What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2026-02-26 compared with 2025-02-28 · 805 added, 411 removed, 793 unchanged (61% of the section changed)

20 unchanged sentences

continuously enhance and improve our offerings to meet client needs, build our brand, scale our technology capabilities,

add functionality to and improve the performance of the Criteo Commerce Media Platform, and address technological and

industry advancements.

If we are unable to enhance our solutions to meet market demand in a timely manner, we may not

be able to maintain our existing clients or attract new clients, and our solutions may become less competitive or obsolete.

Furthermore, brand promotion activities may not yield increased revenue sufficient to offset expenses or any increased

revenue at all.

Our investments in our Commerce Media Platform and new technologies are inherently risky and may not be successful.

While we have a track record of addressing broader marketing and monetization goals, including customer acquisition and

brand awareness, we continue to invest substantial resources to adapt our model, pricing and organization to expand into

new advertising channels.

If we are not successful in continuing to improve and adapt our solutions along broader

marketing goals, our results of operations could be adversely affected.

Furthermore, we believe that the importance of

brand recognition will increase as competition in our market increases.

add functionality to and improve the performance of the Criteo Commerce Intelligence Platform, and address

technological and industry advancements.

If we are unable to enhance our solutions to meet market demand in a timely

manner, we may not be able to maintain our existing clients or attract new clients, and our solutions may become less

competitive or obsolete.

Furthermore, brand promotion activities may not yield increased revenue sufficient to offset

expenses or any increased revenue at all.

Our investments in our Commerce Intelligence Platform and new technologies are inherently risky and may not be

While we have a track record of addressing broader marketing and monetization goals, including customer

acquisition and brand awareness, we continue to invest substantial resources to adapt our model, pricing and organization

to expand into new advertising channels.

If we are not successful in continuing to improve and adapt our solutions along

broader marketing goals, our results of operations could be adversely affected.

Furthermore, we believe that the

importance of brand recognition will increase as competition in our market increases.

The market in which we participate is intensely competitive, and we may not be able to compete successfully

4 unchanged sentences

With the introduction of new technologies and the influx of new entrants to the market,

including large established companies, smaller companies that we do not yet know about, or companies that do not yet

exist, we expect competition to persist and intensify in the future, which could harm our ability to increase sales and

including large established walled gardens, smaller companies that we do not yet know about, or companies that do not

yet exist, we expect competition to persist and intensify in the future, which could harm our ability to increase sales and

maintain our profitability, including if competition increases pricing pressure.

Certain internet and technology companies may have the power and capital to significantly change the very nature of the

digital advertising marketplaces in ways that could materially disadvantage us.

Some of these companies could leverage

their positions to make changes to their web browsers, mobile operating systems, platforms, exchanges, networks or

other solutions or services that could be significantly harmful to our business and results of operations.

Some of these

companies also have significantly larger resources and capital than we do, and in many cases have advantageous

competitive positions in popular products and services such as Amazon Advertising, Google Search, YouTube, Chrome,

Meta Platforms, and Apple Search Ads , which they can use to their advantage.

Furthermore, our competitors have

invested substantial resources and capital in innovation, which could lead to technological advancements that change the

competitive dynamics of our business in ways that we may not be able to predict.

In addition to competing for advertising spend, we compete with many companies for advertising inventory, some of whom

also operate their own advertising networks or exchanges from which we buy advertising inventory.

As more companies compete for advertising impressions on advertising exchange platforms and other platforms that

aggregate supply of advertising inventory, advertising inventory may become competitive and expensive, which may

adversely affect our ability to acquire a consistent supply of advertising inventory and to deliver advertisements on a

profitable basis.

Some of the companies that we compete with, either for advertising spend or inventory, may also be our

clients or affiliated with our clients or important sources of advertising inventory.

Competitive pressure may incentivize

such companies to cease to be our clients or cease to provide us with access to their advertising inventory.

Certain internet and technology companies have significantly larger resources and capital than we do, and in many cases

have advantageous competitive positions in popular products and services such as Amazon Advertising, Google Search,

YouTube, Chrome, Meta Platforms, and Apple Search Ads , which they can use to their advantage.

Furthermore, our

competitors have invested substantial resources and capital in innovation, which could lead to technological

advancements that change the competitive dynamics of our business in ways that we may not be able to predict.

In addition to competing for advertising spend, we compete with many companies for advertising inventory.

companies compete for advertising impressions on advertising exchange platforms and other platforms that aggregate

supply of advertising inventory, advertising inventory may become competitive and expensive, which may adversely affect

our ability to acquire a consistent supply of advertising inventory and to deliver advertisements on a profitable basis.

Some of the companies that we compete with, either for advertising spend or inventory, may also be our clients or

affiliated with our clients or important sources of advertising inventory.

Competitive pressure may incentivize such

companies to cease to be our clients or cease to provide us with access to their advertising inventory.

If this were to occur, our ability to place advertisements would be significantly impaired and our results of operations would

10 unchanged sentences

Our business has recently undergone, and continues to undergo, a significant transformation, partially in response to

major changes in the advertising technology industry driven by, but not limited to, regulations such as GDPR and

major changes in the advertising technology industry driven by, but not limited to, regulations such as the GDPR and

restrictions on data collection and use, including those implemented by large technology companies.

25 unchanged sentences

advertisement, usually by clicking on it.

Many of our agreements with clients do not include a spending minimum.

Similarly, our contracts with publishers generally

do not include long-term obligations requiring them to make their inventory available to us over long periods of time.

Therefore, we need to continuously deliver satisfactory results for our clients and publishers to maintain and increase

revenue, which depends partly on the optimal functioning of Criteo AI Engine.

Many of our agreements with clients neither include a spending minimum nor include long-term obligations requiring

publishers to make their inventory available to us over long periods of time.

Therefore, we need to continuously deliver

satisfactory results for our clients and publishers to maintain and increase revenue, which depends partly on the optimal

functioning of Criteo AI Engine.

In addition, we have seen significant growth in the amount and complexity of data processed by Criteo AI Engine and the

3 unchanged sentences

the type of data collected, stored, generated or accessed also increases.

Our client’s satisfaction also depends on our ability to keep advertisements from being placed in unlawful or inappropriate

content, or content that is not permitted under the terms of the applicable agreements with clients.

While this depends in

part on the optimal functioning of the Criteo AI Engine, as more of our clients use our self-service tools with less

intervention by us, it could become more challenging to train and support such clients to use such tools and to prevent

inappropriate or unlawful advertisements from being shown.

Consistent with the nature of all technology companies,

fraudulent or malicious activity, including non-human traffic, could also impair the proper functioning of Criteo AI Engine.

Our clients’ satisfaction depends on our ability to prevent advertisements from appearing alongside unlawful,

inappropriate, or otherwise non-compliant content under applicable agreements.

While this relies partly on the optimal

performance of the Criteo AI Engine, the growing adoption of our self-service tools—where clients operate with limited

direct support—can make it more challenging to guide their usage effectively and to prevent improper ad placements.

As with all technology-driven businesses, Criteo is also exposed to risks of fraudulent or malicious activity, including non-

human traffic, which can disrupt or degrade the proper functioning of the Criteo AI Engine.

For example, automated bots

or other deceptive mechanisms may artificially inflate click metrics or misattribute ad interactions, distorting campaign

The risk of such fraudulent activity is heightened in higher-value formats such as online video and CTV,

where inventory CPM is greater.

Significant system errors, defects, or fraudulent or malicious activity could impair or disable the Criteo AI Engine, hindering

our ability to purchase advertising inventory and generate revenue until these issues are resolved.

Failure to prevent ads

from being placed in unlawful or inappropriate contexts could also harm our reputation and business relationships.

Potential consequences of such events include:

• Loss of clients or publishers, or reduced inventory purchases by clients;

• Decrease in consumer visits to clients’ websites or mobile applications;

• Inefficient or erroneous inventory purchasing, leading to reduced or negative margins we could need to absorb;

• Lower return on advertising spend for clients;

• Reduced value of advertising inventory offered to publishers;

• Delivery of less relevant or irrelevant ads, lowering click-through and conversion rates;

• Blocking by internet service providers or regulatory authorities;

• Client payment disputes, refund demands, campaign terminations, withdrawal of future business, loss of

confidence, and potential liability through damages, regulatory actions, or lawsuits;

• Adverse publicity or reputational harm.

For example, the use of bots or other automated or manual mechanisms to generate fraudulent clicks or misattribute

clicks on advertisements we deliver could overstate the performance of our advertising.

Due to the higher cost per 1,000

impressions paid for online video and Connected TV advertisements, the risk of fraudulent traffic may increase as we

increase our purchasing of online video and Connected TV inventory.

If we were to experience significant errors, defects, or fraudulent or malicious activity in Criteo AI Engine, our solution

could be impaired or stop working altogether, which could significantly impair our ability to purchase any advertising

inventory and generate any revenue until the errors, defects or fraudulent or malicious activity were detected and

If we are unable to keep our clients’ advertisements from being placed in unlawful or inappropriate content, our

reputation and business may suffer.

Other negative consequences from experiencing such issues could include:

• a loss of clients and publishers or a decrease in inventory purchased by clients;

• fewer consumer visits to our client websites or mobile applications;

• faulty inventory purchase decisions, resulting in lower profitability per impression, up to and including negative

margins , for which we may need to bear the cost;

• lower return on advertising spend for our clients;

• lower price for the advertising inventory we can offer to publishers;

• delivery of less relevant or irrelevant advertisements, resulting in lower click-through or conversion rates;

• being blocked by internet service providers or regulators;

• refusals to pay, demands for refunds, loss of confidence, termination of campaigns or withdrawal of future business

and potential liability for damages or regulatory inquiries or lawsuits;

• negative publicity or harm to our reputation.

Due to the higher CPM paid for

online video and CTV advertisements, the risk of fraudulent traffic may increase as we increase our purchasing of online

video and CTV inventory.

As a result, the failure by Criteo AI Engine to accurately predict engagement of users and the failure to maintain the quality

of our client and publisher content could result in significant costs, lost revenue and diminished business opportunities.

Third parties may implement technical restrictions that impede our access to data and revenue opportunities

upon which we rely, which could materially impact our business and results of operations.

A substantial portion of the data we rely on comes from our publisher and retailer partners and other third parties,

including advertising exchange platforms (including supply-side platforms, or “SSPs”, such as Google’s Ad Manager) and

Similarly, we rely on our publisher and retailer partners, and such other third parties for opportunities to serve

advertisements through which we generate our revenue.

Our ability to successfully leverage such data and successfully

generate revenue from such opportunities could be impacted by restrictions imposed by or on our publisher and retailer

partners or other third parties, including restrictions on our ability to use or read cookies or other tracking features or our

ability to use real-time bidding networks or other bidding networks.

For example, our publishers and retailer partners are responsible under European regulation, such as the GDPR, the E-

Privacy Directive (each as defined below) and other new government restrictions, for gathering necessary user consents

and indicating to SSPs that Criteo has been approved by the applicable users.

As part of their efforts to comply with their

understanding of the requirements of European regulation, certain SSPs have required actions from publishers and

retailer partners with respect to such consents that appear stricter than regulations require.

Similarly, SSPs and other

relevant third parties may take similar actions in response to any new legislation or regulatory developments or

interpretations in the future, in response to perceived user preferences, or for other reasons.

If third parties on which we rely for data or opportunities to serve advertisements impose similar restrictions or are not able

to comply with restrictions imposed by other ecosystem participants, we may lose the ability to access data, bid on

opportunities, or purchase digital ad space, which could have a substantial impact on our revenue.

We have substantial client concentration in certain markets and solutions, with a limited number of clients

accounting for a substantial portion of our revenues in those areas.

Although our overall customer base is well-diversified, with our largest 10 clients representing 17.1% of our revenue i n the

aggregate in 2024 , in certain of our markets and solutions we derive a substantial portion of revenues from a limited

number of clients.

We cannot predict the future level of demand for our services and products generated by these clients,

and revenues from these clients may fluctuate.

Further, some of our contracts with these clients may permit them to

terminate or reduce use of our products at any time (subject to notice and certain other provisions).

If we fail to retain any

of these clients or any of these clients terminate or reduce use of our products, if not replaced by new clients and an

increase in business from existing clients, our revenues within certain markets or solutions may be negatively impacted.

We may not be able to effectively integrate or realize the expected benefits of acquisitions or strategic

13 unchanged sentences

The payment of such transaction costs

could adversely effect our financial condition, results of operations or cash flows.

could adversely affect our financial condition, results of operations or cash flows.

In addition, the anticipated benefits of

14 unchanged sentences

• increased fixed costs without corresponding offsetting growth.

Our international operations and expansion expose us to several risks.

As of December 31, 2024 , we had a direct operating pres ence in 23 offices and shared workplaces located in 16 countries

and did business in 108 countries .

Our current global operations and future initiatives involve a variety of risks, including:

• operational and execution risk, including localization of the product interface and systems, translation into foreign

languages, adaptation for local practices, adequate coordination to onboard local clients and publishers, difficulty

of maintaining our corporate culture, challenges inherent to hiring and efficiently managing employees over large

geographic distances, and the increasing complexity of the organizational structure required to support expansion

and operations into multiple geographies and regulatory systems;

• insufficient, or insufficiently coordinated, demand for and supply of advertising inventory in specific geographic

markets processed through Criteo AI Engine, which could impair its ability to accurately predict user engagement

in that market;

• compliance with (and liability for failure to comply with) applicable local laws and regulations, including, among

other things, laws and regulations with respect to data protection and user privacy, data use, tax and withholding,

labor regulations, anti-corruption, environment, consumer protection, economic sanctions, public health crises

(including the outbreak of contagious disease and pandemics), spam and content, and AI, which laws and

regulations may be inconsistent across jurisdictions;

• intensity of local competition for digital advertising budgets and internet advertising inventory;

• changes in a specific country’s or region’s political or economic conditions, including through elections;

• risks related to tariffs and trade barriers, pricing structure, payment and currency, including aligning our pricing

model and payment terms with local norms, higher levels of credit risk and payment fraud, difficulties in invoicing

and collecting in foreign currencies and associated foreign currency exposure, restrictions on foreign ownership

and investments, and difficulties in repatriating or transferring funds from or converting currencies;

• limited or unfavorable intellectual property (“IP”) protection;

Additionally, operating in international markets also requires significant management attention and financial and legal

We cannot be certain that the investment and additional resources required in establishing operations in other

countries will produce desired levels of revenue or profitability.

Because Criteo S.A.'s functional currency is the euro, while Criteo S.A.'s reporting currency is the U.S.

dollar, we face

exposure to fluctuations in foreign currency exchange rates.

Foreign currency exchange risk exposure also arises from

intra-company transactions and financing with subsidiaries that have a functional currency different than the euro.

While we are engaging in hedging transactions to minimize the impact of uncertainty in future exchange rates on intra-

company transactions and financing, we may not hedge all of our foreign currency exchange rate risk.

In addition, hedging

transactions carry their own risks and costs, and could expose us to additional risks that could harm our financial condition

and operating results.

If we are unable to successfully integrate, leverage the commercial relationships of, or realize the expected benefits of the

strategic transactions we complete or any business, product, solution, technology or team we acquire in the future, our

business and results of operations could suffer, and we may not be able to achieve our business and growth objectives.

We have substantial client concentration in certain markets and solutions, with a limited number of clients

accounting for a substantial portion of our revenues in those areas.

Although our overall customer base is well-diversified, with our largest 10 clients representing 19.5% of our revenue in the

aggregate in 2025 , in certain of our markets and solutions we derive a substantial portion of revenues from a limited

number of clients.

We cannot predict the future level of demand for our services and products generated by these clients,

and revenues from these clients may fluctuate.

Further, some of our contracts with these clients may permit them to

terminate or reduce use of our products at any time (subject to notice and certain other provisions).

If we fail to retain any

of these clients or any of these clients terminate or reduce use of our products, if not replaced by new clients and an

increase in business from existing clients, our revenues within certain markets or solutions may be negatively impacted.

Regulatory, legislative or self-regulatory developments regarding internet or online matters could adversely

4 unchanged sentences

industry standards relating to targeted advertising.

In the European Union (“EU”), the two main pillars of the data protection legal framework are the Directive on Privacy and

Electronic Communications (“E-Privacy Directive”) and the General Data Protection Regulation (“GDPR”).

The E-Privacy

Directive directs EU member states to ensure that accessing information on an Internet user’s computer, such as through

a cookie and other similar technologies, is allowed only if the Internet user has been informed about such access and

given consent.

The Court of Justice of the EU clarified that such consent must be reflected by an affirmative act of the

user in line with the requirements applicable to consent under GDPR.

These developments result in ending reliance on

implied consent mechanisms used to meet requirements of the E-Privacy Directive in some markets.

The European Data

Protection Board has also published guidelines further restricting its interpretation of the technical scope of the E-Privacy

Directive, increasingly limiting our possibility to rely on certain tracking technologies such as racking links and URL.

In the EU, the two main pillars of the data protection legal framework remain the E-Privacy Directive and the GDPR.

E-Privacy Directive mandates that the placing or reading of information in a user's device, such as through a cookie and

other tracking technologies, requires such user’s express consent.

The European Data Protection Board has also

published guidelines expanding the list of what is a tracking technology under the E-Privacy Directive, limiting our

possibility to rely on certain technologies such as racking links and URL.

Under GDPR, data protection authorities have the power to impose administrative fines of up to a maximum of €20 million

or 4% of the data controller’s or data processor’s total worldwide turnover from the preceding financial year.

sanctions would be applicable under the E-Privacy Regulation to cookie consent.

sanctions are also applicable under the E-Privacy Directive.

Further, on October 1, 2020, the French data protection authority (the Commission Nationale de l'Informatique et des

21 unchanged sentences

Criteo has appealed this decision before the Conseil d’Etat.

Refer to Note 20.

Commitments and Contingencies for more

In 2018, the State of California adopted the California Consumer Privacy Act of 2018 (the “CCPA”), which went into effect

on January 1, 2020, and requires covered companies to, among other things, provide new disclosures to California

consumers and afford such consumers new abilities to opt out of the sale of their personal information.

In November 2020,

voters in California passed the California Privacy Rights Act (“CPRA”), which both amends and expands the scope of the

The CPRA, which became effective on January 1, 2023, created additional privacy rights and protections for

California consumers with respect to their personal information and additional obligations on businesses.

We cannot predict the full effect of these laws and regulations on our business, but adapting our business to comply with

them could involve substantial resources and expense, and may cause us to divert resources from other aspects of our

business, all of which may adversely affect our business.

Refer to Note 19 Commitments and contingencies, for more

In November 2025, the European Commission proposed a broad package of amendments to the GDPR intended to

modernize and align the EU’s data protection framework with other digital regulations.

The proposals would, among other

things, clarify the definition of personal data, introduce new legal bases for the development and operation of AI systems,

adjust breach-notification thresholds and timelines, and consolidate certain E-Privacy and cookie-related provisions

directly into the GDPR.

In particular, the draft would permit the use of standardized, browser- or device-level consent

signals to express user preferences, potentially reducing our clients’, publisher and retailer partners’ ability to manage

consent collection through their own interfaces.

If adopted, these reforms could alter the scope of lawful processing, affect

how we collect and use data for advertising and measurement, and increase operational and compliance complexity.

timing, final content, and enforcement approach of these reforms remain uncertain, and any resulting changes could

materially impact our business, financial condition, or results of operations.

In 2018, the State of California adopted the CCPA, which went into effect on January 1, 2020, and requires covered

companies to, among other things, provide new disclosures to California consumers and afford such consumers new

abilities to opt out of the sale of their personal information.

The California Privacy Rights Act (the “CPRA”), which both

amends and expands the scope of the CCPA and creates additional privacy rights and protections for California

consumers with respect to their personal information and additional obligations on businesses b ecame effective January

California’s privacy regulations continue to evolve with new rules on data broker registration, automated decision-

making and cybersecurity audits, and enforcement activity is accelerating.

In September 2025, the California Privacy Protection Agency approved final regulations under the CCPA that significantly

expand business obligations and consumer rights in California, including mandatory risk-assessments and annual

cybersecurity audits for certain businesses;

new rules governing the use of automated decision-making technology in

connection with “significant decisions” about consumers;

and enhanced disclosures, consent/opt-out mechanisms and

documentation requirements in connection with consumer privacy rights.

These new regulations will begin to take effect

on January 1, 2026, with phased compliance deadlines.

Because the ultimate reach and enforcement of these obligations

are still evolving, the implementation of these rules could require significant changes to our data-collection, processing,

governance, audit and compliance frameworks.

In addition, other states in the U.S.

are quickly adopting state enacted privacy laws.

Currently, a total of 20 states in the

Currently, more than 20 states in the

U.S have passed consumer and privacy laws.

Of those 20, eight state’s laws are currently effective.

Some of these consumer and privacy laws differ slightly from the CCPA and CPRA leading to a varied and complex

regulatory landscape, which could result in material costs.

Although many of these laws are modeled in part on the CCPA and CPRA,

they vary in important respects, including definitions of “sale” or “sharing,” requirements for targeted advertising opt-outs,

data-protection impact assessments, and enforcement mechanisms.

This patchwork of state privacy laws increases the

complexity of our compliance obligations, may require modifications to our data-handling practices, systems, and

consumer interfaces.

We cannot predict the full effect of these laws and regulations on our business, but adapting our business to comply with

them could involve substantial resources and expense, regulatory exposure, and may cause us to divert resources from

other aspects of our business, all of which may adversely affect our business.

Clarifications of and changes to these existing and proposed laws, regulations, judicial interpretations and industry

1 unchanged sentence

our clients in the form of increased fees, which may negatively affect our operating results.

Such changes can also delay or impede the development of new solutions, result in negative publicity and reputational

harm, require significant management time and attention, increase our risk of non-compliance and subject us to claims or

other remedies, including fines or demands that we modify or cease existing business practices.

Additionally, any

perception of our practices or solutions as an invasion of privacy, whether such practices or solutions are consistent with

current or future regulations and industry practices, may subject us to public criticism, private class actions, reputational

harm or claims by regulators, which could disrupt our business and expose us to increased liability.

Finally, our legal and

financial exposure often depends in part on our clients’, publisher and retailer partners’ or other third parties' adherence to

and compliance with privacy laws and regulations and their use of our services in ways consistent with users’

expectations.

If our clients or publisher and retail partners fail to adhere to our contracts in this regard, or a court or

governmental agency determines that we have not adequately, accurately or completely described our own solutions,

services and data collection, use and sharing practices in our own disclosures to consumers, then we and our clients and

publisher and retailer partners may be subject to potentially adverse publicity, damages and investigation or other

regulatory activity in connection with our privacy practices or those of our clients.

Additionally, legislative and regulatory action is emerging in the areas of artificial intelligence (“AI”), which, given our long

history developing using and innovating through AI with the Criteo AI Engine, could increase costs or restrict opportunity.

Compliance with existing, expanding, or new laws and regulations regarding AI or use of data to train AI, including the EU

AI Act adopted on July 12, 2024 and other data protection laws, may involve significant costs or require changes in

products or business practices that could adversely affect our results of operations.

Additionally, our ability to innovate

may be affected if we are unable to access foundation models and general- purpose AI in the same manner as our non-

EU competitors.

Such changes can also delay

or impede the development of new solutions, result in negative publicity and reputational harm, require significant

management time and attention, increase our risk of non-compliance and subject us to claims or other remedies, including

fines or demands that we modify or cease existing business practices.

Additionally, any perception of our practices or

solutions as an invasion of privacy, whether such practices or solutions are consistent with current or future regulations

and industry practices, may subject us to public criticism, private class actions, reputational harm or claims by regulators,

which could disrupt our business and expose us to increased liability.

Finally, our legal and financial exposure often

depends in part on our clients’, publisher and retailer partners’ or other third parties' adherence to and compliance with

privacy laws and regulations and their use of our services in ways consistent with users’ expectations.

If our clients or publisher and retail partners fail to adhere to our contracts in this regard, or a court or governmental

agency determines that we have not adequately, accurately or completely described our own solutions, services and data

collection, use and sharing practices in our own disclosures to consumers, then we and our clients and publisher and

retailer partners may be subject to potentially adverse publicity, damages and investigation or other regulatory activity in

connection with our privacy practices or those of our clients.

Beyond privacy, AI regulation is emerging as a major compliance frontier.

Given our long history developing, using, and

innovating through AI with the Criteo AI Engine, this could increase costs or restrict opportunities.

Compliance with

existing, expanding, or new laws and regulations regarding AI or use of data to train AI, including the EU AI Act adopted on

July 12, 2024 and other data protection laws, may involve significant costs or require changes in products or business

practices that could adversely affect our results of operations.

In November 2025, the European Commission published

the Digital Omnibus on AI Regulation Proposal, which would amend the AI Act by introducing flexible timelines for

compliance with high-risk AI obligations, expanding the supervisory role of the European Artificial Intelligence Office,

allowing sensitive data processing for bias mitigation and adjusting registration burdens and proportionality requirements.

These reforms may require us to modify how we access, train or deploy foundation models or general-purpose AI,

undertake additional documentation, governance, oversight and monitoring, and align with evolving definitions of what

constitutes an AI “system” or “provider.” Any failure to adapt could adversely affect our product development, business

practices, competitive positioning and results of operations.

Additionally, our ability to innovate may be affected if we are

unable to access foundation models and general-purpose AI ("GPAI") in the same manner as our non-EU competitors as

these GPAI providers may choose to avoid the EU market due to its regulatory complexity.

Our international operations and expansion expose us to several risks.

As of December 31, 2025 , we had a direct operating presence in 26 offices and shared workplaces located in 19 countries

and did business in 110 countries .