What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2025-01-13 compared with 2024-01-17 · 143 added, 138 removed, 198 unchanged (59% of the section changed)

4 unchanged sentences

Risks Related to Our Ability to Grow Our Business

We may be unsuccessful at innovating in response to rapid technological changes to meet customer needs, which could cause our operating results to suffer.

We operate in rapidly evolving markets and expect the pace of innovation to continue to accelerate.

We may be unsuccessful at innovating in response to rapid technological or industry changes to meet customer needs, which could cause our operating results to suffer.

We operate in rapidly evolving industries and expect the pace of innovation to continue to accelerate.

We must continually introduce new, and enhance existing, products, services and solutions to retain customers and attract new customers.

Developing new products is complex and may not be profitable, and our investments in new technologies are speculative and may not yield the expected business or financial benefits.

Developing new products, services and solutions is complex, requires significant investment and operational costs and may not be profitable, and our investments in new technologies are speculative and may not yield the expected business or financial benefits.

The commercial success of new or enhanced products, services and solutions depends on a number of factors, including timely and successful development;

5 unchanged sentences

and differentiation from other products, services and solutions.

If we fail to anticipate or identify technological trends or fail to devote appropriate resources to adapt to such trends, our business could be harmed.

For example, generative artificial intelligence technologies provide new ways of marketing, creating content and interacting with documents that could disrupt industries in which we operate, and our business may be harmed if we fail to invest or adapt.

While we have released new generative artificial intelligence products, such as Adobe Firefly, and are focused on enhancing the artificial intelligence (“AI”) capabilities of such products and incorporating AI into existing products, services and solutions, there can be no assurance that our products will be successful or that we will innovate effectively to keep pace with the rapid evolution of AI across our Creative Cloud, Document Cloud and Experience Cloud.

If we do not successfully innovate, adapt to rapid technological changes and meet customer needs, our business and our financial results may be harmed.

If we fail to anticipate or identify technological, creative or marketing trends or fail to devote appropriate resources to adapt to such trends, our business could be harmed.

For example, generative artificial intelligence technologies enable users of all skill levels to create and provide new ways of marketing, creating content and interacting with documents, which could significantly disrupt industries in which we operate and our existing products, services and solutions and our business may be harmed if we fail to invest or adapt.

While we have released new generative artificial intelligence products, such as Adobe Firefly, and are focused on enhancing the artificial intelligence (“AI”) capabilities of our products and incorporating AI across existing products, services and solutions, there can be no assurance that our new or enhanced products and AI innovations will be successful, adopted or monetizable or that we will innovate effectively to keep pace with the rapid evolution of AI across our offerings.

If we do not successfully innovate, adapt to rapid technological or industry changes and meet customer needs, our business and our financial results may be harmed.

Issues relating to the development and use of AI, including generative AI, in our offerings may result in reputational harm, liability and adverse financial results.

Social and ethical issues relating to the use of AI, including generative AI, in our offerings may result in reputational harm, liability and additional costs.

We are increasingly incorporating AI technologies into many of our offerings.

Social, ethical and operational issues relating to the use of AI, including generative AI, in our offerings may result in reputational harm, liability and additional costs.

We are increasingly incorporating AI technologies, developed by us and by third parties, into many of our offerings.

If our AI development, deployment, content labeling or governance is ineffective or inadequate, it may result in incidents that impair the public acceptance of AI solutions or cause harm to individuals, customers or society, or result in our offerings not working as intended or producing unexpected outcomes.

Around the world, AI regulation is in the nascent stages of development.

The evolving AI regulatory environment may increase our research and development costs, increase our liability related to the use of AI by our customers or users that are beyond our control and result in inconsistencies in evolving legal frameworks across jurisdictions.

While we have taken a responsible approach to the development and use of AI in our offerings, there can be no guarantee that future AI regulations will not adversely impact us or conflict with our approach to AI, including affecting our ability to make our AI offerings available without costly changes, requiring us to change our AI development practices, monetization strategies and/or indemnity protections and subjecting us to additional compliance requirements, regulatory action, competitive harm or legal

In addition, new competition regulation on AI development and deployment could impose new requirements on our markets that could impact our business and financial results.

Uncertainty around new and evolving AI use, including generative AI, may require additional investment to develop responsible use frameworks, develop or license proprietary datasets and machine learning models and develop new approaches and processes to attribute or compensate content creators, which could be costly.

Developing, testing and deploying AI systems may also increase the cost of our offerings, including due to the nature of the computing costs involved in such systems.

These costs could adversely impact our margins as we continue to add AI capabilities to our offerings and scale our AI offerings without assurance that our customers and users will adopt them.

Jurisdictions around the world are developing and passing new regulations that apply specifically to the use of AI.

For example, the EU AI Act was adopted in 2024 and will be implemented in phases through 2030, and other jurisdictions are considering similarly focused legislation.

These regulations and the evolving AI regulatory environment may, among other impacts, result in inconsistencies among AI regulations and frameworks across jurisdictions, increase our compliance, governance and research and development costs, increase our exposure to claims related to our AI models and increase liability related to the use of AI by our customers or users that are beyond our control.

While we have taken a responsible approach to the development and use of AI, such as in our Adobe Firefly offerings, there can be no guarantee that future AI regulations will not adversely impact us or conflict with our approach to AI, including affecting our ability to make our AI offerings available without costly changes, delaying or halting development of AI offerings, requiring us to change our AI development practices, monetization strategies and/or indemnity protections and subjecting us to additional compliance requirements, regulatory action, competitive harm, reputational harm and/or legal liability.

To the extent we rely on third-party AI models in our products, services and solutions, we will face risks inherent in how those models have been developed and deployed, including situations in which the third party may lack a proper license or consent for the training data used for their model.

In addition, new competition regulations on AI development and deployment could impose new requirements on our markets that could impact our business and financial results.

Uncertainty around new and evolving AI uses may require significant, additional investment to develop models and proprietary datasets, responsible-use frameworks and new approaches and processes to attribute or compensate content creators.

We have experienced, and may in the future experience, challenges accessing AI models, datasets or hardware.

Developing, testing and deploying AI systems may also increase the cost of our offerings, including due to the nature of the computing costs

involved in such systems.

These costs could adversely impact our margins as we continue to make significant investments in AI development, add AI capabilities to our offerings and scale our AI offerings without assurance that our customers and users will adopt them.

Further, as with any new offerings based on new technologies, consumer reception and monetization pathways are uncertain, our strategies may not be successful and our business and financial results could be adversely impacted.

New AI offerings and technologies could disrupt workforce needs, result in negative publicity about AI and have the potential to affect demand for our existing products, services and solutions, all of which could adversely impact our business.

New AI offerings and technologies could modify workforce needs, result in negative publicity about AI and decrease demand for our existing products, services and solutions, all of which could adversely impact our business.

We participate in rapidly evolving and intensely competitive markets, and, if we do not compete effectively, our operating results could suffer.

The markets for our products, services and solutions are rapidly evolving and intensely competitive.

We expect competition to continue to intensify.

Our numerous competitors range in size from diversified global companies with significant sales and research and development resources, broad brand awareness, long operating histories or access to large customer bases to small companies whose specialized focuses may allow them to more easily and effectively deploy technical, marketing and financial resources.

Our competitors may develop or acquire products, services or solutions that are similar to ours or that achieve greater or faster acceptance, may undertake more far-reaching and successful product development efforts or marketing campaigns or may adopt more aggressive pricing policies.

As a result, current and potential customers may select the products, services or solutions of our competitors.

Further, our future success depends on our continued ability to effectively appeal to businesses and consumers.

New industry standards, evolving distribution models, limited barriers to entry, short product life cycles, customer price sensitivity, global market conditions and the frequent entry of new products or competitors may increase downward pressure on pricing and gross margins and adversely affect our renewal, upsell and cross-sell rates as well as our ability to attract new customers.

In addition, we expect to face more competition as AI continues to advance and be integrated into the markets in which we compete.

Our competitors or other third parties may incorporate AI into their offerings more successfully and efficiently than we do and achieve greater and faster adoption, which could impair our ability to compete effectively and adversely affect our business and financial results.

Other companies have, or in the future may obtain, proprietary rights that would prevent, limit or interfere with our ability to make, use or sell our AI offerings.

Further, we expect AI offerings to be highly competitive and rapidly evolving.

For example, we face increasing competition from companies offering generative AI capabilities, including text-to-image, text-to-video and multi-modal offerings that compete directly with our creative offerings.

If we are not able to provide products, services and solutions that compete effectively, we could experience reduced sales and our business could be adversely affected.

For additional information regarding our competition and the risks arising out of the competitive environment in which we operate, see the section titled “Competition” contained in Part I, Item 1 of this report.

If our reputation or our brands are damaged, our business and financial results may be adversely affected.

We believe our reputation and brands have been, and we expect them to continue to be, important to our business and financial results.

Maintaining and enhancing our brands may require us to make substantial investments and these investments may not be successful.

We have experienced, and may in the future experience, reputational harm from, among other things, the introduction of new products, features, services, or terms that do not meet customer expectations;

our position on or approach to new and evolving technologies, including AI;

backlash from customers, the creative community, government entities or other stakeholders that disagree with our product offering decisions or public policy, ethical or political positions;

significant litigation or regulatory actions that negatively reflect on our business practices;

data security breaches or compliance failures;

and public scrutiny or negative publicity, including being the target of media and social media campaigns, criticizing our actual or perceived actions or inactions, policies, terms, agreements, handling of user privacy, data practices or content.

Further, our brands may be negatively affected by uses of our products, services or solutions, particularly our AI offerings, in ways that are out of our control, such as to create or disseminate content that is deemed to be misleading, deceptive or intended to manipulate public opinion, or for illicit, objectionable or illegal ends, or by our failure to respond appropriately and in a timely manner to such uses.

Such uses may result in controversy or claims related to defamation, rights of publicity, illegal content, intellectual property infringement, harmful content, misinformation and disinformation, harmful bias, misappropriation, data privacy, derivative uses of third-party AI and personal injury torts.

If we fail to appropriately respond to objectionable content created using our products, services or solutions or shared on our platforms, our users may lose confidence in our brands.

Entry into markets with weaker protection of brands or changes in the legal systems in countries in which we operate may also impact our ability to protect our brands.

If we fail to maintain, enhance or protect our brands, or if we incur excessive expenses in our efforts to do so, our users’ trust in us and purchasing decisions and our business and financial results may be adversely affected.

We may not realize the anticipated benefits of investments or acquisitions, and they may disrupt our business and divert management’s attention.

15 unchanged sentences

• failure to identify significant problems, liabilities or other challenges during due diligence.

Our ability to acquire other businesses or technologies, make strategic investments or integrate acquired businesses effectively may also be impaired by adverse economic and political events, including trade tensions, and increased global scrutiny of acquisitions and strategic investments.

A number of countries, including the United States and countries in Europe and the Asia-Pacific region, are considering or have adopted more stringent restrictions or guidelines for such transactions.

Governments may continue to adopt or tighten restrictions of this nature, and such restrictions or government actions could negatively impact our business and financial results.

Further, if we are not able to complete an announced acquisition or investment, or we do not achieve the financial and strategic goals of an acquisition or investment, we may not realize the anticipated benefits of such acquisition or investment or we may incur additional costs, which may negatively impact our business and financial results.

We participate in rapidly evolving and intensely competitive markets, and, if we do not compete effectively, our operating results could suffer.

The markets for our products, services and solutions are rapidly evolving and intensely competitive.

We expect competition to continue to intensify.

Our competitors range in size from diversified global companies with significant sales and research and development resources, broad brand awareness, long operating histories or access to large customer bases to small, specialized companies whose narrow focuses may allow them to be more effective in deploying technical, marketing and financial resources.

Our competitors may develop products, services or solutions that are similar to ours or that achieve greater acceptance, may undertake more far-reaching and successful product development efforts or marketing campaigns, or may adopt more aggressive pricing policies.

As a result, current and potential customers may select the products, services or solutions of our competitors.

Further, our future success depends on our continued ability to effectively appeal to businesses and consumers.

New industry standards, evolving distribution models, limited barriers to entry, short product life cycles, customer price sensitivity, global market conditions and the frequent entry of new products or competitors may create downward pressure on pricing and gross margins and adversely affect our renewal, upsell and cross-sell rates as well as our ability to attract new customers.

In addition, we expect to face more competition as AI continues to be integrated into the markets in which we compete.

Our competitors or other third parties may incorporate AI into their offerings more successfully than we do and achieve greater and faster adoption, which could impair our ability to compete effectively and adversely affect our business and financial results.

Further, we expect the markets for standalone AI offerings to be highly competitive and rapidly evolving.

For example, we face increasing competition from companies offering text-to-image generative AI technology that may compete directly with our own creative offerings.

If we are not able to provide products, services and solutions that compete effectively, we could experience reduced sales and our business could be adversely affected.

If our reputation or our brands are damaged, our business and financial results may be adversely affected.

We believe our reputation and brands have been, and we expect them to continue to be, important to our business and financial results.

Maintaining and enhancing our brands may require us to make substantial investments and these investments may not be successful.

There are numerous ways that our reputation or brands could be damaged, including, among other things, introduction of new products, features or services that do not meet customer expectations, our position on or approach to new and evolving technologies, backlash from customers, government entities or other stakeholders that disagree with our product offering decisions or public policy positions, significant litigation or regulatory actions that negatively reflect on our business practices, our action or inaction or actual or perceived failure to meet our commitments on environmental, social and governance, ethical or political issues, public scrutiny regarding our handling of user privacy, data practices or content, data security breaches or compliance failures, or our approach to AI.

If we fail to appropriately respond to objectionable content created using our products, services or solutions or shared on our platforms, our users may lose confidence in our brands.

Entry into markets with weaker protection of brands or changes in the legal systems in countries in which we operate may also impact our ability to protect our brands.

If we fail to maintain, enhance or protect our brands, or if we incur excessive expenses in our efforts to do so, our business and financial results may be adversely affected.

We may not be able to complete acquisitions or other strategic transactions to realize the anticipated benefits of such acquisitions or transactions on favorable terms, or at all, including as a result of challenges in obtaining regulatory approvals, and may incur additional costs.

For example, we have experienced difficulties in obtaining regulatory approvals, resulting in the termination of a previously announced acquisition and the incurrence of additional costs.

Any of these factors may adversely affect our financial condition or results of operations.

Risks Related to the Operation of Our Business

Service interruptions or failures of our or third-party information technology systems may impair the availability of our products, services and solutions, which may expose us to liability, damage our reputation and harm our future financial results.

Much of our business, including our online store at adobe.com and our Creative Cloud, Document Cloud and Experience Cloud solutions, relies on hardware and services that are hosted, managed and controlled directly by us or third-party service providers to be available to customers and users without disruption.

Much of our business, including our online store at adobe.com and our cloud solutions, relies on hardware and services that are hosted, managed and controlled directly by us or third-party service providers to be available to our customers and users without disruption.

We do not have redundancy for all our systems, many of our critical applications (“Apps”) reside in only one of our data centers, and our disaster recovery planning may not account for all eventualities.

If any critical third-party service provider of hosting or content delivery services is negatively affected or becomes unavailable to us for any reason, we may not be able to deliver the corresponding products, services or solutions to our customers and users.

Failure of our systems or those of our third-party service providers could disrupt our business operations and those of our customers, subject us to reputational harm, require costly and time-intensive notifications, and cause us to lose customers, users and future business.

Failure of our systems or those of our third-party service providers could cause large, system-wide failures, disrupt our business operations and those of our customers, subject us to reputational harm, require costly and time-intensive notifications, and cause us to lose customers, users and future business.

Occasionally, we migrate data among data centers and to third-party hosted environments.

6 unchanged sentences

If we supply materially inaccurate information or experience significant interruptions in our systems, our reputation could be harmed, we could lose customers and we could be found liable for damages or incur other losses.

Security incidents, improper access to or disclosure of our customers’ data or other cyber incidents may harm our reputation and materially and adversely affect our business.

Security incidents, improper access to or disclosure of our customers’ data or other cybersecurity incidents may harm our reputation and materially and adversely affect our business.

Our products, services and solutions collect, store, manage and otherwise process third-party data, including our customers’ data and our own data.

Such products, services and solutions as well as our technologies, systems and networks have been subject to, and may in the future be subject to, cyberattacks, computer viruses, ransomware or other malware, fraud, worms, social engineering, denial-of-service attacks, malicious software programs, insider threats and other cybersecurity incidents that have in the past, and may in the future, result in the unauthorized access, disclosure, acquisition, use, loss or destruction of sensitive personal or business data belonging to us and our customers.

Cybersecurity incidents can be caused by human error from our workforce or that of our third-party service providers, by malicious third parties, acting alone or in groups, or by more sophisticated organizations, including nation-states and state-sponsored organizations.

Such risks may be elevated in connection with geopolitical tensions, including the Russia-Ukraine war.

Such risks may be elevated in connection with geopolitical tensions, including the Russia-Ukraine war and the conflict in the Middle East.

Certain unauthorized parties have in the past managed, and may in the future manage, to overcome our security measures and those of our third-party service providers to access and misuse systems and software by exploiting defects in design or manufacture, including bugs, vulnerabilities and other problems that unexpectedly compromise the security or operation of a product or system.

Further, malicious third parties have in the past attempted, and may in the future attempt, to fraudulently induce our employees or users of our products, services or solutions to disclose sensitive, personal or confidential information via illegal electronic spamming, phishing or other tactics, and this risk is heightened in our current hybrid model working environment.

Malicious actors may engage in fraudulent or abusive activities through our products, services and solutions, including unauthorized use of accounts through stolen credentials, use of stolen credit cards or other payment vehicles, failure to pay for services accessed, or other activities that violate our terms of service.

Further, unauthorized parties may also gain physical access to our facilities and infiltrate our information systems or attempt to gain logical access to our products, services or information systems to access content and data and may result in computer viruses, worms, ransomware or other malware.

Malicious third parties have in the past, and may in the future, fraudulently induce our employees or users of our products, services or solutions to disclose sensitive, personal or confidential information via illegal electronic spamming, phishing, social engineering or other tactics, and this risk is heightened in our current hybrid model working environment.

Malicious actors may also engage in fraudulent or abusive activities through our products, services and solutions, including unauthorized use of accounts through stolen credentials, use of stolen credit cards or other payment vehicles, failure to pay for services accessed, or other activities that

violate our terms of service.

While we actively combat such fraudulent activities, we have experienced, and may in the future experience, impacts to our revenue from such activities.

Further, unauthorized parties may also gain physical access to our facilities and infiltrate our information systems or attempt to gain

logical access to our products, services or information systems to access content and data.

The loss of or unauthorized access to data, such as resulting from computer viruses, worms, ransomware or other malware may harm our systems, expose us to litigation or regulatory investigation and subject us to costly and time-intensive notification requirements.

We devote significant resources to address security vulnerabilities through engineering more secure products, enhancing security and reliability features in our products and systems, code hardening, conducting rigorous penetration tests, deploying updates to address security vulnerabilities, regularly reviewing our service providers’ security controls, reviewing and auditing our products, services and solutions against information security control frameworks, providing resources, such as security training, to our workforce, and continually assessing and improving, as appropriate, our incident response process.

Despite our preventative efforts, there is no assurance that our security measures will provide full effective protection from such events.

The costs to prevent, eliminate, mitigate or remediate cybersecurity or other security problems and vulnerabilities are significant and may reduce our operating margins.

Further, our efforts to address these problems, including notifying affected third parties when appropriate, have in the past been, and may in the future be, unsuccessful or delayed, which could result in business interruptions, cessation of service and loss of existing or potential customers.

Maintaining the security of our products, services and solutions is a critical issue for us and our customers.

It is impossible to predict the extent, frequency or impact cybersecurity issues may have on us.

Breaches of our security measures and the accidental loss, inadvertent disclosure or unauthorized dissemination of proprietary information or sensitive, personal or confidential data about us, our employees, our customers or their end users, including the potential loss or disclosure of such information or data could expose us, our employees, our customers or other individuals affected to a risk of loss or misuse of this information.

Actual or perceived security vulnerabilities or incidents may result in claims or litigation and liability or fines (and have in the past led to such claims), costly and time-intensive notice requirements, governmental inquiry or oversight or a loss of customer confidence, any of which could harm our business and damage our brand and reputation.

Our customers may also adopt security measures to protect their computer systems and their instances of our software from attack and may suffer a cybersecurity attack on their own systems, unrelated to our systems.

We devote significant resources to address security vulnerabilities through various methods, including, but not limited to, engineering more secure products, enhancing security and reliability features in our products and systems, regularly reviewing our service providers’ security controls, and continually assessing and improving, as appropriate, our incident response process.

However, it is impossible to accurately predict the extent, frequency or impact cybersecurity issues may have on us, and our security measures do not provide full effective protection from all such events.

The costs to prevent, eliminate, mitigate or remediate cybersecurity or other security problems and vulnerabilities are significant and may reduce our margins.

Breaches of our security measures and the accidental loss, inadvertent disclosure or unauthorized dissemination of proprietary information or sensitive, personal or confidential data about us, our employees, our customers or their end users, including the potential loss or disclosure of such information or data have in the past, and could in the future, expose us, our employees, our customers or other individuals affected to a risk of loss or misuse of this information.

Actual or perceived security vulnerabilities or incidents have resulted in, and may result in additional, claims or litigation and liability or fines, costly and time-intensive notice requirements, governmental inquiry or oversight or a loss of customer confidence, any of which could harm our business and damage our brand and reputation.

Our customers may also adopt security measures to protect their computer systems and their instances of our software from attack and may suffer a cybersecurity breach on their own systems, unrelated to our systems.

Even if such breach is unrelated to our security systems, solutions or programs, such breach could cause us reputational harm and require us to incur significant economic and operational consequences to adequately assess and respond to their breach, and to implement additional safeguards designed to protect against future breaches.

While we maintain insurance to cover operational risks, such as cyber risk and technology outages, our insurance may not be sufficient to cover all liability described herein.

While we maintain insurance to cover operational risks, such as cybersecurity risk and technology outages, our insurance may not be sufficient to cover all liability described herein.

These risks will likely increase as we expand our hosted offerings, integrate our products, services and solutions and store and process more data.

1 unchanged sentence

If we are unable to develop, manage and maintain critical third-party relationships, such as our sales, partner and distribution channels, suppliers and service providers, our revenue and business may be adversely affected.

We contract with a number of software distributors and other third parties to distribute our products, services and solutions, none of which are individually responsible for a material amount of our total net revenue in any recent period.

Successfully managing our distribution channels and sales partners to reach various customers for our products, services and solutions is a complex and global process.

We rely on a number of third-party distributors and sales partners to distribute our products, services and solutions.

The successful management of such third-party relationships is a complex, global process.

If an agreement with one of our distributors or partners was terminated, any prolonged delay in securing a replacement distributor or partner could have a negative impact on our results of operations.

8 unchanged sentences

In addition, the loss of key sales employees could impact our customer relationships and future ability to sell to certain accounts covered by such employees.

We rely on third-party service providers and technologies to deliver our products, services and business operations and to operate critical business systems, such as cloud-based infrastructure, data center facilities, encryption and authentication technology and company email, communications with customers.

If such third parties are negatively affected, if we fail to effectively develop, manage and maintain our relationships with such third parties, or if we are unable to renew our agreements with them on favorable terms or at all, our expenses could significantly increase, and we and our customers may experience service interruptions.

We rely on third-party service providers and technologies to deliver our products, services and business operations and to operate critical business systems, such as cloud-based infrastructure, data center facilities, generative AI, encryption and authentication technology, company email and communications with customers.

experience service interruptions.

Any disruption or damage to, or failure of our systems generally, including the systems of our third-party platform providers, could result in interruptions in our services and harm our business.

22 unchanged sentences

Such disruption could also negatively impact our customers’ ability to pay us due to delays or inability to access their existing cash.

As of December 1, 2023, our investment portfolio consisted of asset-backed securities, corporate debt securities, money market funds, time deposits, U.S.

agency securities and U.S.

Treasury securities.

As of November 29, 2024, our investment portfolio consisted of money market funds, corporate debt securities, U.S.

Treasury securities, time deposits, U.S.

agency securities and asset-backed securities.

These investments are subject to credit, liquidity, market, and interest rate risks as well as economic downturns or events that affect global or regional financial markets that may cause the value of our investments to decline, requiring impairment charges, which could adversely affect our financial condition.

If we are unable to recruit and retain key personnel, our business may be harmed, and our hybrid work model may present challenges, which could adversely impact our business.

Much of our future success depends on the continued service, availability and performance of our senior management and highly skilled personnel across all levels of our organization.

Our senior management has acquired specialized knowledge and skills with respect to our business, and the loss of any of these individuals could harm our business, especially if we are not successful in developing adequate succession plans.

Our efforts to attract, develop, integrate and retain highly skilled employees may be compounded by intensified restrictions on travel, immigration or the availability of work visas.

The technology industry is often subject to substantial and continuous competition for talent, particularly with cybersecurity and AI backgrounds, and demand for cutting-edge or unique skill sets can be highly competitive, both of which are heightened with the increased availability of hybrid or remote working arrangements.

We face an increasingly difficult challenge to attract and retain highly qualified security personnel to assist us in combating security threats.

We may experience higher compensation costs to retain and recruit senior management and highly skilled personnel that may not be offset by improved productivity or increased sales.

Our hybrid work environment may also present operational and workplace culture challenges, which could negatively affect our ability to execute against our business objectives and retain and recruit personnel.

We continue to hire personnel in countries where exceptional technical knowledge and other expertise are offered at lower costs, which increases the efficiency of our global workforce structure and reduces our personnel-related expenditures.

Nonetheless, as globalization continues, competition for talent in those countries has increased, which may impact our ability to retain these employees and increase our compensation-related expenses.

Some of our enterprise offerings have extended and complex sales cycles, which may increase our costs and make our sales cycles unpredictable.

As we continue to target large enterprise customers for certain of our offerings, including Adobe Experience Cloud in our Digital Experience business and our Enterprise Term License Agreements in our Digital Media business, we may face increased costs, longer sales cycles, greater competition and less predictability in completing our sales.

For our enterprise customers, the evaluation process may be longer and more involved, and require us to invest more in educating our customers about our products, services and solutions, particularly because the decision to use our products, services and solutions is often an enterprise-wide decision.

As we continue to target enterprise customers for certain of our offerings, including Adobe Experience Cloud in our Digital Experience business and our Enterprise Term License Agreements in our Digital Media business, we may face increased costs, longer sales cycles, greater competition and less predictability in completing our sales.

For our enterprise customers, the

evaluation process may be longer and more involved, and require us to invest more in educating our customers about our products, services and solutions, particularly because the decision to use our products, services and solutions is often an enterprise-wide decision.

We are increasingly offering end-to-end solutions that include cross-cloud and generative AI capabilities, which have in the past, and may in the future, increase the complexity of technical or contractual assurances or requirements that we or our customers require as part of the contracting process, leading to extended sales cycles.

We may be required to submit more robust proposals, participate in extended proof-of-concept evaluation cycles and engage in more extensive contract negotiations.

In addition, our enterprise customers often demand more complex configurations and additional integration services and product features.

Adverse macroeconomic conditions have caused, and may cause in the future, delays in our enterprise customers’ purchasing decisions.

Adverse macroeconomic conditions have caused, and may continue to cause, additional spend scrutiny and delays in our enterprise customers’ purchasing decisions.

Due to these factors, we often must devote greater sales support to certain enterprise customers, which increases our costs and time required to complete a sale, without assurance that potential customers will ultimately purchase our solutions.

1 unchanged sentence

Since the sales cycles for our enterprise offerings are multi-phased and complex, it is often unpredictable when a given sales cycle will close.

Our revenue from enterprise customers may be affected by longer-than-expected sales and implementation cycles, extended collection cycles, potential deferral of revenue and alternative licensing arrangements.

Additionally, our enterprise sales pattern has historically been uneven, where a higher percentage of a quarter’s total sales occur during the final weeks of each quarter, which is common in our industry.

Our revenue from enterprise customers may be affected by longer-than-expected sales, contract negotiation and implementation cycles, extended collection cycles, potential deferral of revenue and alternative licensing arrangements.

Additionally, our enterprise sales pattern has historically been, and is expected to remain, uneven, where a higher percentage of a quarter’s total sales occur during the final weeks of each quarter, which is common in our industry.

If we are unable to recruit and retain key personnel, our business may be harmed, and our hybrid work model may present challenges, which could adversely impact our business.

Much of our future success depends on the continued service, availability and performance of our senior management and highly skilled personnel across all levels of our organization.

Our efforts to attract, develop, integrate and retain highly skilled employees may be compounded by intensified restrictions on immigration or the availability of work visas.

The technology industry has been and may continue to be subject to substantial and continuous competition for talent, particularly with AI and cybersecurity backgrounds, and demand for cutting-edge or unique skill sets may continue to be highly competitive, both of which are heightened with hybrid or remote working arrangements.

Our hybrid work environment may also present operational, security and workplace culture challenges, which could negatively affect our ability to execute against our business objectives and retain and recruit personnel.

We have experienced, and may continue to experience, higher compensation costs to retain and recruit senior management or highly skilled personnel that may not be offset by innovation, improved productivity or increased sales.

Risks Related to Laws and Regulations

We are, and may in the future become, subject to litigation, regulatory inquiries and other claims, which could result in an unfavorable outcome and have an adverse effect on our business, financial condition, results of operation and cash flows.

We are, and may in the future become, subject to various legal proceedings (including class action lawsuits), claims, negotiations and regulatory inquiries and additional claims, enforcement actions and inquiries may arise in the future, such as those relating to antitrust, data privacy and security, consumer protection, product liability and the validity or alleged infringement of third-party intellectual property rights, including patent rights, among others.

Such activity has increased over time with evolving regulatory landscapes and as our products, services and solutions have become more available to, and used by, more enterprises and consumers.

For example, there is an increase in enforcement activity in connection with federal and state consumer protection laws, including some suits which seek civil penalties.

Any proceedings, actions, claims or inquiries initiated by or against us, whether successful or not, may be highly time consuming;

result in costly litigation, damage awards, consent decrees, injunctive relief or increased costs of business;

require us to change our business practices or products;

result in negative publicity;

require significant amounts of management time;

result in the diversion of significant operational resources;

or otherwise harm our business and financial results.

Disputes and litigation can be complex and are typically costly and can be disruptive to our business operations by diverting the attention of management and key personnel.

For example, third-party intellectual property disputes, including those initiated by patent assertion entities, could subject us to significant liabilities, require us to enter into royalty and licensing arrangements on unfavorable terms, prevent us from offering certain products, services or solutions, subject us to injunctions restricting our sales, cause severe disruptions to our operations or the markets in which we compete, or require us to satisfy

indemnification commitments with our customers, including contractual provisions under various license arrangements and service agreements.

In addition, we have incurred, and may in the future incur, significant costs in acquiring the necessary third-party intellectual property rights for use in our products, in some cases to fulfill contractual obligations with our customers.

Any of these occurrences could significantly harm our business.

We have not prevailed, and may not in the future prevail, in every lawsuit or dispute.

F or further information about specific litigation and proceedings, see the section titled “Legal Proceedings” contained in Part II, Item 8, Note 16 of our Notes to Consolidated Financial Statements of this report.

We are subject to risks associated with compliance with laws and regulations globally, which may harm our business.

We are a global company subject to varied and complex laws, regulations and customs, both domestically and internationally.

These laws and regulations relate to a number of aspects of our business, including trade compliance, import and export control, anti-boycott, economic sanctions and embargoes, data and transaction processing security, payment card industry data security standards, consumer protection, records management, user-generated content hosted on websites we operate, privacy practices, data residency, corporate governance, antitrust and competition, employee and third-party complaints, anti-corruption, gift policies, conflicts of interest, securities regulations and other regulatory requirements affecting trade and investment.

The application of these laws and regulations to our business is often unclear and may at times conflict.

For example, we are subject to the U.S.

Foreign Corrupt Practices Act and other anti-corruption and anti-bribery laws, but in other foreign countries, particularly those with developing economies, it is common to engage in practices that would be prohibited under such acts.

These local, state, federal and international laws and regulations relate to a number of aspects of our business, including trade laws such as import and export controls, anti-boycott, economic sanctions and embargoes, data and transaction processing security, payment card industry data security standards, consumer protection, records management, user-generated content hosted on websites we operate, privacy practices, data residency, AI regulations, corporate governance, antitrust and competition, employee and third-party complaints, anti-corruption, conflicts of interest, securities regulations and other regulatory requirements affecting trade and investment.

The application of these laws and regulations to our business is often unclear and evolving, and may at times conflict.

Further, we are subject to the U.S.

Foreign Corrupt Practices Act and other anti-corruption and anti-bribery laws, which may conflict with local customs and practices in other foreign countries, particularly those with developing economies where it is common to engage in practices that would be prohibited under such laws.

We cannot provide assurance that our employees, contractors, agents, business partners and vendors will not take actions in violation of our internal policies, U.S.

laws or other applicable international laws.

Compliance with these laws and regulations may involve significant costs or require changes in our business practices that result in reduced revenue and profitability.

Compliance with the above laws and regulations may involve significant costs or require additional changes to our business practices that result in reduced revenue and profitability.

Non-compliance could also result in fines, damages, criminal sanctions against us, our officers or our employees, prohibitions on the conduct of our business and damage to our reputation.

5 unchanged sentences

These laws, regulations and codes are inconsistent across jurisdictions and are subject to evolving and differing (sometimes conflicting) interpretations.

Government officials and regulators, privacy advocates and class action attorneys are increasingly scrutinizing how companies collect, process, use, store, share and transmit personal data.

Government officials and regulators, privacy advocates and class action attorneys are increasingly scrutinizing how companies collect, process, use, store, share and transmit personal data, including the transferring of personal information across international borders.

This scrutiny can result in new and shifting interpretations of existing laws, thereby further impacting our business.

For example, the General Data Protection Regulation (“GDPR”) in the European Economic Area, and the United Kingdom continues to be interpreted by European and UK courts in novel ways leading to shifting requirements, country specific differences in application and uncertain enforcement priorities.

More recently enacted laws, such as the Personal Information Protection Law in China, and new and emerging state laws in the United States on privacy, data and related technologies, such as the California Consumer Privacy Act, the California Privacy Rights Act, the Colorado Privacy Act and the Virginia Consumer Data Protection Act, as well as industry self-regulatory codes and regulatory requirements, create new privacy and security compliance obligations and expand the scope of potential liability, either jointly or severally with our customers and suppliers.

As a security example, pursuant to the U.S.

Securities and Exchange Commission’s Rules on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure we are required to make certain disclosures related to material cybersecurity incidents and the reasonably likely impact of such an incident on Form 8-K and will be required to make certain other cybersecurity disclosures on Form 10-K.

For example, European data transfers outside the European Economic Area are highly regulated and litigated.

The mechanisms that we and many other companies rely upon for European data transfers (for example, Standard Contractual Clauses and the EU - US Data Privacy Framework) are the subject of legal challenge, regulatory interpretation and judicial decisions by the Court of Justice of the European Union.

Several other countries, including but not limited to the United States, China, Australia, New Zealand, Brazil, Kingdom of Saudi Arabia, Hong Kong and Japan, have also established specific legal requirements for cross-border transfers of personal information and certain countries have also established specific legal requirements for data localization (such as where personal data must remain stored in the country).

If other countries implement more restrictive regulations for cross-border data transfers or do not permit data to leave the country of origin, such developments could adversely impact our business and our enterprise customers’ business, our financial condition and our results of operations in those jurisdictions.

Additionally, the General Data Protection Regulation in the European Economic Area and the United Kingdom continues to be interpreted by European and UK courts in novel ways leading to shifting requirements, country-specific differences in application and uncertain enforcement priorities.

Laws in Asia, such as the Personal Information Protection Law in China and developing laws in India, as well as state laws in the United States on privacy, data and related technologies, such as the California Consumer Privacy Act, the California Privacy Rights Act, the Colorado Privacy Act and the Virginia Consumer Data Protection Act, as well as industry self-regulatory codes and regulatory requirements, create additional privacy and security compliance obligations and expand the scope of potential liability, either jointly or severally with our customers and suppliers.

Further, the U.S.

Securities and Exchange Commission’s Rules on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure requires us to make certain disclosures related

to material cybersecurity incidents and the reasonably likely impact of such an incident on Form 8-K.

Determining whether a cybersecurity incident is notifiable or reportable may not be straightforward and any such mandatory disclosures could be costly and lead to negative publicity, loss of customer confidence in the effectiveness of our security measures, diversion of management’s attention and governmental investigations.

3 unchanged sentences

Additionally, we collect and store information on behalf of our business customers and if our customers fail to comply with contractual obligations or applicable laws, it could result in litigation or reputational harm to us.

Transferring personal information across international borders is complex and subject to legal and regulatory requirements as well as active litigation and enforcement in a number of jurisdictions around the world, each of which could have an adverse impact on our ability to process and transfer personal data as part of our business operations.

For example, European data transfers outside the European Economic Area are highly regulated and litigated.

The suitability of Standard Contractual Clauses for data transfer in some scenarios has recently been the subject of legal challenge, and while the United States and the European Union reached agreement on the EU - US Data Privacy Framework, there are legal challenges to that data transfer mechanism as well.

We continue to closely monitor for developments related to valid transfer mechanisms available for transferring personal data outside the European Economic Area (including the EU - US Data Privacy Framework) and other countries that have similar trans-border data flow requirements and adjust our practices accordingly.

The open judicial questions and regulatory interpretations related to the validity of transfers using Standard Contractual Clauses have resulted in some changes in the obligations required to provide our services in the European Union and could expose us to potential sanctions and fines for non-compliance.

Several other countries, including China, Australia, New Zealand, Brazil, Hong Kong and Japan, have also established specific legal requirements for cross-border transfers of personal information and certain countries have also established specific legal requirements for data

localization (such as where personal data must remain stored in the country).

Our intellectual property portfolio is a valuable asset and we may not be able to protect our intellectual property rights, including our source code, from infringement or unauthorized copying, use or disclosure.

15 unchanged sentences

If we cannot protect our intellectual property against unauthorized copying, use, or other misappropriation, our business could be harmed.

We are, and may in the future become, subject to litigation, regulatory inquiries and intellectual property infringement claims, which could result in an unfavorable outcome and have an adverse effect on our business, financial condition, results of operation and cash flows.

We are subject to various legal proceedings (including class action lawsuits), claims and regulatory inquiries that are not yet resolved and additional claims, enforcement actions and inquiries may arise in the future.

Any proceedings, actions, claims or inquiries initiated by or against us, whether successful or not, may be time consuming;

result in costly litigation, damage awards, consent decrees, injunctive relief or increased costs of business;

require us to change our business practices or products;

result in negative publicity;

require significant amounts of management time;

result in the diversion of significant operational resources, or otherwise harm our business and financial results.

Additionally, we are currently, and may in the future be subject to claims, negotiations and complex, protracted litigation relating to disputes regarding the validity or alleged infringement of third-party intellectual property rights, including patent rights.

Intellectual property disputes and litigation are typically costly and can be disruptive to our business operations by diverting the attention of management and key personnel.

Third-party intellectual property disputes, including those initiated by patent assertion entities, could subject us to significant liabilities, require us to enter into royalty and licensing arrangements on unfavorable terms, prevent us from offering certain products, services or solutions, subject us to injunctions restricting our sales, cause severe disruptions to our operations or the markets in which we compete, or require us to satisfy indemnification commitments with our customers, including contractual provisions under various license arrangements and service agreements.

Any of these occurrences could significantly harm our business.

We have not prevailed, and may not in the future prevail, in every lawsuit or dispute.

For further information about specific litigation and proceedings, see the section titled “Legal Proceedings” contained in Part II, Item 8, Note 16 of our Notes to Consolidated Financial Statements of this report.

Changes in tax rules and regulations or interpretations thereof may adversely affect our effective tax rates.

2 unchanged sentences

Tax laws in the United States as well as other countries and jurisdictions in which we conduct business are subject to change as new laws are passed and/or new interpretations are made available, which may have a material impact on our business.

These countries, governmental bodies, such as the European Commission of the European Union, and intergovernmental economic

organizations, such as the Organization for Economic Cooperation and Development, have made or could make unprecedented assertions about how taxation is determined and, in some cases, have proposed or enacted new laws that are contrary to the way in which rules and regulations have historically been interpreted and applied.

These countries, governmental bodies, such as the European Commission of the European Union, and intergovernmental economic organizations, such as the Organization for Economic Cooperation and Development, have made or could make unprecedented assertions about how taxation is determined and, in some cases, have proposed or enacted new laws that are contrary to the way in which rules and regulations have historically been interpreted and applied.

Changes in our operating landscape, such as changes in laws or interpretations of tax rules, could adversely affect our effective tax rates and/or cause us to respond by making changes to our business structure, which could adversely affect our operations and financial results.

10 unchanged sentences

Such processes are complex, lengthy and can often be delayed.

Furthermore, requirements may change, or we may be unable to achieve or sustain one or more government authorizations or certifications, which could affect our ability to sell to government entities until we meet any revised requirements.

Risks Related to Financial Performance

11 unchanged sentences

Our operating results and performance metrics are subject to fluctuations in foreign currency exchange rates due to the global scope of our business.

Geopolitical and economic events, including war, trade disputes, economic sanctions and

emerging market volatility, and associated uncertainty have caused, and may in the future cause, currencies to fluctuate.

Geopolitical and economic events, including war, trade disputes, economic sanctions and emerging market volatility, and associated uncertainty have caused, and may in the future cause, currencies to fluctuate.

Accordingly, amounts reported as annualized recurring revenue, a performance metric which we measure at currency rates that are set at the beginning of each fiscal year and held constant throughout the year, may vary from actual revenue recognized in accordance with generally accepted accounting principles in the United States.

7 unchanged sentences

Our existing and future debt obligations may adversely affect our financial condition and future financial results.

As of December 1, 2023, we had $3.65 billion in senior unsecured notes outstanding and a $3 billion commercial paper program with no amounts outstanding.

We also had a $1.5 billion senior unsecured revolving credit agreement and $3.5 billion delayed draw term loan agreement, both of which were undrawn.

Subsequent to December 1, 2023, the delayed draw term loan agreement was terminated.

As of November 29, 2024, we had $5.65 billion in senior unsecured notes outstanding and a $3 billion commercial paper program with no amounts outstanding.

We also had a $1.5 billion senior unsecured revolving credit agreement, which was undrawn.

This debt or future additional indebtedness may adversely affect our financial condition and future financial results by, among other things:

13 unchanged sentences

Our corporate headquarters, significant research and development activity, certain of our data centers and other critical business operations are in the San Francisco Bay Area and the Salt Lake Valley Area, both of which are near major earthquake faults.

A catastrophic event, particularly one that may

disrupt our data centers or our critical activities, could prevent us from conducting normal business operations and providing our products, services and solutions, which could adversely affect our business.

A catastrophic event could negatively impact a country or region in which we sell and, in turn, decrease demand for our products, services and solutions, which could negatively impact our business.

Climate-related catastrophic events that may harm our business are also increasing in frequency and severity.

We may be subject to additional climate-related regulations and reporting requirements and changing market dynamics and stakeholder expectations regarding climate change and our environmental impacts, all of which may impact our business, financial condition and results of operations.

The occurrence of an epidemic or a pandemic, such as the COVID-19 pandemic, has had and may continue to have an adverse effect on our operating results.

A catastrophic event, particularly one that may disrupt our data centers or our critical activities, could prevent us from conducting normal business operations and providing our products, services and solutions, which could adversely affect our business.

A catastrophic event could negatively impact a country or region in which we sell and, in turn, decrease demand for our products, services and solutions, which could negatively impact our business.

Laws, regulations and policies relating to environmental, social, and governance are expanding globally.

We may be subject to additional climate-related regulations and reporting requirements in the future, as well as changing market dynamics and stakeholder expectations regarding climate change and our environmental impacts.

Compliance with such regulations, investments in our environmental, social and governance commitments, may involve significant costs and negatively impact our business, financial condition and results of operations.

Additionally, we may experience reputational harm from our actual or perceived failure to meet our environmental, social and governance commitments.

The occurrence of an epidemic or a pandemic, such as the COVID-19 pandemic, has had, and may in the future, have an adverse effect on our operating results.

The extent to which epidemics and pandemics impact our financial condition or results of operations will depend on many factors outside of our control and whether there is a material impact on the businesses or productivity of our customers, employees, suppliers and other partners.

3 unchanged sentences

All factors described in this Part I, Item 1A of this report, some of which are beyond our control, may affect our stock price, including:

• shortfalls in or changes to estimates, recommendations or expectations about our revenue, margins, earnings, annualized recurring revenue or other key performance metrics set forth in guidance we provide or provided by financial analysts;

• shortfalls in our results or shortfalls, changes to estimates, recommendations or expectations in guidance we provide or provided by financial analysts about our revenue, margins, earnings, annualized recurring revenue, growth rates or other key performance metrics;

• changes in investor and analyst valuation models for our stock;

6 unchanged sentences

• general economic, political or market conditions;

• other events, such as significant litigation and regulatory actions.

• other events, such as significant litigation and regulatory actions and media and social media scrutiny.

In addition, the market for technology stocks or the stock market in general has experienced, and may in the future experience, extreme fluctuations, which has caused, and may in the future cause, our stock price to decline for reasons unrelated to our financial performance.

Volatility in our stock price has increased, and in the future may increase, our susceptibility to securities class action litigation, which could result in substantial costs and divert management’s attention and resources, which may adversely affect our business.

UNRESOLVED STAFF COMMENTS

CYBERSECURITY

Not applicable.

Volatility in our stock price has increased, and may continue to increase, our susceptibility to securities class action litigation, which could result in substantial costs and divert management’s attention and resources, which may adversely affect our business.

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1A. Risk Factors