What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2026-03-03 compared with 2025-03-07 · 200 added, 185 removed, 424 unchanged (48% of the section changed)

Investing in our securities involves risks.

Before you make a decision regarding our securities, in addition to the risks and uncertainties discussed above under “Forward-Looking Statements,” you should carefully consider the specific risks set forth herein.

If any of these risks actually occur, it may materially harm our business, financial condition, liquidity and results of operations.

Before you make a decision regarding our securities, you should carefully consider the specific risks set forth herein.

If any of these risks actually occur, it may materially harm our business, financial condition, liquidity

and results of operations.

As a result, the market price of our securities could decline, and you could lose all or part of your investment.

6 unchanged sentences

• our ability to hire, timely train and retain talented individuals for our workforce, and to maintain our corporate culture as we grow;

• the effects of future pandemics and the measures taken to mitigate their spread including their adverse effects on our business, results of operations, financial condition and liquidity;

• developments with respect to retailers that are out of our control;

1 unchanged sentence

• consolidation within the industry of our clients creating pressure on the nature and pricing of our services;

• consumer goods manufacturers and retailers reviewing and changing their sales, retail, marketing and technology programs and relationships;

• CPG manufacturers and retailers reviewing and changing their sales, retail, marketing and technology programs and relationships;

• our ability to successfully develop and maintain relevant omni-channel services for our clients in an evolving industry and to otherwise adapt to significant technological change;

2 unchanged sentences

• our ability to avoid or manage business conflicts among competing brands;

• limitations, restrictions and business decisions involving our joint ventures and minority investments;

• service failures or disruptions related to certain functions we have outsourced to third-party service providers;

• business decisions involving our joint ventures and minority investments;

• our ability to identify attractive acquisition targets, acquire them at attractive prices and successfully integrate the acquired businesses;

• difficulties in integrating acquired businesses;

• complications with the implementation of our new enterprise resource planning system;

• changes in applicable laws or regulations;

2 unchanged sentences

• our ability to respond to changes in digital practices and policies;

• the harm the use of artificial intelligence (“AI”) in our business may cause to our business and reputation;

• the effects of future pandemics and the measures taken to mitigate their spread including their adverse effects on our business, results of operations, financial condition and liquidity;

• exposure to foreign currency exchange rate fluctuations and risks related to our international operations;

• our substantial indebtedness and our ability to refinance at favorable rates;

• our ability to achieve the anticipated benefits of our recent debt transactions;

• complications with the implementation of additional aspects of our new enterprise resource planning system;

• our ability to maintain proper and effective internal control over financial reporting in the future;

17 unchanged sentences

If we are unable to hire, timely train or retain talented individuals we may face higher turnover and increased labor costs, which could compromise the quality of our service, and could adversely affect our business.

Future pandemics may have an adverse effect on our business, results of operations, financial condition and liquidity.

The COVID-19 pandemic, including the measures taken to mitigate its spread, had adverse effects on our business and operations.

A future pandemic or health epidemic, could adversely impact our business and results of operations in a number of ways.

For example, the COVID-19 pandemic and measures taken to mitigate the spread of COVID-19, including restrictions on large gatherings, “shelter in place” health orders and travel restrictions, had far-reaching direct and indirect impacts on many aspects of our operations, including temporary termination of certain in-store demonstration services and other services, as well as on consumer behavior and purchasing patterns.

In particular, our Experiential Services segment experienced a significant decline in revenues, primarily due to the temporary suspension or reduction of certain in-store demonstration services and decreased demand in our digital marketing services, both of which we believe were caused by the COVID-19 pandemic and the various governmental and private responses to the pandemic.

In our sales segment, we experienced significant shifts in consumer spending preferences and habits.

We cannot predict the full extent to which a future pandemic or health epidemic, may have similar or other adverse effects on our business, financial condition, results of operations and liquidity, and the degree to which it may impact other risk factors described in this Annual Report.

Our business and results of operations are affected by developments with and policies of retailers that are out of our control.

A limited number of national retailers account for a large percentage of sales for our consumer goods manufacturer clients.

A limited number of national retailers account for a large percentage of sales for our CPG clients.

We expect that a significant portion of these clients’ sales will continue to be made through a relatively small number of retailers and that this percentage is anticipated to increase if the growth of these large retailers continues.

6 unchanged sentences

Consolidation in the industries we serve could put pressure on the pricing of our services, which could adversely affect our business, financial condition or results of operations.

Consolidation in the consumer goods and retail industries we serve could reduce aggregate demand for our services in the future and could adversely affect our business or our results of operations.

When companies consolidate, the services they previously

purchased separately are often purchased by the combined entity, leading to the termination of relationships with certain service providers or demands for reduced fees and commissions.

Consolidation in the CPG and retail industries we serve could reduce aggregate demand for our services in the future and could adversely affect our business or our results of operations.

When companies consolidate, the services they previously purchased separately are often purchased by the combined entity, leading to the termination of relationships with certain service providers or demands for reduced fees and commissions.

The combined company may also choose to insource certain functions that were historically outsourced, resulting in the termination of existing relationships with third-party service providers.

While we attempt to mitigate the impact of any consolidation by maintaining existing or winning new service arrangements with the combined companies, there can be no assurance as to the degree to which we will be able to do so as consolidation continues in the industries we serve, and our business, financial condition or results of operations may be adversely affected.

Consumer goods manufacturers and retailers may periodically review and change their sales, retail, marketing and technology programs and relationships to our detriment.

The consumer goods manufacturers and retailers to whom we provide our business solutions operate in highly competitive and rapidly changing environments.

CPG manufacturers and retailers may periodically review and change their sales, retail, marketing and technology programs and relationships to our detriment.

The CPG manufacturers and retailers to whom we provide our business solutions operate in highly competitive and rapidly changing environments.

From time to time these parties may put their sales, retail, marketing and technology programs and relationships up for competitive review.

8 unchanged sentences

The retail industry is evolving, and if we do not successfully develop and maintain relevant omni-channel services for our clients, our business, financial condition or results of operations could be adversely impacted.

Historically, substantially all of our sales segment revenues were generated by sales and services that ultimately occurred in traditional retail stores.

Historically, substantially all of our Branded Services segment revenues were generated by sales and services that ultimately occurred in traditional retail stores.

The retail industry is evolving, as demonstrated by the number of retailers that offer both traditional retail stores and e-commerce platforms or exclusively e-commerce platforms.

5 unchanged sentences

Interruption of supply chains and tariffs, retaliations or other governmental restrictions could adversely affect our business and our profitability.

The demand for our services is dependent on the ability of retailers and consumer goods manufacturers to offer and deliver products directly or indirectly to consumers.

The demand for our services is dependent on the ability of retailers and CPG manufacturers to offer and deliver products directly or indirectly to consumers.

We provide services involving a wide variety of brands that are sourced from domestic and international suppliers.

Any material interruption in the supply chains serving consumer goods manufacturers, retailers or ourselves, whether due to interruptions in service by our third-party logistic service providers, trade restrictions (such as increased tariffs, taxes or quotas, embargoes, customs or other governmental restrictions), pandemics, social or labor unrest, labor shortages, natural disasters, or political disputes and military conflicts that cause a material disruption in supply chains or a significant increase in supply costs could adversely affect our business and our profitability.

Any material interruption in the supply chains serving CPG manufacturers, retailers or ourselves, whether due to interruptions in service by our third-party logistic service providers, trade restrictions (such as increased tariffs, taxes or quotas,

embargoes, customs or other governmental restrictions), pandemics, social or labor unrest, labor shortages, natural disasters, or political disputes and military conflicts that cause a material disruption in supply chains or a significant increase in supply costs could adversely affect our business and our profitability.

We may be unable to adapt to significant technological change, which could adversely affect our business, financial condition or results of operations.

21 unchanged sentences

If we fail to offer high-quality customer service, our business and reputation may suffer.

High-quality education, training and customer service are important for successful marketing and sales and for the renewal of existing customers and for the pursuit of new customers.

Providing this education, training and service requires that our personnel who manage our online training resource or provide customer service have specific inbound experience domain knowledge and expertise, making it more difficult for us to hire qualified personnel and to scale up our support operations.

If we do not help our customers use multiple applications and provide effective ongoing service, our ability to sell additional functionality and services to, or to retain, existing customers may suffer and our reputation with existing or potential customers may be harmed.

High-quality education, training and customer service are important for services and for the renewal of existing clients and for the pursuit of potential clients.

Providing this education, training and service requires that our teammates who manage our online training resource or provide customer service have specific inbound experience domain knowledge and expertise, making it more difficult for us to hire qualified teammates and to scale up our support operations.

If we do not provide effective ongoing service to our clients, our ability to sell additional functionality and services to, or to retain, existing clients may suffer and our reputation with existing or potential clients may be harmed.

We may be adversely affected if clients reduce their outsourcing of sales and marketing functions.

1 unchanged sentence

Our clients and potential clients will outsource if they perceive that outsourcing may provide quality services at a lower overall cost and permit them to focus on their core business activities and have done so in the past.

We cannot be certain that the industry trend to outsource will continue or not be reversed or that clients that have historically outsourced functions will not decide to perform these functions themselves.

We cannot be certain that the industry trend to outsource will continue or not be reversed or that clients that have historically outsourced functions will not decide to

perform these functions themselves.

Unfavorable developments with respect to outsourcing could adversely affect our business, financial conditions and results of operations.

Divestitures or other dispositions could negatively impact our business, financial condition or results of operations.

We continually assess the strategic fit of our existing businesses and may divest, spin-off, split-off or otherwise dispose of businesses that are deemed not to fit with our strategic plan or are not achieving the desired return on investment.

We continually assess the strategic fit of our existing businesses and may divest, or otherwise dispose of businesses that are deemed not to fit with our strategic plan or are not achieving the desired return on investment.

Since January 2023, we have divested nine businesses, and also decreased our ownership interest in our European joint venture.

Such transactions pose risks and challenges that could negatively impact our business and financial statements.

For example, when we decide to sell or otherwise dispose of a business or assets, we may be unable to do so on satisfactory terms within our anticipated timeframe or at all, and even after reaching a definitive agreement to sell or dispose a business the sale is typically subject to satisfaction of pre-closing conditions which may not become satisfied.

When we decide to sell or otherwise dispose of a business or assets, we may be unable to do so on satisfactory terms within our anticipated timeframe or at all, and even after reaching a definitive agreement to sell or dispose a business the sale is typically subject to satisfaction of pre-closing conditions which may not become satisfied.

For example, during the second quarter of fiscal year 2024, we recognized a goodwill impairment charge of $99.7 million for the Branded Agencies reporting unit goodwill due to the pending sale of one of the businesses that comprised a substantial portion of the assets, liabilities and prospective cash flows of the Branded Agencies reporting unit.

18 unchanged sentences

Some of our contracts expressly restrict our ability to represent competitors of the counterparty.

These perceived competitive conflicts may also become more challenging to avoid or manage as a result of continued consolidation in the consumer goods and retail industries and our own acquisitions.

These perceived competitive conflicts may also become more challenging to avoid or manage as a result of continued consolidation in the CPG and retail industries and our own acquisitions.

If we are unable to avoid or manage business conflicts among competing manufacturers and retailers, we may be unable to acquire new clients or be forced to terminate existing client relationships, and in either case, our business and results of operations may be adversely affected.

Limitations, restrictions and business decisions involving our joint ventures and minority investments may adversely affect our growth and results of operations.

Business decisions involving our joint ventures and minority investments may adversely affect our growth and results of operations.

We have made substantial investments in joint ventures and minority investments and may use these and other similar methods to expand our service offerings and geographical coverage in the future.

These arrangements typically involve other business services companies as partners that may be competitors of ours in certain markets.

Joint venture agreements may place limitations or restrictions on our services.

For example, as part of our joint venture with, and investments in Smollan, we were restricted under

certain circumstances from making direct acquisitions and otherwise expanding many of our service offerings into markets outside of North America.

The limitations and restrictions tied to our joint venture and minority investments limit our potential business opportunities and reduce the economic opportunity for certain prospective international investments and operations.

Additionally, we may rely upon our equity partners or local management for operational and compliance matters associated with our joint ventures or minority investments.

25 unchanged sentences

Many of these potential circumstances are outside of our control and any of them could result in increased costs, decreased revenue, decreased synergies or the diversion of management time and attention.

We may choose to pay cash, incur debt or issue equity securities to pay for any such acquisition.

We may choose to pay cash, incur debt or issue equity securities to pay for any acquisition.

The incurrence of indebtedness would result in increased fixed obligations and could also include covenants or other restrictions that would impede our ability to manage our operations.

15 unchanged sentences

If we are not able to successfully integrate an acquisition, if we incur significantly greater costs to achieve the expected synergies than we anticipate or if activities related to the expected synergies have unintended consequences, our business, financial condition or results of operations could be adversely affected.

Complications with the implementation of our new enterprise resource planning system could adversely impact our business and operations.

We rely extensively on information systems and technology to manage our business and summarize operating results.

We are in the process of implementing a new enterprise resource planning (“ERP”) system to replace our existing operating and financial systems.

The ERP system implementation process has required, and will continue to require, the investment of significant personnel and financial resources.

We may not be able to successfully implement the ERP system without experiencing delays, increased costs and other difficulties.

If we are unable to successfully implement the new ERP system as planned, our financial positions, results of operations and cash flows could be negatively impacted.

Additionally, if we do not effectively implement the ERP system as planned or the ERP system does not operate as intended, the effectiveness of our internal control over financial reporting could be adversely affected or our ability to assess those controls adequately could be further delayed.

We may be subject to unionization, work stoppages, slowdowns or increased labor costs.

3 unchanged sentences

Moreover, if a significant number of our teammates participate in labor unions, it could put us at increased risk of labor strikes and disruption of our operations or adversely affect our growth and results of operations.

In December 2019, a union which commonly represents employees in the supermarket industry filed a petition with the National Labor Relations Board to represent approximately 120 of our teammates who worked in and around Boston.

An election was held, and based on certified results of the election we prevailed in this election.

Notwithstanding this successful election, we could

face future union organization efforts or elections, which could lead to additional costs, distract management or otherwise harm our business.

We have faced, and in the future could face future union organization efforts or elections, which could lead to additional costs, distract management or otherwise harm our business.

If goodwill or other intangible assets in connection with our acquisitions become impaired, we could take significant charges against earnings.

2 unchanged sentences

(“Topco”), we have goodwill and intangible assets recorded on our balance sheet of $0.4 billion and $1.0 billion, respectively, as of December 31, 2025, as further described in Note 3 — Goodwill and Intangible Assets to our consolidated financial statements for the year ended December 31, 2025.

Under accounting guidelines, we must assess, at least annually, whether the value of goodwill and other indefinite-lived intangible assets has been impaired.

For example, during the year ended December 31, 2024, we recognized goodwill impairment charges of $233.2 million due to the pending sale of one of the businesses that comprised a substantial portion of the Branded Agencies reporting unit and a loss of clients and a reduction in the scope of client services as our clients in the Branded Services reporting unit implemented internal cost reduction initiatives.

Refer to Note 3 — Goodwill and Intangible Assets to our consolidated financial statements for the year ended December 31, 2024.

Under applicable accounting guidance, we are required to assess, at least annually or more frequently if indicators of impairment exist, whether the carrying value of our goodwill and other indefinite‑lived intangible assets is impaired.

During the year ended December 31, 2025, we recognized goodwill impairment charges of $36.6 million related to our Branded Services and Merchandising

reporting units.

These impairments primarily resulted from increases in market‑based discount rate inputs, including higher risk‑free rates and equity risk premiums, updated valuation multiples for comparable publicly traded companies, and revised prospective financial information reflecting current expectations for revenue growth, margin performance and operating cost trends.

Moreover, during the year ended December 31, 2024, we recognized goodwill impairment charges of $233.2 million due to the pending sale of one of the businesses that comprised a substantial portion of the Branded Agencies reporting unit and a loss of clients and a reduction in the scope of client services as our clients in the Branded Services reporting unit implemented internal cost reduction initiatives.

During the fourth quarter of December 31, 2024, we recognized an intangible asset impairment charge of $42.0 million as a result of the triggering event for the Branded Services reporting unit.

Moreover, during the year ended December 31, 2023, we recognized an intangible asset impairment charge of $43.5 million related to our indefinite-lived trade name, in connection with our deconsolidation of the European joint venture and planned disposition of the foodservice businesses.

During the year ended December 31, 2022, and in connection with our annual impairment assessment of goodwill and indefinite-lived intangible assets, we also recognized goodwill and intangible asset impairment charges of $1,367.5 million and $205.0 million, respectively, in our reporting units and indefinite-lived trade names.

While there was no single determinative event or factor, the consideration of the weight of evidence of several factors included:

(a) sustained decline in our share price;

(b) challenges in the labor market and continued inflationary pressures;

and (c) an increase to the discount rate as a result of the recent increases in the interest rates which adversely affected the results of the quantitative impairment tests.

We can make no assurances that we will not record any additional impairment charges in the future.

Any future reduction or impairment of the value of goodwill or other intangible assets will similarly result in charges against earnings, which could adversely affect our reported financial results in future periods.

Failures in, data breaches of, or incidents involving, our technology infrastructure could damage our business, reputation and brand and substantially harm our business and results of operations.

Our business is highly dependent on our ability to manage operations and process a large number of transactions on a daily basis.

We rely heavily on our operating, payroll, financial, accounting and other data processing systems which require substantial support and maintenance, and may be subject to disabilities, errors or other harms.

If our data and network infrastructure were to fail, or if we were to suffer a data security breach, or an interruption or degradation of services in our data center, third-party cloud, and other infrastructure environments, we could lose important data, which could harm our business and reputation, and cause us to incur significant liabilities.

Our facilities, as well as the facilities of third-parties that provide services, maintain, or otherwise have access to our data or network infrastructure, are vulnerable to damage or interruption from earthquakes, hurricanes, floods, fires, cybersecurity attacks, terrorist attacks, power losses, telecommunications failures and similar events.

In the event that our or any third-party provider’s systems or service abilities are hindered by any of the events discussed above, our ability to operate may be impaired.

Our information technology systems, and the information technology systems of our current or future third-party vendors, collaborators, consultants and service providers, could be penetrated by internal or external parties intent on extracting information, corrupting information, stealing intellectual property or trade secrets, or disrupting business processes.

A third party’s decision to close facilities or terminate services without adequate notice, or other unanticipated problems, could adversely impact our operations.

Any of the aforementioned risks may be augmented if our or any third-party provider’s business continuity and disaster recovery plans prove to be inadequate in preventing the loss of data, service interruptions, disruptions to our operations or damages to important systems or facilities.

Our data center, third-party cloud, and managed service provider infrastructure also could be subject to break-ins, cyber-attacks (including through the use of malware, software bugs, computer viruses, ransomware, social engineering, and denial of service), sabotage, intentional acts of vandalism and other misconduct, from a spectrum of actors ranging in sophistication from threats common to most industries to more advanced and persistent, highly organized adversaries.

Any security breach or incident, including personal data breaches, that we experience could result in unauthorized access to, or misuse, modification, destruction or unauthorized acquisition of, our internal sensitive corporate data, such as personal data, financial data, trade secrets, intellectual

property or other competitively sensitive or confidential data.

Such unauthorized access, misuse, acquisition or modification of sensitive data may result in data loss, corruption or alteration, interruptions in our operations or damage to our computer hardware or systems or those of our employees or customers.

Our systems have been the target of cyber-attacks.

Although we have taken and continue to take steps to enhance our cybersecurity posture, we cannot assure that future cyber incidents will not occur or that our systems will not be targeted or breached in the future.

Any such breach or unauthorized access could result in a disruption of the Company’s operations, the theft, unauthorized use or publication of the Company’s intellectual property, other proprietary information or the personal information of customers, employees, licensees or suppliers, a reduction of the revenues the Company is able to generate from its operations, damage to the Company’s brand and reputation, a loss of confidence in the security of the Company’s business and products, and significant legal and financial exposure.

If any such incident results in litigation, we may be required to make significant expenditures in the course of such litigation and may be required to pay significant amounts in damages.

We may not carry sufficient business interruption insurance to compensate us for losses that may occur as a result of any events that cause interruptions in our service.

There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information.

Significant unavailability of our services due to attacks could cause us to incur significant liability, could cause users to cease using our services and materially and adversely affect our business, prospects, financial condition and results of operations.

We use complex software in our technology infrastructure, which we seek to continually update and improve.

Replacing such software and infrastructure is often time-consuming and expensive and can also be intrusive to daily business operations.

Further, we may not always be successful in executing these upgrades and improvements, which may result in a failure of our systems.

We may experience periodic system interruptions from time to time.

Any slowdown or failure of our underlying technology infrastructure could harm our business and reputation, which could materially adversely affect our results of operations.

Our disaster recovery plan or those of our third-party providers may be inadequate, and our business interruption insurance may not be sufficient to compensate us for the losses that could occur.

Failure to comply with federal, state, and foreign laws and regulations relating to privacy, data protection, and consumer protection, or the expansion of current or the enactment of new laws or regulations relating to privacy, data protection and consumer protection, could adversely affect our business and our financial condition.

Security incidents involving our technology or infrastructure could damage our reputation and substantially harm our business and results of operations.

Our business is highly dependent on our ability to manage operations and process many transactions daily.

We rely heavily on information technology systems, hardware, software, technology infrastructure, and online sites and networks (collectively, “IT Systems”).

We own and manage some of these IT Systems but also rely on third parties for a range of IT Systems and related products and services, including but not limited to cloud computing services.

These IT Systems face continuous threats, ranging from weather, public safety, and other shared infrastructure outages to bad actors, both internally and externally.

The latter—threat actors intent on extracting or corrupting information, stealing intellectual property, or trade secrets, or disrupting business processes—create the greatest risk to our operations and reputation, and thus to our financial viability.

We face numerous and evolving cybersecurity risks that threaten the confidentiality, integrity and availability of our IT Systems and Confidential Information (as defined below).

Cyber-attacks (including by deployment of malware, software bugs, computer viruses, ransomware, social engineering, malicious code embedded in open-source software, or misconfigurations, or other vulnerabilities in commercial software that is integrated into our (or our suppliers’ or service providers’) IT Systems and denial of service) are commonplace in any industry.

Even for the most prepared organizations, sabotage, intentional acts of vandalism and other misconduct may occur, as threat actors continue to evolve.

Our IT Systems, and third-party IT Systems housing our data, have been the target of cyber-attacks including from diverse threat actors, such as state-sponsored organizations, opportunistic hackers, and hacktivists, as well as through diverse attack vectors, such as social engineering/phishing, malware (including ransomware), malfeasance by insiders, human, or technological error, and as a result of bugs, misconfigurations or exploited vulnerabilities in software or hardware.

We expect such attacks and incidents to continue in varying degrees and cannot assure that future cyber incidents will not occur or that our IT Systems or data will not be targeted or breached in the future.

Any security breach or incident that we experience could result in unauthorized access to, or misuse, modification, destruction, or unauthorized acquisition of, our valuable company information, such as personal data, financial data, trade secrets, intellectual property or other competitively sensitive or confidential data.

Any such breach or unauthorized access could result in a reduction of our financial performance or condition, damage to our brand and reputation, a loss of confidence in the security of our business and products, and significant legal and financial exposure.

Further, if any such incident results in legal claims or proceedings (such as class actions), regulatory investigations and enforcement actions, fines, and penalties, negative reputational impacts that cause us to lose existing or future customers, and/or significant incident response, system restoration, or remediation and future compliance costs we may be required to make significant expenditures during the pendency of such litigation and may be required to pay significant amounts in damages, related costs, and/or to procure settlement.

Any or all of the foregoing could materially adversely affect our business, operating results, and financial condition.

While we carry cyber-security insurance and have developed a Cybersecurity Risk Management Strategy (see Item 1C., below), there can be no assurance that either will be effective in protecting our IT Systems and Confidential Information or the associated liabilities of a security incident.

Extended unavailability of our operational functions due to attacks could cause us to incur significant financial liability;

users may cease using our services which would materially and adversely affect our current business, prospects, reputation, and overall financial condition.

We may not carry sufficient business interruption insurance to compensate us for losses that may occur because of any events that cause interruptions in our service.

In addition to service disruption, security incidents may also result in data theft and/or extortion, demanding extensive investigation and potential high costs and reputational risks.

Cyberattacks are expected to accelerate on a global basis in frequency and magnitude as threat actors are becoming increasingly sophisticated in using techniques and tools – including AI – that circumvent security controls, evade detection and remove forensic

As a result, we may be unable to detect, investigate, remediate or recover from future attacks or incidents, or to avoid a material adverse impact to our IT Systems, Confidential Information or business.

Further, our technology infrastructure is complex and requires substantial support and maintenance, which we seek to continually update and improve.

However, replacing such software and infrastructure is often time-consuming and expensive and can also be intrusive to daily business operations.

Further, we may not always be successful in executing these upgrades and improvements, which may result in a failure of our IT Systems.

We may also experience periodic system interruptions from time to time.

If our, or any third-party provider’s, IT Systems or service abilities are hindered by any of the events discussed above, our ability to operate may be impaired which could harm our business and reputation and cause us to incur significant liabilities.

These risks are amplified if our or any third-party provider’s business continuity and disaster recovery plans prove to be inadequate in preventing the loss of data, service interruptions, disruptions to our operations or damage to important IT Systems or facilities.

Failure to comply with federal, state, and foreign laws and regulations relating to privacy and data protection could adversely affect our business and our financial condition.

A variety of federal, state, and foreign laws and regulations govern the collection, use, retention, sharing, and security of personal information.

The information, security, and privacy requirements imposed by such governmental laws and regulations relating to privacy, data protection, and consumer protection are increasingly demanding, quickly evolving, and may be subject to differing interpretations.

These requirements may not be harmonized, may be interpreted and applied in a manner that is inconsistent from one jurisdiction to another, or may conflict with other rules or our practices.

The requirements imposed by such laws and regulations relating to privacy and data protection are increasingly demanding, quickly evolving, and may be subject to differing interpretations.

Further, given their patchwork status, these requirements often cannot be harmonized and may be applied in a manner that is inconsistent from one jurisdiction to another.

As a result, our practices may not have complied or may not comply in the future with all such laws, regulations, requirements, and obligations.

Our actual or perceived failure to comply with such laws and regulations could result in fines, investigations, enforcement actions, penalties, sanctions, claims for damages by affected individuals, and damage to our reputation, among other negative consequences, any of which could have a material adverse effect on its financial performance.

We are subject to the California Consumer Protection Act of 2018, which became effective in 2020, as well as its amendment, the California Privacy Rights Act of 2020 (the “CPRA”) and accompanying regulations, the California Consumer Privacy Act Regulations (collectively, the “CCPA”).

The CCPA regulates the collection, use, and processing of personal information relating to California residents, which includes our teammates.

We and certain of our third-party providers collect, maintain and process data about consumer, employees, business partners and others, including personally identifiable information, as well as proprietary information belonging to our business such as trade secrets (collectively, "Confidential Information").

Our business model does not require a significant amount of consumer personal information to sustain operations or create additional business opportunities.

The largest area of privacy exposure relates to the collection and use of personal information of our employees.

As such, we are subject to the California Consumer Protection Act of 2018, as well as its amendment, the California Privacy Rights Act of 2020 (the “CPRA”) and accompanying regulations, the California Consumer Privacy Act Regulations (collectively, the “CCPA”).

The CCPA regulates the collection, use, and processing of personal information relating to California residents, which includes our employees.

It grants certain privacy rights to California residents, including the right to access, correct, and delete personal information relating to such individuals under certain circumstances.

Compliance with the new obligations imposed by the CCPA depends in part on how its requirements are interpreted and applied by the California attorney general, courts, and the new California Privacy Protection Agency.

Alleged violations of the CCPA may result in substantial civil penalties or statutory damages when applied at scale, of approximately $3,000 per violation or approximately $8,000 per intentional violation of any CCPA requirement, which may be applied on a per-person or per-record basis.

The CCPA also establishes a private right of action if certain personal information of individuals is subject to an unauthorized access and exfiltration, theft, or disclosure as a result of a business’s violation of the duty to implement and maintain reasonable security procedures and practices, which authorizes statutory damages of approximately $100 to $800 per person per incident even if there is no actual harm or damage to plaintiffs.

This private right of action may increase the likelihood of, and risks associated with, data breach litigation.

Further, the CPRA includes additional and strengthened privacy rights for California residents, new requirements regarding sensitive data and data sharing for digital advertising, and tripled damages for violations involving children’s data.

The selling and sharing of personal information by businesses for digital advertising and marketing purposes remains a priority of regulators, including the Federal Trade Commission and California Attorney General.

In August 2022, the California Attorney General announced its first enforcement action under the CCPA against a retailer that to pay penalties and comply with injunctive terms, including overhauling its online disclosures and opt-out rights and providing regular reports to the California Attorney General

regarding its data sharing practices.

Additionally, demand letters related to the deployment of cookies and related technologies on organizations’ websites has garnered the attention of regulators and plaintiffs’ attorneys, and likely will continue to do so.

By the end of 2025, laws similar to CCPA are expected to be in effect in at least 18 states, and this number may increase.

Like the CCPA, these laws regulate the collection, use and processing of personal information relating to residents of the respective states, and grants certain privacy rights to those residents, some of which may include individuals as with the CCPA.

We are also subject to international privacy laws and regulations, many of which, such as the General Data Privacy Regulation (“GDPR”) and national laws implementing or supplementing the GDPR, such as the United Kingdom Data Protection Law 2018 (which retains key features of GDPR post-Brexit), are significantly more stringent than those currently enforced in the United States.

The GDPR requires companies to meet requirements regarding the handling of personal data of individuals located in the European Economic Area (the “EEA”).

The GDPR imposes mandatory data breach notification requirements subject to a 72-hour notification deadline.

The GDPR also includes significant penalties for noncompliance, which may result in monetary penalties of up to the higher of €20.0 million or 4% of a group’s worldwide turnover for the preceding financial year for the most serious violations.

The GDPR and other similar legal constructs require companies to give specific types of notice, and informed consent is required for the placement of a cookie or similar technologies on a user’s device for online tracking for behavioral advertising and other forms of direct electronic marketing.

The GDPR also imposes additional conditions in order to satisfy such consent, such as a prohibition on pre-checked tick boxes and bundled consents.

Enforcement of the GDPR and related regulations varies by each EU Member State and is ongoing.

Further laws and regulations on these topics are forthcoming, including the Regulation on Privacy and Electronic Communications (“ePrivacy Regulation”), Digital Services Act, and Digital Markets Act.

The GDPR may increase our responsibility and liability in relation to personal data that we process where that processing is subject to the GDPR.

In addition, we may be required to put in place additional mechanisms to ensure compliance with the GDPR, including GDPR requirements as implemented by individual countries.

Compliance with the GDPR will be a rigorous and time-intensive process that may increase our cost of doing business or require us to change our business practices in certain jurisdictions.

In addition, under GDPR, transfers of personal data are prohibited to countries outside of the EEA that have not been determined by the European Commission to provide adequate protections for personal data, including the United States.

There are mechanisms to permit the transfer of personal data from the EEA to the United States, but there is also uncertainty as to the future of such mechanisms, which have been under consistent scrutiny and challenge.

In July 2020, a decision of the Court of Justice of the European Union invalidated the EU-U.S.

Privacy Shield Framework, a means that previously permitted transfers of personal data from the EEA to companies in the United States that certified adherence to the Privacy Shield Framework.

In July 2023, the European Union and the United States agreed to replace the Privacy Shield Framework by implementing the E.U.-U.S.

Data Privacy Framework.

Standard contractual clauses approved by the European Commission to permit transfers from the EU to third countries currently remain as a basis on which to transfer personal data from the EEA to other countries.

However, the standard contractual clauses are also subject to legal challenge, and in November 2020, the European Commission published a draft of updated standard contractual clauses.

In January 2022, for example, Austria’s data protection authority determined that the use of Google Analytics violated the GDPR and the Court of Justice of the European Union’s “Schrems II” decision on international data transfers.

We presently rely on standard contractual clauses to transfer personal data from EEA member countries, and we may be impacted by changes in law as a result of future review or invalidation of, or changes to, this mechanism by European courts or regulators.

While we will continue to undertake efforts to conform to current regulatory obligations and evolving best practices, we may be unsuccessful in conforming to permitted means of transferring personal data from the European Economic Area.

We may also experience hesitancy, reluctance, or refusal by European or multi-national customers to continue to use some of our services due to the potential risk exposure of personal data transfers and the current data protection obligations imposed on them by certain data protection authorities.

Such customers may also view any alternative approaches to the transfer of any personal data as being too costly, too burdensome, or otherwise objectionable, and therefore may decide not to do business with us if the transfer of personal data is a necessary requirement.

Data protection requirements in China continued to change in 2024, with the issuance of the highly anticipated final Regulations on Promoting and Regulating Cross-Border Data Flows on March 22, 2024, effective immediately.

These regulations aim to ease compliance burdens and facilitate cross-border data flows, by introducing substantial changes to the current rules over filings and security assessments of cross-border data transfers, including exemptions from and higher thresholds for filing standard contracts for outbound cross-border data transfers, applying for personal information protection certifications and conducting the mandatory data security assessment.

Additionally, in January 2025, the Cyberspace Administration of China (CAC) issued a draft document titled Measures for the Certification of Personal Information Protection for Cross-Border Data Transfers for public consultation.

The draft measures, comprising 20 detailed articles, outline a comprehensive framework for certifying the security and compliance of personal data transfers.

As such, it is prudent to expect additional changes to China’s legal and regulatory landscape in 2025.

Although we make reasonable efforts to comply with all applicable laws and regulations and have invested and continue to invest human and technology resources into data privacy compliance efforts, there can be no assurance that we will not be subject to

regulatory action, including fines, in the event of an incident or other claim.

Data protection laws and requirements may also be enacted, interpreted or applied in a manner that creates inconsistent or contradictory requirements on companies that operate across jurisdictions.

We, or our third-party service providers, could be adversely affected if legislation or regulations are expanded to require changes in our or our third-party service providers’ business practices or if governing jurisdictions interpret or implement their legislation or regulations in ways that negatively affect our or our third-party service providers’ business, results of operations, or financial condition.

For example, we may find it necessary to establish alternative systems to maintain personal data in the EEA, which may involve substantial expense and may cause us to divert resources from other aspects of our business, all of which may adversely affect our results from operations.

Compliance with obligations imposed by the CCPA depends in part on how its requirements are interpreted and applied by the California attorney general, courts, and the California Privacy Protection Agency.

In 2026, violations of the CCPA may result in substantial civil penalties or statutory damages of approximately $2,700 per violation or approximately $8,000 per intentional violation of any CCPA requirement, which may be applied on a per-person or per-record basis.

The CCPA also establishes a private right of action if certain personal information of individuals is breached as a result of a business’s violation of the duty to implement and maintain reasonable security procedures and practices.

This violation authorizes statutory damages of approximately $100 to $800 per person per incident even if there is no actual harm or damage to plaintiffs.

This private right of action may increase the likelihood of, and risks associated with, general data breach litigation.

By the end of 2026, laws similar to CCPA are expected to be in effect in 18 states, and this number may increase as 14 additional states have active legislation under consideration.

Like the CCPA, these laws regulate the collection, use and processing of personal information relating to residents of the respective states, and grants certain privacy rights to those residents.

Similarly, the U.S.

Federal Trade Commission continues to actively investigate and enforce privacy violations by its authority under the FTC Act Section 5, with recent enforcement actions focusing on various types of personal data that the FTC considers to be sensitive.

As with the state privacy laws discussed above, however, this authority generally does not extend to employment-related uses of personal information.

We may also, but on a much more limited extent, be subject to international privacy laws and regulations, such as the General Data Privacy Regulation in the European Union, Canada’s Personal Information Protection and Electronic Documents Act, and other related privacy laws in the countries where we have employees or obtain third party services.

While these laws are generally more

stringent than those currently enforced in the United States, we have very limited operations in international jurisdictions, and none of those operations are customer-facing, thus further reducing our risk.

However, we continue to comply with all applicable laws in these international locations, with specific assurance that we are meeting all requirements concerning the protection and use of employee personal information.

Although we make reasonable efforts to comply with all applicable laws and regulations and have invested and continue to invest human and technological resources into data privacy compliance efforts, there can be no assurance that we will not be subject to regulatory action, including fines, in the event of an incident or other claim.

We, or our third-party service providers, could be adversely affected if legislation or regulations are expanded or interpreted to require changes to business practices.

Further, any inability to adequately address privacy concerns in connection with our solutions, or comply with applicable privacy or data protection laws, regulations, and policies, could result in additional cost and liability to us, and adversely affect our ability to offer our solutions.

GDPR, CCPA, and other similar laws and regulations, as well as any associated inquiries or investigations or any other government actions, may be costly to comply with, result in negative publicity, increase our operating costs, require significant management time and attention, and subject us to remedies that may harm our business, including fines, or demands or orders that we modify or cease existing business practices.

Our systems may not be able to satisfy these changing requirements and manufacturer, retailer, and teammate expectations, or may require significant additional investment or time in order to do so.

We expect that new industry standards, laws and regulations will continue to be proposed regarding privacy, data protection, and information security in many jurisdictions, including the European e-Privacy Regulation, which is currently in draft form, as well as at the U.S.

federal and state levels.

In addition, new data processes and datasets associated with emerging technologies are coming under increased regulatory scrutiny, such as biometrics, artificial intelligence, and automated decision-making.

We cannot yet determine the impact such future laws, regulations and standards may have on our business.

Complying with these evolving obligations is challenging, time consuming, and expensive, and federal regulators, state attorneys general, and plaintiff’s attorneys have been, and will likely continue to be, active in this space.

Expanding definitions and interpretations of what constitutes “personal data” (or the equivalent) within the United States, the EEA, and elsewhere may increase our compliance costs and legal liability.

For example, the Personal Information Protection Commission (PIPC – the Republic of Korea) and the California Privacy Protection Agency (“CPPA”) signed a declaration of cooperation on January 10, 2025, emphasizing their shared commitment to safeguarding the privacy and personal information of their citizens and consumers, while recognizing the need for enhanced cross-border collaboration.

This is similar to a declaration between the CPPA and the Commission Nationale de l'Informatique et des Libertés (CNIL-France), signed in June 2024, and signals to us a more robust global privacy schema may be emerging.

Civil litigation, including class actions, remains another source of potential liability under privacy laws.

For example, cases filed under Illinois’ Biometric Information Privacy Act have resulted in large settlement amounts and damages awards against other companies due to the presence of statutory damages under that law.

As another example, website owners and operators saw a wave of putative class actions filed against them in 2022 under the California Invasion of Privacy Act and similar federal and state surveillance and wiretapping laws, with claims centering on websites’ deployment of session monitoring, keylogging, chatbots, and other tracking and monitoring technologies.

The inconsistency among court rulings regarding these legal claims renders the likelihood and dollar amount of potential liability and/or settlement value difficult to accurately quantify.

A data breach or any failure, or perceived failure, by us to comply with any federal, state, or foreign privacy or consumer protection-related laws, regulations, or other principles or orders to which we may be subject, or other legal obligations relating to privacy or consumer protection could adversely affect our reputation, brand, and business, and may result in fines, enforcement actions, sanctions, claims (including claims for damages by affected individuals), investigations, proceedings, or actions against us by governmental entities or others, or other penalties or liabilities or require us to change our operations and/or cease using certain data sets, among other negative consequences, any of which could have a material adverse effect on our business.

Moreover, the proliferation of supply chain-based cyber-attacks and vendor security incidents increases these potential risks and costs even in cases where the attack did not target us, occur on our systems, or result from any action or inaction by us.

Privacy laws and regulations, as well as any associated inquiries or investigations or any other government actions, may be costly to comply with, result in negative publicity, increase our operating costs, require significant management time and attention, and subject us to remedies that may harm our business, including fines, or demands or orders that we modify or cease existing business practices, including data deletion and algorithmic disgorgement.

We expect that new industry standards, laws, and regulations will continue to be proposed regarding privacy, data protection, and information security in many jurisdictions.

Specifically, data processing associated with emerging technologies, and data sets utilizing sensitive personal information, are coming under increased regulatory scrutiny, such as those related to biometrics, AI, and automated decision-making.

These evolutionary areas of privacy concern may create additional requirements for compliance, including privacy impact assessments, which aim to have companies document the risks associated with the processing of high-risk data are now essential but create additional work.

We also suspect that compliance with AI-related legal obligations will be our greatest challenge, as we continue to stretch our business and operating models to utilize AI to increase efficiency and reduce workload strain.

Such obligations may include modified and expanded governance programs, outcome-based testing, pre-use notices, end user rights such as access and opt-out rights, human monitoring, and intervention controls, and regulatory reporting.

Ongoing monitoring of these laws and compliance with their evolving requirements will be challenging, time consuming, and expensive, and federal regulators, state attorneys general, and plaintiff’s attorneys have been, and will likely continue to be, active in this space.

Additionally, nuanced legal arguments related to consumer protection online, continue to require awareness.

Specifically, the selling and sharing of personal information by businesses for digital advertising and marketing purposes remains a priority of regulators, including the FTC and California Attorney General.

Further, recent years have seen a dramatic proliferation of plaintiff’s attorney-driven class action litigation, individual litigation, arbitrations, and demand letters related to Internet-based technologies such as website cookies and pixels, tracking technologies, chatbots, and AI tools, and there is little sign that this trend will abate in the near-term.

To the contrary, we expect both regulators and plaintiff’s attorneys to continue to seek to apply these legal theories to an ever-expanding list of technologies and data processing activities.

Collectively, this stresses the importance of proper cataloging of websites and a governance structure for the deployment of third party technologies, including cookies, pixels, and other tracking technologies, by business teams and third parties.

Relatedly, website owners and operators have seen a wave of putative class actions, individual civil actions, single and mass arbitration demands, and demand letters filed against them in recent years, under the California Invasion of Privacy Act and similar federal and state surveillance and wiretapping laws, with claims centering on companies’ deployment of web- and app-based tracking technologies (including cookies, pixels, scripts, and software development kits), session monitoring, key logging, chatbots, and other tracking and monitoring technologies.

These legal claims, based on the reemergence of old laws retrofitted for a modern society, create novel issues of law and fact that may require extended litigation to resolve, as inconsistency among court rulings, rendering the likelihood and dollar amount of potential liability and/or settlement value difficult to accurately quantify.

In sum, a data breach or any failure to comply with any applicable privacy or consumer protection-related laws, regulations, or other principles could adversely affect our reputation, brand, and business, and may result in fines, enforcement actions, sanctions, claims (including claims for damages by affected individuals), investigations, proceedings, or actions against us by governmental entities or others.

This could have a material adverse effect on our business as we spend time tending to these issues and/or are forced to change our operations.

Moreover, the proliferation of vendor security incidents increases these potential risks and costs even in cases where the attack did not target us, occur on our IT Systems, or result from any action or inaction by us.

Depending on the nature of the information compromised, we may also have obligations to notify users, law enforcement, regulators, business partners or payment companies about the incident and provide some form of remedy, such as refunds or identity theft monitoring services, for the individuals affected by the incident.

Uncertainties with respect to the use of AI in our business may result in harm to our business and reputation.

We use AI, machine learning, and automated decision-making technologies (collectively, “AI Technologies”) throughout our business, and are making investments in this area.

For example, we use AI Technologies to assist us with operational scheduling, development of training materials, and certain administrative services that we offer to specific clients.

We expect that increased investment will be required in the future to continuously improve our use of AI Technologies.

As with many technological innovations, there are significant risks involved in developing, maintaining and deploying these technologies and there can be no assurance that our investments in such technologies will always enhance our products or services or be beneficial to our business, including our efficiency or profitability.

In particular, if the models underlying our AI Technologies are:

incorrectly designed or implemented;

trained or reliant on incomplete, inadequate, inaccurate, biased or otherwise poor quality data, or on data to which we do not have sufficient rights or in relation to which we and/or the providers of such data have not implemented sufficient legal compliance measures;

used without sufficient oversight and governance to ensure their responsible use;

and/or adversely impacted by unforeseen defects, technical challenges, cybersecurity threats, data privacy concerns, or material performance issues, the performance of our products, services and business, as well as our reputation and the reputations of our customers, could suffer or we could incur liability resulting from the violation of laws or contracts to which we are a party or from civil claims.

We use AI Technologies licensed from third parties in our technologies and our ability to continue to use such technologies at the scale we need may be dependent on access to specific third-party software and infrastructure.

We cannot control the availability or pricing of such third-party AI Technologies, especially in a highly competitive environment, and we may be unable to negotiate favorable economic terms with the applicable providers.

If any such third-party AI Technologies become incompatible with our solutions or unavailable for use, or if the providers of such models unfavorably change the terms on which their AI Technologies are offered or terminate their relationship with us, our solutions may become less appealing to our customers and our business will be harmed.

In addition, to the extent any third-party AI Technologies are used as a hosted service, any disruption, outage, or loss of information through such hosted services could disrupt our operations or solutions, damage our reputation, cause a loss of confidence in our solutions, or result in legal claims or proceedings, for which we may be unable to recover damages from the affected provider.

In particular, we are working to incorporate generative AI Technologies (i.e., AI Technologies that can produce and output new content, software code, data and information) into our solutions and internal business practices.

There is a risk that generative AI Technologies could produce inaccurate or misleading content or other discriminatory or unexpected results or behaviors, such as hallucinatory behavior that can generate irrelevant, nonsensical, or factually incorrect results, all of which could harm our reputation, business, or customer relationships.

While we take measures designed to ensure the accuracy of such AI generated content, those measures may not always be successful, and in some cases, we may need to rely on end users to report such inaccuracies.

Our generative AI Technologies could generate output that is infringing, and we could be subject to claims or lawsuits, including for infringement of third-party intellectual property rights as a result of the output of such generative AI Technologies.

While some providers of AI Technologies offer to indemnify their end users for any copyright or other intellectual property infringement claims arising from the output of their AI Technologies, we may not be successful in adequately recovering our losses in connection with such claims.

In addition, we may experience difficulties in enforcing the intellectual property rights in output generated by generative AI Technologies.

The United States Copyright Office has previously denied copyright protection for content generated by AI Technologies, and the United States Patent and Trademark Office has similarly stated that an AI tool cannot be an “inventor” of a patent, rendering it impossible to obtain patent protection for inventions created solely by AI Technologies.

The Supreme Court of the United Kingdom has reached a similar conclusion, stating that AI systems cannot be named as an “inventor” for UK patent law purposes.

Further, if we are deemed to not have sufficient rights to the data we use to train our generative AI Technologies, we may be subject to litigation by the owners of the content or other materials that comprise such data, similar to the litigation that is currently pending in various U.S., UK, and EU national courts against other developers of generative AI Technologies, and in which the outcome of such litigation is uncertain.

We use certain third-party AI models that are made available under an open source or open weights license.

Such freely available open AI Technologies may not be actively maintained or supported by the provider and as such, may have heightened risk of introducing inaccuracies or vulnerabilities into our business operations or products or services.

Further, if the licensor for such open AI Technologies developed their models by training on data that was inaccurate, biased or for which it did not have the appropriate rights, we could be subject to claims or lawsuits arising from our use of such AI Technologies, including for infringement of

third-party intellectual property.

Sophisticated attackers may exploit vulnerabilities in open generative AI Technologies to obtain access to alter the outputs or results, or access our sensitive data.

In addition, our use of open AI Technologies may require us to license our data or intellectual property to third parties and limit our ability to protect our intellectual property rights or proprietary data, or subject us to new payment or non-compete obligations for any products or services we seek to commercialize that use such open AI Technologies.

Complications with the further implementation of our new enterprise resource planning system could adversely impact our business and operations.

We rely extensively on information systems and technology to manage our business and summarize operating results.

We are in the process of implementing our new enterprise resource planning (“ERP”) system for our operating and financial systems involving our Advisory Services business unit.

The ERP system implementation process has required, and will continue to require, the investment of significant personnel and financial resources.

We may not be able to successfully implement the ERP system in our Advisory Services business unit without experiencing delays, increased costs and other difficulties.

If we are unable to successfully implement these additional aspects of ERP system as planned, our financial positions, results of operations and cash flows could be negatively impacted.

Additionally, if we do not effectively implement the new ERP system for such business unit or the ERP system does not operate as intended, the effectiveness of our internal control over financial reporting could be adversely affected or our ability to assess those controls adequately could be further delayed.

Our business is seasonal in nature and quarterly operating results can fluctuate.

1 unchanged sentence

Adverse events, such as deteriorating economic conditions, higher unemployment, higher gas prices, public transportation disruptions, public health crises, including, without limitation, pandemic, natural and man-made disasters, or unanticipated adverse weather, could result in lower-than-planned sales during key revenue-producing seasons.

For example, frequent or unusually heavy snowfall, ice storms, rainstorms, windstorms or other extreme weather conditions over a prolonged period could make it difficult for consumers to travel to retail stores or foodservice locations.

Such events could lead to lower revenues, negatively impacting our financial condition and results of operations.

8 unchanged sentences

Our business is subject to risks associated with climate change.

The effects of climate change, and a resulting shift to a lower carbon economy, could present several climate-related risks for our business.

The effects of climate change, and a resulting shift to a lower carbon economy, could present climate-related risks for our business.

Physical risks from climate change could result in both chronic and acute perils including, but not limited to, extreme weather, changes in precipitation and temperature, and rising sea levels, all of which may result in a decrease in demand for our services from or our ability to provide services to our clients, many of whom are in the retail industry, located in the areas affected by these conditions.

1 unchanged sentence

Failure to meet environmental, social and governance (“ESG”) expectations or standards could adversely affect our business, results of operations, financial condition, or stock price.

In recent years, there has been an increased focus from stakeholders, regulators and the public in general on ESG matters, including greenhouse gas emissions and climate-related risks, renewable energy, water stewardship, waste management, diversity, equity and inclusion, responsible sourcing and supply chain, human rights, and social responsibility, including changes in laws and regulations related to compliance and disclosure obligations related thereto.

Certain stakeholders, regulators and the public in general have focused on ESG matters, including greenhouse gas emissions and climate-related risks, renewable energy, water stewardship, waste management, responsible sourcing and supply chain, human rights, and social responsibility, including changes in laws and regulations related to compliance and disclosure obligations related thereto.

We actively seek to address this focus and comply with the evolving laws and regulations related thereto.

11 unchanged sentences

The harm may be immediate without affording us an opportunity for redress or correction.

We rely on third parties to provide certain data and services in connection with the provision of our services.

We rely on third parties to provide certain data and services for use in connection with the provision of our services.

We have outsourced certain functions to third-party service providers, and any service failures or disruptions related to these outsourcing arrangements could adversely affect our business.

We have outsourced certain business processes in the areas of logistics, supply chain, certain financial service functions and information technology and security to third-party service providers.

We have also engaged third parties to host and manage certain aspects of our information and technology infrastructure to provide certain back-office support activities, and to support business process outsourcing for our clients.

Outsourcing these functions involves the risk that third-party service providers may not perform to our standards or legal requirements, may not produce reliable results, may not perform in a timely manner, may not maintain the confidentiality of our proprietary information, or may fail to perform at all.

Failure by these third parties to meet their contractual, legal and other obligations to us, or our failure to adequately monitor their performance, could result in our inability to achieve the expected cost savings or efficiencies and could result in additional costs to correct errors made by such service providers or could result in the imposition by governmental authorities of procedures or penalties.

Additionally, if any of our relationships with these third-party service providers were terminated, or if any of these parties were to cease doing business or supporting the applications and services we currently utilize, our business could be disrupted, and we may be forced to spend significant time and money to change vendors or insource these aspects of our business.

We also have diminished control over the quality and timeliness of the outsourced services, including the cybersecurity protections implemented by these third parties.

As a result of these outsourcing arrangements, we may experience interruptions or delays in our processes, loss or theft of sensitive data or other cybersecurity issues, compliance issues, challenges in maintaining and reporting financial and operational information, and increased costs to remediate any unanticipated issues that arise, any of which could materially and adversely affect our business, financial condition and results of operations.

Additionally, any disruptions such as recently announced tariffs, a government shutdown, war, natural disaster or global pandemic, could affect the ability of our third-party service providers to meet their contractual obligations to us.

Failure of these third parties to meet their contractual, regulatory, confidentiality or other obligations to us could result in material financial loss, higher costs, regulatory actions, and reputational harm.

We rely on third parties to provide certain data in connection with the provision of our services.

We rely on third parties to provide certain data for use in connection with the provision of our services.

For example, we contract with third parties to obtain the raw data on retail product sales and inventories.

These suppliers of data may impose restrictions on our use of such data, fail to adhere to our quality control standards, increase the price they charge us for this data or refuse altogether to license the data to us.

If we are unable to use such third-party data and services or if we are unable to contract with third parties, when necessary, our business, financial condition or our results of operations could be adversely affected.

In the event that such data and services are unavailable for our use or the cost of acquiring such data and services increases, our business could be adversely affected.

If we are unable to use such third-party data or if we are unable to contract with third parties, when necessary, our business, financial condition or our results of operations could be adversely affected.

In the event that such data are unavailable for our use or the cost of acquiring such data increases, our business could be adversely affected.

We may be unable to timely and effectively respond to changes in digital practices and policies, which could adversely affect our business, financial condition or results of operations.

Changes to practices and policies of operating systems, websites and other digital platforms, including, without limitation, Apple’s or Android’s transparency policies, may reduce the quantity and quality of the data and metrics that can be collected or used by us and our clients or reduce the value of our digital services.

These limitations may adversely affect both our and our clients’ ability to effectively target and measure the performance of our digital services.

These limitations may adversely affect both our and our clients’ ability

to effectively target and measure the performance of our digital services.

In addition, our clients and third-party vendors routinely evaluate their digital practices and policies, and if in the future they determine to modify such practices and policies for any reasons, including, without limitation, privacy, targeting, age or content concerns, this could decrease the desire for our digital services as compared to other alternatives.

If we are unable to timely or effectively respond to changes in digital practices and policies, or if our clients do not believe that our digital services will generate a competitive return on investment relative to alternatives, then our business, financial condition or results of operations could be adversely affected.

Future pandemics may have an adverse effect on our business, results of operations, financial condition and liquidity.

The COVID-19 pandemic, including the measures taken to mitigate its spread, had adverse effects on our business and operations.

A future pandemic or health epidemic, could adversely impact our business and results of operations in a number of ways.

For example, the COVID-19 pandemic and measures taken to mitigate the spread of COVID-19 had far-reaching direct and indirect impacts on many aspects of our operations, including termination of in-store demonstration services and certain other services, as well as on consumer behavior and purchasing patterns.

We may not be able to adequately protect our intellectual property, which, in turn, could harm the value of our brands and adversely affect our business.

48 unchanged sentences

As a result, we could be subject to claims or lawsuits (including potential class action lawsuits), and we could incur liabilities that are not insured or exceed our insurance coverage or for which the manufacturer of the product does not indemnify us.

Even if product claims against us are not successful or fully pursued, these claims could be costly and time consuming and may require our management to spend time defending the claims rather than operating our business.

Even if product claims against us are not successful or fully pursued,

these claims could be costly and time consuming and may require our management to spend time defending the claims rather than operating our business.

A product that has been actually or allegedly misbranded, adulterated or damaged or is actually or allegedly defective could result in product withdrawals or recalls, destruction of product inventory, negative publicity and substantial costs of compliance or remediation.

23 unchanged sentences

Outcomes from these audits could have an adverse effect on our operating results and financial condition.

We may face potential and actual harms and uncertainties arising from the matter related to our 2018 acquisition of the Take 5 Media Group (the “Take 5 Matter”), including litigation and governmental investigations.

We acquired the business of Take 5 Media Group (“Take 5”) in April 2018, and a result of an investigation into that business, we terminated all operations of Take 5, including the use of its associated trade names and the offering of its services to its clients and offered refunds to clients of collected revenues attributable to the period after our acquisition.

See “ Legal Proceedings—Proceedings Relating to Take 5 .”

As a result of these matters, we may be subject to a number of additional harms, risks and uncertainties, including substantial costs for legal fees in connection with or related to the potential lawsuits by clients or other interested parties who claim to have been harmed by the misconduct at Take 5, other costs and fees related to the Take 5 Matter (in excess of the amounts previously offered as refunds), potential governmental investigations arising from the Take 5 Matter.

In addition, if we do not prevail in any such litigation related to these matters, we could be subject to costs related to such litigation, including equitable relief, civil monetary damages, treble damages, or repayment, which may not be covered by insurance or may materially increase our insurance costs.

We have incurred and will continue to incur additional costs regardless of the outcome of any such litigation or governmental investigation.

In addition, there can be no assurance to what degree, if any, we will be able to recover any such costs or damages from the former owners of Take 5 or whether such former owners of Take 5 engaged in further unknown improper activities that may subject us to further costs or damages, including potential reputational harm.

Likewise, such events have caused and may cause further diversion of our management’s time and attention.

Any adverse outcome related to these matters cannot be predicted at this time, and may materially harm our business, reputation, financial condition and/or results of operations, or the trading price of our securities.

Risks Related to Ownership of Our Common Stock

We are controlled by Topco, the Advantage Sponsors, and the CP Sponsor, whose economic and other interests in our business may be different from yours.

Our authorized capital stock consists of 3,290,000,000 shares of common stock and 10,000,000 shares of preferred stock.

As of February 28, 2025, the equity holders of Topco (equity funds affiliated with or advised by CVC Capital Partners, Leonard Green & Partners, Juggernaut Capital Partners, Centerview Capital, L.P., and Bain Capital (collectively, the “Advantage Sponsors”)), Topco and Conyers Park II Sponsor LLC, an affiliate of Centerview Capital Management, LLC and Conyers Park’s sponsor (the “CP Sponsor”) collectively own 229,083,807 shares, or 71.3% (including 55.9% held by Topco), of our outstanding common stock.

As of February 27, 2026, our authorized capital stock consisted of 3,290,000,000 shares of common stock and 10,000,000 shares of preferred stock.

As of February 27, 2026, the equity holders of Topco (equity funds affiliated with or advised by CVC Capital Partners, Leonard Green & Partners, Juggernaut Capital Partners, Centerview Capital, L.P., and Bain Capital (collectively, the “Advantage Sponsors”)), Topco and Conyers Park II Sponsor LLC, an affiliate of Centerview Capital Management, LLC (the “CP Sponsor”) collectively owned 229,083,807 shares, or 69.9% (including 54.9% held by Topco), of our outstanding common stock.

We are a controlled company within the meaning of the Nasdaq Stock Market LLC listing requirements and as a result, may rely on exemptions from certain corporate governance requirements.

34 unchanged sentences

The payment of cash dividends is also restricted under the terms of the agreements governing our debt and our ability to pay dividends may also be restricted by the terms of any future credit agreement or any securities we or our subsidiaries may issue.

Our failure to meet the continued listing requirements of Nasdaq could result in a delisting of our common stock.

On January 7, 2026, we received a letter from Nasdaq stating that the closing bid price for our common stock over the prior 30 days was below the minimum required share price for continued listing on Nasdaq (the “Minimum Bid Price Requirement”).

In accordance with Nasdaq Listing Rule 5810(c)(3)(A), we have been provided a period of 180 calendar days, or until July 6, 2026, to regain compliance with the Minimum Bid Price Requirement.

If, at any time during this 180-day period, the closing bid price of the Company’s common stock is at least $1.00 for a minimum of 10 consecutive business days, Nasdaq staff will provide written notification that the Company has achieved compliance with the Minimum Bid Price Requirement.

This notice has had no immediate impact on the listing of our common stock, which will continue to be listed and traded on Nasdaq during the period allowed to regain compliance, subject to our compliance with other listing standards.

However, in the event we do not regain compliance with these Nasdaq requirements within the applicable compliance period, Nasdaq could commence proceedings to delist our common stock, following which our common Stock would trade on the over-the-counter market for so long as we remain eligible to trade on such market.

A delisting of our common stock from Nasdaq may make it more difficult for us to raise capital on favorable terms in the future.

Such a delisting would likely have a negative effect on the price of our common stock and would impair your ability to sell or purchase our common stock when you wish to do so.

Further, if we were to be delisted from Nasdaq, our common stock would cease to be recognized as covered securities, and we would be subject to regulation in each state in which we offer our securities.

Moreover, there is no assurance that any actions that we would take to restore our compliance, if needed, would stabilize the market price, or improve the liquidity of our common stock, prevent our common stock from falling below the minimum requirements for continued listing again, or prevent future non-compliance with Nasdaq’s rules.

There is also no assurance that we will maintain compliance with the other listing standards of Nasdaq.

An active, liquid trading market for our Class A common stock may not be available.

We cannot predict the extent to which investor interest in our company will lead to availability of a trading market on Nasdaq or otherwise in the future or how active and liquid that market may be for our Class A common stock.

If an active and liquid trading market is not available, you may have difficulty selling any of our Class A common stock.

If an active and liquid trading

market is not available, you may have difficulty selling any of our Class A common stock.

Among other things, in the absence of a liquid public trading market:

28 unchanged sentences

Any announcement of a suspension, discontinuance or reduction of this program may negatively impact our reputation and investor confidence.

The valuation of our private placement warrants could increase the volatility in our net (loss) income in our consolidated statements of (loss) earnings.

We determine the fair value of the liability classified private placement warrants by approximating the value with the price of the public warrants at the respective period end.

The change in fair value of warrant liability represents the mark-to-market fair value adjustments to the outstanding private placement warrants issued in connection with the initial public offering of Conyers Park.

Significant changes in the price of the public warrants and the number of private placement warrants outstanding may adversely affect the volatility in our net (loss) income in our Consolidated Statements of Operations and Comprehensive Loss.

Risks Related to Indebtedness

12 unchanged sentences

For a more detailed description of the covenants and material terms of our material indebtedness, please see “ Management’s Discussion and Analysis of Financial Condition and Results of Operations — Liquidity and Capital Resources” in this Annual Report.

Our recent debt transactions may not achieve their anticipated benefits.

In 2026, we agreed to engage in a series of transactions designed to extend our debt maturities and reduce our indebtedness.

On February 6, 2026, Advantage Sales & Marketing Inc.

an indirect subsidiary of the Advantage Solutions Inc., and certain subsidiaries of Advantage Solutions Inc.

(together with Advantage Sales & Marketing Inc., the “Company Parties”) entered into a Transaction Support Agreement with holders of approximately 59.2% of the Advantage Sales & Marketing Inc.’s outstanding senior secured notes and lenders holding approximately 54.3% of the Advantage Sales & Marketing Inc.’s outstanding term loans.

The agreement provides for support of transactions intended to extend the maturities of the Advantage Sales & Marketing Inc.’s outstanding debt obligations, including amendments to the existing notes and term loan facilities and related exchange or refinancing transactions.

In connection with its entry into the Transaction Support Agreement, on February 9, 2026, Advantage Sales & Marketing Inc.

commenced an exchange offer (the “Exchange Offer”) to exchange any and all of the Existing Notes for Advantage Sales & Marketing Inc.’s 9.000% Senior Secured Notes due 2030 (the “New Notes”), to be issued subsequent to the issuance of this Annual Report, and cash consideration.

Simultaneously with the Exchange Offer, Advantage Sales & Marketing Inc.

is soliciting consents (the “Consent Solicitation”) from holders of the Existing Notes to adopt certain proposed amendments to eliminate substantially all of the affirmative and negative covenants, mandatory offers to purchase, change of control provisions, and events of default provisions, and remove certain other provisions contained in the indenture, dated as of October 28, 2020, by and among the Advantage Sales & Marketing Inc., the guarantors party thereto and Wilmington Trust, National Association, as trustee and collateral agent, governing the Existing Notes and to terminate the guarantees of the Existing Notes provided by subsidiaries of Advantage Solutions Inc.

and release all of the collateral securing the Existing Notes.

In completing these transactions, we will incur substantial transaction expenses, will have agreed to pay higher levels of interest and will have committed to more restrictive debt covenants, which collectively could have important consequences, including the potentially adverse consequences of carrying significant debt or failing to comply with applicable debt covenants.

For all these reasons and more, we may not realize some or all of the benefits we anticipate receiving from completing the transactions.

Despite current indebtedness levels, we and our subsidiaries may still be able to incur additional indebtedness, which could increase the risks associated with our indebtedness.

1 unchanged sentence

Subject to covenant compliance and certain conditions, as of December 31, 2025, the agreements governing our indebtedness would have permitted us to borrow up to an additional $438.0 million under our revolving credit facility.

In addition, we and our subsidiaries have, and will have, the ability to incur additional indebtedness as incremental facilities under our credit agreement and we or our subsidiaries may issue additional notes in the future.

If additional debt is added to our current debt levels and our subsidiaries’ current debt levels, the related risks that we and they now face could increase.

4 unchanged sentences

Our variable rate indebtedness subjects us to interest rate risk, which could cause our debt service obligations to increase significantly.

Borrowings under our credit facilities are at variable rates of interest and expose us to interest rate risk.

Borrowings under our credit facilities, including under our debt transactions, are at variable rates of interest and expose us to interest rate risk.

If interest rates were to increase, our debt service obligations on the variable rate indebtedness would increase even though the amount borrowed remained the same, and our net income and cash flows, including cash available for servicing our indebtedness, will correspondingly decrease.

On a pro forma basis, assuming no other prepayments of the credit facility and that our revolving credit facility is fully drawn (and to the

extent that SOFR, is in excess of the 0.75% floor applicable to our revolving credit facility and our term loan credit facility, respectively), each one-eighth percentage point change in interest rates would result in an approximately $0.8 million change in annual interest expense on the indebtedness under our credit facilities.

On a pro forma basis, assuming no other prepayments of the credit facility and that our revolving credit facility is fully drawn (and to the extent that SOFR, is in excess of the 0.75% floor applicable to our revolving credit facility and our term loan credit facility, respectively), each one-eighth percentage point change in interest rates would result in an approximately $2.0 million change in annual interest expense on the indebtedness under our credit facilities.

In the future, we may enter into interest rate swaps that involve the exchange of floating for fixed-rate interest payments in order to reduce interest rate volatility or risk.

19 unchanged sentences

If we are unable to obtain insurance at an acceptable cost or on acceptable terms, we could be exposed to significant losses.

We have incurred and will continue to incur increased costs as a public company.

As a public company, we have incurred and will continue to incur significant legal, accounting, insurance, and other expenses that we did not incur as a private company, including costs associated with public company reporting requirements.

We also have incurred and will incur costs associated with the Sarbanes-Oxley Act and related rules implemented by the SEC.

The expenses incurred by public companies for reporting and corporate governance purposes generally have been increasing.

Laws and regulations could also make it more difficult or costly for us to obtain certain types of insurance, including director and officer liability insurance, and we may be forced to accept reduced policy limits and coverage or incur substantially higher costs to obtain the same or similar coverage.

These laws and regulations could also make it more difficult for us to attract and retain qualified persons to serve on our board of directors, on our board committees, or as our executive officers.

Furthermore, if we are unable to satisfy our obligations as a public company, we could be subject to delisting of our Class A common stock, fines, sanctions, and other regulatory action and potentially civil litigation.

If securities analysts do not publish research or reports about our business or if they publish negative evaluations of our common stock, the price of our Class A common stock could decline.

8 unchanged sentences

Topco, the Advantage Sponsors, the CP Sponsor and members of our management have rights, subject to certain conditions, to require us to file registration statements covering Topco’s shares of our common stock or to include shares in registration statements that we may file for ourselves or other stockholders.

In each of November 2020 and March 2021, we filed a registration statement on Form S-1 under which certain of our stockholders may sell, from time to time, shares of our Class A common stock, respectively, that, if sold, will be freely tradable without restriction under the Securities Act.

In the event a large number of shares of Class A common stock are sold in the public market, such sales could reduce the market price of our Class A common stock.

Shares of our Class A common stock held by Topco, the Advantage Sponsors, the CP Sponsor and members of our management are covered by a resale registration statement, and have rights, subject to certain conditions and limitations, to require us to facilitate the sale of those shares.

In the event a large number of shares of Class A common stock are sold in the public market, or a perception exists that such sales could occur, the market price of our Class A common stock could be adversely affected.

We may also issue shares of our common stock or securities convertible into our common stock from time to time in connection with financings, acquisitions, investments, or otherwise.

1 unchanged sentence

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1A. Risk Factors