report unknown yearA · The company itself

“There is also an emerging trend of governmental entities proposing and providing regulatory guidance related to AI, including generative AI. If we or our third-party providers are restricted from using AI as a result of any regulatory views, laws or other measures, it could impact our operations, increase our compliance expense and burden, and cause us to incur costs to replace or modify our use of AI.”

Annual report 2025A · The company itself

“The legal and regulatory landscape for certain new technologies, such as artificial intelligence, is uncertain and evolving, and our compliance obligations could increase our costs or limit how we may use these technologies.”

Annual report 2025A · The company itself

“In addition, the use of AI presents certain risks, including, among other things: (i) the generation of and reliance upon inaccurate, misleading or otherwise flawed content in our business processes, (ii) the unauthorized use or disclosure of confidential or proprietary information and (iii) potential exposure to new or enhanced governmental or regulatory scrutiny, all of which could negatively impact our business.”

Annual report 2025A · The company itself

“In January 2026, the European Medicines Agency and FDA jointly established new artificial intelligence (“AI”) principles in drug development that provide broad guidance on AI use in evidence generation and monitoring across all phases of a medicine’s lifecycle - from early research and clinical trials to manufacturing and drug safety. These AI principles may lead to future regulatory guidance and requirements in various jurisdictions, which could affect the use of AI in our business.”

Annual report 2025A · The company itself

“•Our business may be affected by current and future laws and regulations governing the development, use and deployment of AI technologies, as well as potentially related private litigation.”

Annual report 2025A · The company itself

“Additionally, compliance with new and evolving laws, regulations or industry standards relating to AI may require significant investment and resources, and may limit our ability to use AI, which may result in reputational harm, legal liability or other adverse effects on our operations and overall business. Political, economic and/or financial market conditions could negatively impact our financial results.”

Annual report 2025A · The company itself

“The Company is subject to complex U.S., foreign and other local laws and regulations that are applicable to its operations, such as anti-bribery and anti-corruption, competition, export and import, trade sanctions, data privacy, environmental, the use of artificial intelligence in our business and in our products and services, and human rights laws.”

Annual report 2025A · The company itself

“Risks Related to Government Regulation, Legal Proceedings, and Financial and Economic Market Conditions •Our ability to comply with a broad range of laws and regulations, and other stakeholder requirements globally, including rapidly evolving requirements related to tax, trade, tariffs, manufacturing, ingredients, climate change, sustainability, the environment, privacy, data protection, artificial intelligence, anti-corruption, and human rights. •We are, and could become, subject to legal proceedings and governmental or regulatory investigations that may result in significant expenses, liabilities (potentially in excess of accruals), and reputational damage. •Concerns about the reliability, safety, and efficacy of our products and their ingredients, including acetaminophen, talc, and phenylephrine, have resulted and could in the future result in litigation, regulatory action, governmental investigations, reputational damage, product recalls, product reformulations, or product withdrawals, whether or not such concerns are based on scientific or factual evidence we believe is sound.”

Annual report 2025A · The company itself

“The development, adoption, integration, and use of generative artificial intelligence technology remains in early stages, and ineffective or inadequate artificial intelligence governance, development, use, or deployment practices by us or third parties could result in unintended consequences.”

Annual report 2025A · The company itself

“Furthermore, the rapid evolution and increased adoption of artificial intelligence technologies may intensify our cybersecurity risks.”

Annual report 2025A · The company itself

“The privacy laws in the U.S. are being implemented at a state level effective from 2023 and continuing through 2026. The California Privacy Rights Act (CPRA) is modelled after GDPR.”

Annual report 2024A · The company itself

“Other potential future legislation and regulations, including the increasing global regulation of privacy rights and use of AI, may also adversely affect the customers to which, and the markets into which, we sell our products, and increase our costs and otherwise negatively affect our business, reputation, results of operations and financial condition, including in ways that cannot yet be foreseen.”

Annual report 2026A · The company itself

“Further, the rapidly evolving legal and regulatory environment relating to artificial intelligence and privacy could impact our implementation of these and other emerging technologies and increase compliance costs and the risk of non-compliance.”

Annual report 2025A · The company itself

“Additionally, legislative and regulatory action in the United States at the federal, state and local levels, as well as internationally, is emerging in the areas of AI and automation.”

Annual report 2025A · The company itself