What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2026-07-31 compared with 2026-05-01 · 38 added, 77 removed, 55 unchanged (68% of the section changed)

The Company’s products and services may be affected from time to time by design and manufacturing defects that could materially adversely affect the Company’s business and result in harm to the Company’s reputation.

The Company offers complex hardware and software products and services that can be affected by design and manufacturing defects.

Sophisticated operating system software and applications, such as those offered by the Company, often have issues that can unexpectedly interfere with the intended operation of hardware or software products and services.

Defects can also exist in components and products the Company purchases from third parties.

Component defects could make the Company’s products unsafe and create a risk of environmental or property damage and personal injury.

These risks may increase as the Company’s products are introduced into specialized applications, including health.

In addition, the Company’s service offerings can have quality issues and from time to time experience outages, service slowdowns or errors.

As a result, from time to time the Company’s services have not performed as anticipated and may not meet user expectations.

The Company’s products and services may also be used in unintended ways, or in a manner that its users allege is harmful.

The introduction of new and complex technologies, such as artificial intelligence features, can increase these and other safety risks, including exposing users to harmful, inaccurate or other negative content and experiences.

The Company may not be able to detect and fix all issues and defects in the hardware, software and services it offers, which can result in widespread technical and performance issues affecting the Company’s products and services.

Errors, bugs and vulnerabilities can be exploited by third parties, compromising the safety and security of a user’s device.

In addition, the Company can be exposed to product liability claims, recalls, product replacements or modifications, write-offs of inventory, property, plant and equipment or intangible assets, and significant warranty and other expenses, including litigation costs and regulatory fines.

Quality problems can adversely affect the experience for users of the Company’s products and services, and result in harm to the Company’s reputation, loss of competitive advantage, poor market acceptance, reduced demand for products and services, delay in new product and service introductions and lost sales.

Losses or unauthorized access to or releases of confidential information, including personal information, could subject the Company to significant reputational, financial, legal and operational consequences.

The Company’s business requires it to use and store confidential information, including personal and sensitive health and financial information with respect to the Company’s customers and employees.

The Company devotes significant resources to systems and data security, including through the use of encryption and other security measures intended to protect its systems and data.

But these measures cannot provide absolute security, and losses or unauthorized access to or releases of confidential information occur and could materially adversely affect the Company’s business, reputation, results of operations, financial condition and stock price.

The Company’s business also requires it to share confidential information with suppliers, service providers and other third parties.

The Company relies on global suppliers that are also exposed to cybersecurity, ransomware and other malicious attacks that can disrupt business operations.

Although the Company takes steps to secure confidential information that is provided to or accessible by third parties working on the Company’s behalf, such measures are not always effective and losses or unauthorized access to, or releases of, confidential information occur.

Such incidents and other malicious attacks could materially adversely affect the Company’s business, reputation, results of operations, financial condition and stock price.

The Company experiences malicious attacks and other attempts to gain unauthorized access to its systems on a regular basis.

These attacks target the confidentiality, integrity or availability of confidential information and may disrupt normal business operations.

Attacks can impair the Company’s ability to attract and retain customers for its products and services, affect its stock price, damage commercial relationships, and expose the Company to litigation or government investigations, potentially resulting in penalties, fines or judgments.

Globally, attacks are expected to continue accelerating in frequency, scale and sophistication with increasing use by actors of tools and techniques that are designed to circumvent controls, avoid detection, and remove or obfuscate forensic evidence, all of which hinders the Company’s ability to identify, investigate and recover from incidents.

In addition, attacks against the Company and its customers can escalate during periods of geopolitical tensions or conflict.

The Company’s business, reputation, results of operations, financial condition and stock price can be materially and adversely affected by a number of factors, whether currently known or unknown, including those described in Part I, Item 1A of the 2025 Form 10-K and Part II, Item 1A of the Form 10-Q for the quarter ended March 28, 2026 (the “second quarter 2026 Form 10-Q”), in each case under the heading “Risk Factors.” Except for the risk factors set forth below and those disclosed in Part II, Item 1A of the second quarter 2026 Form 10-Q , which are incorporated by reference herein, there have been no material changes to the Company’s risk factors since the 2025 Form 10-K.

Future operating results depend upon the Company’s ability to obtain components and computing resources in sufficient quantities and on commercially reasonable terms.

The Company currently obtains certain components from single or limited sources, which exposes it to significant supply and pricing risks.

In addition, many components, including those that are available from multiple sources, are at times subject to industry-wide shortages and significant commodity pricing fluctuations that can materially adversely affect the Company’s business, results of operations, financial condition and stock price.

For example, the Company is experiencing a period of supply constraints and increasing costs for components driven by factors such as industry supply-demand imbalances for components, including advanced semiconductors, storage (NAND) and memory (DRAM), which adversely affects the Company’s ability to obtain sufficient quantities of components and products on commercially reasonable terms, or at all.

The Company expects these trends to intensify, which may materially adversely impact the Company’s revenue, costs, gross margin, results of operations and financial condition.

Actions, such as price increases, that have been and may in the future be taken by the Company may not effectively mitigate these negative impacts, and may also reduce demand for the Company’s products and materially adversely affect the Company’s revenue, costs, gross margin, results of operations and financial condition.

Additionally, the Company’s new products often utilize custom components available from only one source.

When a component or product uses new technologies, initial capacity constraints may exist until the suppliers’ yields have matured or their manufacturing capacities have increased.

The Company may not be able to extend or renew agreements for the supply of components on similar terms, or at all, and may not be successful in obtaining sufficient quantities from its suppliers in a timely manner, or in identifying and obtaining sufficient quantities from an alternative source.

In addition, component suppliers may fail, be subject to consolidation within a particular industry, or decide to concentrate on the production of common components instead of components customized to meet the Company’s requirements, further limiting the Company’s ability to obtain sufficient quantities of components on commercially reasonable terms, or at all.

The Company’s business, including its artificial intelligence and machine learning offerings, also depends on access to sufficient computing resources.

Demand for cloud computing and artificial intelligence infrastructure has increased substantially across the technology industry, resulting in constrained supply, extended lead times, and increasing costs.

In addition to its own data center infrastructure, the Company relies on third-party cloud service providers to meet these compute needs, and the Company may be unable to secure sufficient capacity on commercially reasonable terms, or at all, to meet customer demand.

If the Company is unable to obtain adequate compute capacity in a timely manner or at commercially reasonable rates, this can limit the functionality and availability of its products and services, delay the deployment of new features or offerings, or cause the Company to incur significantly higher costs to operate its business, any of which could materially adversely affect the Company’s revenue, costs, gross margin, results of operations, and financial condition.

In addition, the Company may over- or under-estimate requirements, either of which could result in higher-than-expected costs for the Company or an inability to fully satisfy customer demand.

Therefore, the Company remains subject to significant risks of supply shortages and price increases that can materially adversely affect its business, results of operations, financial condition and stock price.

The Company’s future performance depends in part on support from third-party software developers.

The Company believes decisions by customers to purchase its hardware products depend in part on the availability of third-party software applications and services.

Third-party developers may discontinue the development and maintenance of software applications and services for the Company’s products.

If third-party software applications and services cease to be developed and maintained for the Company’s products, customers may choose not to buy the Company’s products, materially adversely impacting the Company’s business, results of operations, financial condition and stock price.

The Company believes that third-party developer support depends on the perceived benefits of creating software and services for the Company’s products compared to competitors’ platforms, such as Android for smartphones and tablets, Windows for personal computers and tablets, and PlayStation, Nintendo and Xbox for gaming platforms.

This analysis may be based on factors such as the market position of the Company and its products, the anticipated revenue that may be generated, expected future growth of product sales, and the costs of developing such applications and services.

| Q3 2026 Form 10-Q | 21

The rapid advancement and widespread dissemination of artificial intelligence technologies significantly increases the risks associated with cyberattacks.

For example, artificial intelligence technologies are being used to produce highly targeted phishing campaigns, automate the discovery or exploitation of vulnerabilities, generate deepfake content designed to bypass authentication protocols, and identify and exploit vulnerabilities at a highly accelerated pace.

As increasingly sophisticated and capable artificial intelligence models continue to become available, these risks are intensifying.

Sophisticated and widespread cyberattacks could pose substantial systemic risks, such as cascading failures across interconnected systems, and potential disruptions to critical infrastructure and market stability.

In addition, artificial intelligence technologies can themselves be susceptible to security threats, and the development and deployment of artificial intelligence by the Company and its suppliers may expose the Company to additional vulnerabilities and attacks.

Although malicious attacks perpetrated to gain access to confidential information, including personal information, affect many companies across various industries, the Company is at a relatively greater risk of being targeted because of its high profile and the value of the confidential information it creates, owns, manages, stores and processes.

As with all companies, the security the Company has implemented may not be sufficient for all eventualities and are vulnerable to hacking, ransomware attacks, employee error, malfeasance, system error, faulty password management or other irregularities.

For example, third parties can fraudulently induce the Company’s or its suppliers’ and other third parties’ employees or customers into disclosing usernames, passwords or other sensitive information, which can, in turn, be used for unauthorized access to the Company’s or such suppliers’ or third parties’ systems and services.

To help protect customers and the Company, the Company deploys and makes available technologies like multifactor authentication, monitors its services and systems for unusual activity and may freeze accounts under suspicious circumstances, which, among other things, can result in the delay or loss of customer orders or impede customer access to the Company’s products and services.

While the Company maintains insurance coverage that is intended to address certain aspects of data security risks, such insurance coverage may be insufficient to cover all losses or all types of claims that may arise.

The Company’s minority market share in the global smartphone, personal computer, tablet and wearables markets can make developers less inclined to develop or upgrade software for the Company’s products and more inclined to devote their resources to developing and upgrading software for competitors’ products with larger market share.

When developers focus their efforts on these competing platforms, the availability and quality of applications for the Company’s devices can suffer.

The Company relies on the continued availability and development of compelling and innovative software applications for its products.

The Company’s products and operating systems are subject to rapid technological change, and when third-party developers are unable to or choose not to keep up with this pace of change, their applications can fail to take advantage of these changes to deliver improved customer experiences, can operate incorrectly, and can result in dissatisfied customers and lower customer demand for the Company’s products.

The Company distributes third-party applications through the App Store.

Where applicable, the Company may retain a commission from sales of applications and sales of digital services or goods initiated within an application.

If third-party developers use alternative methods of distribution and payment for their apps and digital content, including direct-to-consumer distribution models, the Company may earn a lower commission on such sales, or may not earn a commission at all, which can materially adversely affect the Company’s revenue, gross margin, results of operations, financial condition and stock price.

The technology industry, including, in some instances, the Company, is subject to intense media, political and regulatory scrutiny, which exposes the Company to increasing regulation, government investigations, legal actions and penalties.

9 unchanged sentences

For example, the Company has implemented changes to iOS, iPadOS, the App Store and Safari ® in the EU as it seeks to comply with the DMA, including new business terms and alternative fee structures for iOS and iPadOS apps, alternative methods of distribution for iOS and iPadOS apps, alternative payment processing for apps across the Company’s operating systems, and additional tools and application programming interfaces for developers.

The Company has also continued to make changes to its compliance plan in response to feedback and engagement with the Commission.

Although the Company’s compliance plan is intended to address the DMA’s obligations, it has been challenged by the Commission and may be challenged further by private litigants.

In addition, the DMA imposes interoperability obligations on the Company requiring it to make certain of its technologies and features available to third-party products and services for free, which increases security and privacy risks, requires significant engineering resources, and can adversely affect the functionality, competitiveness, and user experience of the Company’s products.

Interoperability and other requirements have in the past, and may in the future, cause the Company to not launch or maintain products, services and features, such as Siri AI, in certain jurisdictions.

Any of these outcomes can have a negative impact on the Company’s competitive advantage and materially adversely affect its business, results of operations, financial condition and stock price.

The Company has also continued to make changes to its DMA compliance plan in response to feedback and engagement with the Commission.

Although the Company’s DMA compliance plan is intended to address the DMA’s obligations, it has been challenged by the Commission and may be challenged further by private litigants.

The DMA provides for significant fines and penalties for noncompliance.

While the changes introduced by the Company in the EU are intended to reduce new privacy and security risks that the DMA poses to EU users, many risks will remain.

Changes to the Company’s business in response to the DMA or other laws and regulations could materially adversely affect the Company’s business, reputation, results of operations, financial condition and stock price.

Changes to the Company’s business in response to the DMA or other laws and regulations in the EU or in other jurisdictions, including the U.S., could materially adversely affect the Company’s business, reputation, results of operations, financial condition and stock price.

The Company is also currently subject to antitrust investigations and litigation in various jurisdictions around the world, which can result in legal proceedings and claims against the Company that could, individually or in the aggregate, have a material adverse impact on the Company’s business, results of operations, financial condition and stock price.

38 unchanged sentences

The Company is also subject to new and changing laws, regulations and other legal obligations regarding online safety, including enhanced protections for minors and mandatory age verification requirements.

These obligations can increase regulatory risks by requiring complex compliance measures and significant modifications to the Company’s products, services and operations, and may lead to operational disruptions, heightened privacy and data security risks, increased costs and potential liability and fines, all of which can have a material adverse impact on the Company’s business, financial condition, results of operations and stock price.

These obligations can increase regulatory risks by requiring complex compliance measures and significant modifications to the Company’s products, services and operations, and may lead to operational disruptions, heightened privacy and data security risks, and increased costs, all of which can have a material adverse impact on the Company’s business, results of operations, financial condition and stock price.

Failure to comply with such changing laws, regulations and other legal obligations can also result in significant penalties and fines, and legal liability.

| Q3 2026 Form 10-Q | 23

Issues related to artificial intelligence may result in reputational, competitive and financial harm to the Company, regulatory action, legal liability, and other material adverse effects to the Company’s business, results of operations, financial condition and stock price.

Artificial intelligence technologies are increasingly integrated into the Company’s products and services and its business and operations.

These technologies present emerging legal, regulatory, ethical and operational risks that could materially adversely affect the Company’s business, results of operations and financial condition.

For example, the Company’s artificial intelligence efforts may give rise to risks related to:

competition and strategy;

recouping costs and returns on investments;

product liability;

intellectual property infringement;

data privacy;

cybersecurity;

sanctions and export controls;

exposing users to harmful, inaccurate or other negative content or experiences;

bias and discrimination;

and online safety and protection of minors;

among other issues.

While the Company is committed to developing and deploying artificial intelligence responsibly, the Company may be unsuccessful in identifying or resolving all potential issues and failures before they arise.

As a result, the Company could be exposed to reputational and competitive harm, regulatory action, legal liability, and other material adverse effects to its business, results of operations, financial condition and stock price.

The Company’s net sales and gross margins are subject to volatility and downward pressure due to a variety of factors.

The Company’s gross margins vary significantly across its products, services, geographic segments and distribution channels and can change over time.

The Company’s net sales and gross margins are subject to volatility and downward pressure due to a variety of factors, including:

industry-wide supply constraints and increasing costs for components such as advanced semiconductors, storage (NAND) and memory (DRAM);

product pricing pressures and product pricing actions that the Company may take in response to such pressures;

increased competition;

the Company’s ability to effectively stimulate demand for certain of its products and services;

compressed product life cycles;

supply shortages;

potential increases in the cost of outside manufacturing services, and developing, acquiring and delivering content for the Company’s services;

the Company’s ability to manage product quality and warranty costs effectively;

shifts in the mix of products and services, or in the geographic, currency or channel mix, including to the extent that regulatory changes require the Company to modify its product and service offerings;

fluctuations in foreign exchange rates;

inflation and other macroeconomic pressures;

the imposition of new or increased tariffs and other trade restrictions, their overall magnitude and duration, and retaliatory actions in response;

and the introduction of new products or services, including new products or services with lower profit margins.

These and other factors could have a materially adverse impact on the Company’s results of operations, financial condition and stock price.

Further, the Company generates a significant portion of its net sales from a single product category and a decline in demand for that product could significantly impact net sales and gross margins.

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-Q

Item 1A. Risk Factors