What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2025-03-18 compared with 2024-03-21 · 235 added, 260 removed, 548 unchanged (47% of the section changed)

5 unchanged sentences

Business and Industry Risks

• Any decrease in adoption of our eSignature product, without a corresponding increase in our other products.

• Any decrease in adoption or sales of our eSignature product, without corresponding increases in our other solutions in our IAM platform.

• Any inability to attract new customers and retain and expand sales to existing customers.

• Our IAM platform failing to achieve market acceptance or to meet our customers’ evolving needs.

• Our inability to compete in an evolving and highly competitive market.

• Our systems and security measures being compromised or subject to data breaches, cyberattacks, or other malicious activity.

• Our systems and security measures being compromised or subject to data breaches, cyberattacks, or other malicious activity, and any harm to our business or reputation caused by malicious actors attempting to exploit our technology, platform or brand to defraud others.

• Any real or perceived improper use of, disclosure of, or access to sensitive customer data.

• Our products and solutions not evolving to meet the needs of our customers or failing to achieve market acceptance.

• Any inability to manage our growth effectively.

• An over-estimation of the size of our total addressable market.

• Any interruption or delay in performance from our technical operations infrastructure, co-located data centers and third-party cloud providers.

• An over-estimation of our market opportunity.

• Any interruption or delay in performance from our technical infrastructure, including third-party cloud providers.

• The implementation of AI in our business, and the legal, regulatory, reputational and business risks relating to its use.

• Any loss of highly skilled personnel, including our management team or other key employees, or inability to attract, integrate, and retain such employees necessary to support our business.

6 unchanged sentences

• Any failure to forecast our revenue accurately, or failure to match our expenditures with corresponding revenue.

• Any inability to achieve or sustain profitability in the future.

• Any operational challenges in connection with our current or future international operations.

• A lack of additional capital or the availability to use it on reasonable terms to support business growth and objectives.

• Any limits on business flexibility and access to capital due to substantial indebtedness.

• Any limits on our ability to use our net operating loss carryforwards to offset future taxable income.

3 unchanged sentences

• Any failure to adequately protect our proprietary rights, including intellectual property rights.

• The implementation of AI in our business and challenges with properly governing its use.

Risks Related to our Common Stock

• Any volatility in the market price of our common stock.

• Securities analysts publishing unfavorable or inaccurate research about us, or not publishing research.

General Risks

1 unchanged sentence

• Natural catastrophic events and man-made problems, including the effects of climate change.

DocuSign, Inc.| 2024 Form 10-K | 13

Docusign, Inc.

| 2025 Form 10-K | 13

Our business involves significant risks, some of which are described below.

1 unchanged sentence

Business and Industry Risks

We derive a majority of our revenue from our eSignature product, and slower or declining adoption of our eSignature product, without a corresponding increase in the use of our other products and solutions, could cause our operating results to suffer.

We derive a majority of our revenue from our eSignature product, and slower or declining adoption or sales of our eSignature product, without corresponding increases in the use of our other products and solutions in our IAM platform, could cause our operating results to suffer.

Sales of subscriptions to our eSignature product account for substantially all of our subscription revenue and are the source of substantially all of our professional services revenue.

Although we continue to add to our suite of products and solutions for automating the agreement process, we expect that we will be substantially dependent on our eSignature product to generate revenue for the foreseeable future.

Although we continue to add to our suite of other products and solutions in our IAM platform for automating the agreement process, we expect that we will be substantially dependent on our eSignature product to generate revenue for the foreseeable future.

As a result, our operating results could suffer due to:

7 unchanged sentences

▪ our inability to release enhanced versions of our eSignature product on a timely basis;

▪ macro- and micro-economic factors, including inflation, volatile interest rates, increased debt and equity market volatility, actual or perceived instability in the global banking sector, and the impact of regional or global conflicts or other public health crises.

▪ macro- and micro-economic factors, including inflation, changes in interest rates or foreign exchange rates, increased debt and equity market volatility, tariffs and trade policy changes, geopolitical conflict or public health crises.

We have experienced, and may continue to experience, declines and fluctuations in the demand for our eSignature product due to a number of factors, including changing patterns of customer adoption and retention, shifts in customer spending levels, a highly competitive market, and general economic and global market conditions.

12 unchanged sentences

Our customers have no obligation to renew their subscriptions and we cannot guarantee that our customers will renew their subscriptions with us for a similar or greater contract period or on the same or more favorable terms.

Our renewal and expansion rates may decline or fluctuate as a result of a number of factors, including customer spending levels, customer dissatisfaction, decreases in the number of users with our customers, changes in the type and size of our customers, pricing, competitive conditions, customer attrition and general economic and global market conditions, including as a result of inflation, volatile interest rates,

DocuSign, Inc.| 2024 Form 10-K | 14

actual or perceived instability in the global banking sector, increased debt and equity market volatility and the impact of regional or global conflicts or other public health crises.

Docusign, Inc.

| 2025 Form 10-K | 14

attrition and general economic and global market conditions, including as a result of inflation, changes in interest rates, increased debt and equity market volatility, tariffs and trade policy changes, geopolitical conflicts or public health crises.

If our customers do not renew their subscriptions for our products and solutions or if they reduce their subscription amounts at the time of renewal, our revenue will decline, and our business will suffer.

If our IAM platform, products and solutions do not evolve to meet the needs of our customers or fail to achieve sufficient market acceptance, our financial results and competitive position will suffer.

We spend substantial amounts of time and money to research, develop and enhance our existing products, add new offerings, incorporate additional functionality, and solve new use cases to meet our customers’ rapidly evolving demands.

Maintaining adequate research and development resources, such as the appropriate personnel and development technology, to meet the demands of our customers and potential customers is essential to our business.

If we are unable to develop products and solutions internally due to a lack of research and development resources, we may be forced to rely on acquisitions to expand into certain markets or technologies, which can be costly.

When we develop or acquire new or enhanced products and solutions, we typically incur expenses and expend resources upfront to develop, market, promote and sell them.

For example, in April 2024, we launched our new IAM platform.

When we introduce new or enhanced products and solutions, they must achieve high levels of market acceptance to justify the amount of our investment in developing or acquiring them and bringing them to market.

Our platform, products, solutions or enhancements to our existing products and solutions could also fail to attain sufficient market acceptance for many reasons, including:

▪ failure to predict market demand for particular features or functions, or to timely meet demand;

▪ defects, errors or failures in our platform, products and solutions;

▪ negative publicity about their performance or effectiveness;

▪ changes in applicable legal or regulatory requirements, or increased legal or regulatory scrutiny, adversely affecting our products and solutions;

▪ delays in releasing our products and solutions to the market;

▪ negative customer perception of our IAM platform or new products and solutions;

▪ inability to effectively execute our go-to-market and sales-directed strategies for our IAM platform, including the implementation of additional pricing models for products or enhancements;

▪ introduction or anticipated introduction of competing products by our competitors.

For example, we have made, and intend to continue making, significant investments in our platform and developing products that incorporate AI, and while we believe that these investments will drive future growth of our business, the development of such new features involves significant risks and costs, and there is no guarantee that any such offerings will ultimately be successful.

If the release of these or other new and enhanced products, solutions or functionalities as part of our platform do not meet customer needs or if our customers do not accept them, our business, operating results and financial condition would be harmed.

The adverse effect on our financial results may be particularly acute because of the significant research, development, marketing, sales and other expenses we will have incurred.

The market in which we participate is evolving and highly competitive, which may negatively affect our ability to add new customers, retain existing customers and grow our business.

7 unchanged sentences

We also face competition from a select number of vendors that focus on specific industries, geographies or product areas such as contract lifecycle management and advanced contract analytics.

As we attempt to sell our products and solutions to new and existing customers, we must convince them that our products and solutions are superior to the solutions that their organizations have used in the past.

As we attempt to sell our products and solutions to new and existing customers, we must convince them that our products and solutions are superior to other solutions available to their organizations.

Many of our competitors have longer operating histories than us, significantly greater financial, technical, marketing and other resources, stronger brand and customer recognition, larger intellectual property portfolios and broader global distribution.

As a result, our competitors may be able to respond more quickly and effectively than we can to new or changing opportunities, technologies, standards or customer requirements.

Our competitors may also offer lower pricing than we do or bundle certain competing products and services at a lower price.

Our competitors may also offer lower pricing

Docusign, Inc.

| 2025 Form 10-K | 15

than we do or bundle certain competing products and services at a lower price.

Further, we could lose customers if our competitors develop new competitive products and solutions, acquire competitive products, reduce prices, form strategic alliances with other companies, are acquired by third parties with greater resources or develop and market new technologies that render our existing or future products less competitive, unmarketable or obsolete.

1 unchanged sentence

If we are unable to effectively compete, our business, operating results and financial condition would be harmed.

Our systems and security measures have been, and may in the future be, compromised or subject to data breaches, cyberattacks, or other malicious activity, which could result in customers reducing or stopping their use of our products, our reputation being harmed, and significant liabilities and adverse effects on our operating results and financial condition.

Our operations involve the storage and transmission of customer data, personal data and other sensitive information, and our corporate environment contains important company data and/or business records, employee data and data from partner, vendor or other relationships, as well as a wide variety of our own internal company, partner and employee information.

Our employees, service providers and third parties often work on a remote or hybrid arrangement basis, which may involve relying on less secure systems and may increase the risk of cybersecurity related incidents.

Our systems and security measures have been, and may in the future be, compromised or subject to data breaches, cyberattacks, or other malicious activity, and third parties have attempted and may continue to attempt to exploit our platform or brand to defraud others, which could result in customers reducing or stopping their use of our products, our reputation being harmed, and significant liabilities and adverse effects on our operating results and financial condition.

Our operations involve the storage and transmission of customer data, personal data and other sensitive or confidential information, and our corporate environment contains important company data and/or business records, employee data and data from partner, vendor or other relationships, as well as a wide variety of our own internal company, partner and employee information.

Our employees, service providers and third parties providing services to us often work on a remote or hybrid arrangement basis, which may involve relying on less secure systems and may increase the risk of cybersecurity related incidents.

We cannot guarantee these private work environments and electronic connections to our work environment have the same robust security measures as those deployed in our physical offices.

We also rely on third-party and public-cloud infrastructure, and we depend in part on third-party security measures to protect against unauthorized access, cyberattacks and the mishandling of customer data.

We also rely on third-party and public-cloud infrastructure, and we depend in part on third-party security measures on such infrastructure to protect against unauthorized access, cyberattacks and the mishandling of customer data.

Our ability to monitor our third-party service providers’ data security is limited and any breach of our providers’ security measures may result in unauthorized access to, or misuse, loss or destruction of, our and our customers’ data.

While we have security measures in place designed to protect our production and development environment and other systems, maintain the integrity of customer, company, partner and employee information, and prevent data loss, misappropriation and other security breaches and incidents, we have faced security incidents in the past that did not have a material impact on our operations.

In these cases, upon detection, we took prompt action to prevent any additional unauthorized access, put further security controls in place and worked with law enforcement agencies.

These efforts may not completely eliminate potential risks from such incidents.

Furthermore, there can be no assurance that there will be no impact to our operations from these or similar incidents in the future.

While we have security measures in place designed to protect our production and development environments and other systems, maintain the integrity of customer, company, partner and employee information, and prevent data loss, misappropriation and other security breaches and incidents, we are a frequent target of cyberattacks and have faced security incidents in the past that did not have a material impact on our operations.

In these cases, upon detection, we took prompt action to prevent any additional unauthorized access, put further security controls in place and worked with law enforcement agencies, when appropriate.

While we have taken and will continue to take steps to address cyberattacks and security incidents, these efforts may not always be entirely successful, and there can be no assurance that there will be no impact to our operations from these or similar incidents in the future.

Despite our prevention and response efforts, any security incident or breach, even if immaterial and properly addressed, could result in negative publicity, loss of customers, damage to our reputation and could impair our sales and harm our business.

DocuSign, Inc.| 2024 Form 10-K | 15

Like other organizations providing valuable technology and services, we are subject to increasing cyberattacks from malicious third parties using a wide variety of tactics.

Like other organizations providing valuable technology and services, we are subject to increasing cyberattacks from malicious third parties using widely varying and frequently changing tactics, including phishing and fraud campaigns targeting our personnel via email, text, instant messaging and voice calls.

The frequency and sophistication of such threats continues to increase and often becomes further heightened in connection with geopolitical tensions.

In addition, we face increased risk to maintain the performance, reliability, security and availability of our products and technical infrastructure to the satisfaction of our customers.

In addition, we face increased risk in our ability to maintain the performance, reliability, security and availability of our products and technical infrastructure to the satisfaction of our customers.

Advances in technology and the increasing sophistication of attackers have led to more frequent and effective cyberattacks, including advanced persistent threats by state-sponsored actors, cyberattacks relying on complex social engineering or “phishing” tactics, ransomware attacks and other methods including credential stuffing and account takeover attacks, denial or degradation of service attacks, malicious code (e.g., viruses and worms), and many other techniques that may lead to the loss, theft or misuse of personal, corporate or financial information, fraudulent payments and identity theft.

Bad actors, nation-states, and nation-state-supported actors now engage, and are expected to continue to engage, in cyberattacks, including for geopolitical reasons and in connection with global or regional conflicts and operations.

During major global or regional conflicts, we and our partners, service providers, or customers may be vulnerable to heightened risk of such cyberattacks.

If bad actors gain improper access to our systems or databases or those of our partners, service providers, and other third parties who have access to our data, they may be able to steal, publish, delete, copy, unlawfully or fraudulently use or modify data, including personal information and/or blackmail us to pay a ransom.

If our security measures, or the security measures of our partners, service providers, or customers, are compromised, our reputation could be damaged, our ability to attract and retain customers could be adversely affected, we could be subject to negative publicity, increased costs to remedy any problems and otherwise respond to any incident, monetary and other losses for us or our customers, identity theft for our customers, the inability to expand our business, additional scrutiny, restrictions, fines or penalties from regulatory or governmental authorities, loss of customers and customer confidence in our services, ongoing regulatory oversight, assessments and audits, exposure to civil litigation, and/or a breach of our contracts with third parties, all of which could expose us to significant liability and harm our business, financial condition, and operating results.

Additionally, “bad actors” have misused our platform and/or our brand name to attempt to deceive or defraud others, and may continue to do so.

If our efforts to prevent these activities, or limit their impact, are unsuccessful, our reputation and brand could be harmed, we could lose customers, and our business and financial condition could be adversely affected.

Docusign, Inc.

| 2025 Form 10-K | 16

subject to negative publicity, increased costs to remedy any problems and otherwise respond to any incident, monetary and other losses for us or our customers, identity theft for our customers, the inability to expand our business, additional scrutiny, restrictions, fines or penalties from regulatory or governmental authorities, loss of customers and customer confidence in our services, ongoing regulatory oversight, assessments and audits, exposure to civil litigation, and/or a breach of our contracts with third parties, all of which could expose us to significant liability and harm our business, financial condition, and operating results.

Despite significant efforts to identify vulnerabilities and create security barriers to such threats, it is virtually impossible for us, our service providers, our partners and our customers to entirely mitigate these risks.

Further, we could be forced to expend significant financial and operational resources in response to a security breach, including repairing system damage, increasing security protection costs, investigating and remediating any information security vulnerabilities, complying with data breach notification obligations and applicable laws, and defending against and resolving legal and regulatory claims, all of which could divert resources and the attention of our management and key personnel away from our business operations and materially and adversely affect our business, financial condition, and operating results.

In July 2023, the Securities and Exchange Commission (the “SEC”) also adopted a new cybersecurity rule (effective in December 2023) requiring companies subject to SEC reporting requirements to formally report material cyber security incidents, where failure to report may result in the SEC imposing injunctions, fines and other penalties.

Further, we could be forced to expend significant financial and operational resources in response to a cyberattack or security incident or breach, including repairing system damage, increasing security protection costs, investigating and remediating any information security vulnerabilities, complying with data breach notification obligations and applicable laws, and defending against and resolving legal and regulatory claims, all of which could divert resources and the attention of our management and key personnel away from our business operations and materially and adversely affect our business, financial condition, and operating results.

Additionally, there can be no assurance that any limitations of liability provisions in our contracts would be enforceable or adequate in the event of a security breach or would otherwise protect us from any such liabilities or damages with respect to any particular claim.

We also cannot be sure that our existing general liability insurance coverage, our cybersecurity coverage, and coverage for errors or omissions will continue to be available on acceptable terms or will be available in sufficient amounts to cover one or more large claims, or that insurers will not deny coverage as to any future claim.

Security breaches may result in increased costs for such insurance as well.

We also cannot be sure that our existing general liability insurance coverage, cybersecurity coverage, and coverage for errors or omissions will continue to be available on acceptable terms or will be available in sufficient amounts to cover one or more large claims, or that insurers will not deny coverage as to any future claim.

Cyberattacks or security incidents may result in increased costs for such insurance as well.

One or more large, successful claims against us in excess of our available insurance coverage, or changes in our insurance policies, including premium increases or large deductible or coinsurance requirements, could have an adverse effect on our business, operating results and financial condition.

3 unchanged sentences

In addition, customers use our products and solutions to obtain and store personal information, health information (including protected health information) and personal financial information.

Our handling of data is thus subject to a variety of laws and regulations around the world, including regulation by various government agencies, such as the respective Data Protection Authorities of the United Kingdom and other EU member states who enforce the General Data Protection Regulation, the U.S.

Our handling of data is thus subject to a variety of laws and regulations around the world, including regulation by various government agencies, such as the respective data protection authorities of the United Kingdom and EU member states who enforce the General Data Protection Regulation, the U.S.

Federal Trade Commission (the “FTC”), the U.S.

Department of Health and Human Services Office for Civil Rights (the “OCR”), the California Privacy Protection Agency, and other various state, local and foreign agencies and other authorities, such as each U.S.

Department of Health and Human Services Office for Civil Rights (the “OCR”), the California Privacy Protection Agency, and other various federal, state, local and foreign agencies and other authorities, such as each U.S.

state’s attorney general.

2 unchanged sentences

Although we endeavor to comply with our policies and documentation, we may at times fail to do so or be accused of having failed to do so.

DocuSign, Inc.| 2024 Form 10-K | 16

misrepresent our actual practices, which could materially and adversely affect our business, financial condition and results of operations.

The publication of our privacy notices and other related documentation that provide commitments about data privacy and security can subject us to potential actions if they are found to be non-compliant, deceptive, unfair, or otherwise misrepresent our actual practices, which could materially and adversely affect our business, financial condition and results of operations, and subject us to investigations, fines or penalties from regulators or government authorities, or civil litigation.

We are subject to various evolving laws and regulations governing our use of our business data.

For more information on these laws and regulations, see the risk factor “ We are subject to laws and regulations affecting our business, including those related to e-signature, marketing, advertising, privacy, data protection and information security.

Our actual or perceived failure to comply with laws or regulations could harm our business.

Complying with laws and regulations, in particular those related to privacy and data protection, could also result in additional costs and liabilities to us or inhibit sales of our software.

For more information on these laws and regulations, see the risk factors “ We are subject to laws and regulations affecting our business, including those related to e-signature, marketing, advertising, privacy, data protection and information security.

Our actual or perceived failure to comply with laws or regulations could harm our business.” and “Complying with laws and regulations, in particular those related to privacy and data protection, could also result in additional costs and liabilities to us or inhibit sales of our software.

” If we are not able to comply with these laws or regulations or if we become liable under these evolving laws or regulations, we could be directly harmed, and we may be forced to implement new measures to reduce our exposure to this liability.

2 unchanged sentences

Any costs incurred as a result of this potential liability could harm our business and operating results.

Docusign, Inc.

| 2025 Form 10-K | 17

Additionally, any failure or perceived failure by us to comply with laws, regulations, policies, legal or contractual obligations, industry standards, or regulatory guidance relating to privacy or data security, may result in governmental investigations and enforcement actions, litigation, fines and penalties or adverse publicity, and could cause our customers and partners to lose trust in us, which could have an adverse effect on our reputation and business.

If our products, solutions and functionalities do not evolve to meet the needs of our customers or fail to achieve sufficient market acceptance, our financial results and competitive position will suffer.

When we develop or acquire new or enhanced products and solutions, we typically incur expenses and expend resources upfront to develop, market, promote and sell them.

As a result, when we introduce new or enhanced products and solutions, they must achieve high levels of market acceptance to justify the amount of our investment in developing or acquiring them and bringing them to market.

New products, solutions or enhancements to our existing products and solutions could also fail to attain sufficient market acceptance for many reasons, including:

▪ failure to predict market demand for particular features or functions, or to timely meet demand;

▪ defects, errors or failures in our products and solutions;

▪ negative publicity about their performance or effectiveness;

▪ changes in applicable legal or regulatory requirements, or increased legal or regulatory scrutiny, adversely affecting our products and solutions;

▪ delays in releasing our products and solutions to the market;

▪ negative customer perception of our sales-directed strategies, including the pricing of new products or enhancements;

▪ introduction or anticipated introduction of competing products by our competitors.

For example, we have made, and intend to continue making, significant investments in developing products that incorporate AI, and while we believe that such new products will drive future growth of our business, the development of such new features involves significant risks and costs, and there is no guarantee that any such offerings will ultimately be successful.

If the release of these or other new and enhanced products, solutions or functionalities do not meet customer needs or if our customers do not accept them, our business, operating results and financial condition would be harmed.

The adverse effect on our financial results may be particularly acute because of the significant research, development, marketing, sales and other expenses we will have incurred.

Our prior rapid growth may not be indicative of our future growth.

Our revenue grew from $2.5 billion in the fiscal year ended January 31, 2023 to $2.8 billion in the fiscal year ended January 31, 2024.

We expect that, in the future, as our revenue increases, our revenue growth rate could decline as the scale of our business increases.

DocuSign, Inc.| 2024 Form 10-K | 17

While we experienced an increase in paying customers and revenue in the past, in part due to macro-economic conditions, including the pandemic, there is no assurance that we will experience a continued increase in paying customers or that new or existing customers will utilize our products at similar levels as businesses continue to return to more normalized, hybrid or in-person work environments.

Additionally, future revenue growth rates may fail to meet the expectations of investors or securities analysts, particularly if measured against periods of accelerated revenue growth such as those experienced during the earlier phases of the COVID-19 pandemic and the resulting increased adoption of remote work and reduced seasonality experienced during such periods.

We believe that future growth of our revenue depends on a number of factors, including our ability to:

▪ price our products and solutions effectively so that we are able to attract and retain customers;

▪ attract new customers, increase our existing customers’ use of our products and solutions and provide our customers with excellent customer support;

▪ expand our product offerings for our customers, including our ability to successfully implement such product offerings and ensure successful adoption of new or enhanced product offerings by our customers;

▪ effectively implement our sales strategies, including the expansion of self-serve capabilities;

▪ continue to introduce our products and solutions to new markets outside of the U.S.;

▪ mitigate and effectively manage the increased pace of the digital transformation of business and the costs of monitoring and complying with evolving governmental mandates;

▪ hire, retain, train, and integrate our employee base including our sales force, customer success, research and development teams and key employees;

▪ successfully identify and develop, acquire or invest in businesses, products or technologies that we believe could complement or expand our products and solutions;

▪ increase global awareness of our brand.

We may not successfully accomplish any of these objectives.

We expect to continue to expend substantial financial and other resources on:

▪ product development and innovation;

▪ sales, including our omni channel:

direct, self-serve and partners;

▪ marketing to expand brand awareness both in the U.S.

and internationally;

▪ our technology infrastructure, including information technology systems, systems architecture, management tools, scalability, availability, performance and security, as well as disaster recovery measures;

▪ acquisitions or strategic investments;

▪ international expansion;

▪ general administration, including legal and accounting expenses.

In addition to growth in revenue, we have also experienced significant growth in the number of our customers and users, the number and complexity of the transactions we handle, and the amount of data that our infrastructure supports.

Our growth has placed and may continue to place significant demands on our management and our operational and financial resources.

Finally, our business is becoming more complex as we increase our product offerings, expand internationally and acquire complementary companies, products and technologies.

In connection with this increased complexity, we are working to improve our operational, financial and management controls as well as our reporting systems and procedures, including streamlining or automating manual processes, all of which requires capital expenditures and management attention.

Failure to effectively manage our growth and operations could have an adverse effect on our business, operating results and financial condition.

If we have overestimated the size of our total addressable market, our future growth rate may be limited.

We have estimated the size of our total addressable market based on internally generated data and assumptions, as well as data published by third parties, which we have not independently verified.

If we have overestimated our market opportunity, our future growth rate may be limited.

We have estimated our market size and opportunity based on internally generated data and assumptions, as well as data published by third parties, which we have not independently verified.

While we believe our market size estimates are reasonable, such information is inherently imprecise and subject to a high degree of uncertainty.

1 unchanged sentence

In addition, these inaccuracies or errors may cause us to misallocate capital and other critical business resources, which could harm our business.

Even if our total addressable market meets our size estimates and experiences growth, we may not continue to grow our share of the market.

Even if our market size estimates are correct, we may not continue to grow our share of the market and our business could be harmed.

We depend on co-located data centers and third-party cloud providers, as well as our own technical operations infrastructure, to provide our products and solutions to our customers in a timely manner.

Interruptions or

DocuSign, Inc.| 2024 Form 10-K | 18

delays in performance of our products and solutions could result in customer dissatisfaction, damage to our reputation, loss of customers, limited growth and reduction in revenue.

Interruptions or delays in performance of our products and solutions could result in customer dissatisfaction, damage to our reputation, loss of customers, limited growth and reduction in revenue.

We currently serve our customers from third-party data center hosting facilities and cloud service providers.

10 unchanged sentences

These factors in turn could further reduce our revenue, subject us to liability and cause us to issue credits or cause customers to fail to renew their subscriptions, any of which could adversely affect our business.

We use AI in our business, and challenges with properly governing its use could result in reputational harm, competitive harm, and legal liability, and adversely affect our results of operations.

We use AI-powered tools and services as part of operating our business, and also incorporate AI features and applications into our products and solutions and are making further investments in expanding AI capabilities in our products and solutions.

AI technologies can be complex and are rapidly evolving, and while we believe that product features powered by next generation AI technologies, such as generative AI, will help drive the future growth of our business, there is no guarantee that such new product features will ultimately be successful.

Our competitors and other third parties may incorporate AI into their products more quickly or more successfully than us, all of which could impair our ability to compete effectively and may adversely affect our results of operations.

This use of AI in our products and solutions may present new and evolving challenges, including reputational harm, competitive harm, and legal liability, and adversely affect our results of operations.

Additionally, AI technology may lower barriers to entry in our industry and we may be unable to effectively compete with the products or services offered by new competitors.

AI-related changes to the products and services on offer may affect our customers’ expectations or requirements in ways we cannot adequately anticipate or adapt to, causing our business to lose sales, market share, or the ability to operate profitably and sustainably.

Docusign, Inc.

| 2025 Form 10-K | 18

The development and use of AI features and applications present various intellectual property, data privacy, security and reliability risks that may impact our business.

We may choose to significantly invest in the development and maintenance of proprietary datasets and training models and the development of appropriate protections, safeguards, and policies for handling the processing of data, including transparency of customer data extraction and usage in training models, with our AI features and applications, which may be costly and subject us to legal liability.

Furthermore, any integration of third-party AI models with our products and solutions relies on certain safeguards implemented by the third-party developers of the underlying AI models, including those related to the accuracy, bias, and other variables of the data, and these safeguards may be insufficient.

These risks could negatively impact our business, financial condition, and results of operations.

Existing laws and regulations may be interpreted, or new laws and regulations regarding AI have been and may in the future be adopted and interpreted, in ways which could negatively affect the way we use AI in our products.

For example, the EU Artificial Intelligence Act prohibits certain AI applications and systems with unacceptable risk and imposes additional requirements on the use of other high-risk or limited-risk AI applications or systems, which may require the implementation of additional quality assurance controls and measures to be reviewed and approved by regulatory submissions of our products.

Intellectual property ownership issues, licensing and privacy rights surrounding AI technologies are evolving and have not been fully addressed by U.S.

federal or state courts or foreign jurisdictions, which may expose us to claims of intellectual property infringement or misappropriation or privacy rights violations, or result in inquiries by government bodies or agencies.

For example, the U.S.

Federal Trade Commission initiated multiple AI-related inquiries over the past several years and sent requests to technology companies, including Docusign, seeking additional information about their AI usage and policies.

The rapid evolution of AI technologies will require significant resources in research and development in order to develop, test and maintain our platform and products to minimize any potential harmful impact on our business, financial condition, and results of operations.

The continued use in our business and incorporation of AI-powered features and applications into our products and solutions may subject us to new and evolving regulatory scrutiny, litigation, social or ethical concerns, unforeseen operational failures, potential for biased or incorrect outputs, or other risks that could harm our business, reputation, brand, and our results of operations.

For example, if the content, analyses, or recommendations arising from our AI product offerings are, or are alleged to be, inaccurate, deficient, offensive, or biased, or if they have a perceived or actual negative impact on human rights, privacy rights, employment, or in other social contexts, we may experience brand and reputational harm or legal liability, and our business, financial condition, and results of operations may be adversely affected.

Additionally, the significant technical complexity of AI technology will require specialized expertise and may increase compensation-related expenses.

Competition for specialized personnel in the AI industry is intense, and failing to attract, integrate, or retain such specialized expertise in AI could adversely affect our business and results of operations.

There is also the possibility that the AI models we develop may not perform as expected when deployed, which could hinder our product offerings, impact our competitiveness in the market, or lead to financial losses.

We rely on the performance of highly skilled personnel, including our management and other key employees, and failing to attract, integrate, or retain such employees could harm our business.

2 unchanged sentences

In the last 12 months, there have been significant changes to our senior leadership team.

For example, in June 2023, Cynthia Gaylor, our Chief Financial Officer, resigned from the Company and Blake Grayson was appointed as our new Chief Financial Officer, and in January 2024, Inhi Cho Suh, our President, Product and Engineering, departed the Company.

For example, in August 2024, Steve Shute, our President, Worldwide Field Operations, departed the Company and Paula Hansen was appointed as our President, Chief Revenue Officer.

These changes and any future significant leadership changes or senior management transitions involve inherent risk.

3 unchanged sentences

Our senior management and key employees are employed on an at-will basis, meaning that we may terminate their employment at any time, with or without cause, and they may resign at any time, with or without cause.

If we lose one or more of our senior management or other key employees and are unable to find adequate replacements, or if we fail to attract, integrate, retain and motivate members of our senior management team and key employees or otherwise fail to retain a significant portion of our workforce, our business could be harmed.

For example, in September 2022, in response to changing economic conditions and in an effort to reduce our operational costs and improve our organizational efficiency, we authorized a restructuring plan, which included a restructuring and reduction of the current workforce by approximately 9%.

The execution of this restructuring plan was substantially completed at the end of fiscal 2023.

Additionally, in February 2023, in an effort to support our growth, scale and profitability objectives, we authorized an additional restructuring plan, which included a restructuring and reduction of the current workforce by approximately 10%.

The execution of this restructuring plan was substantially completed at the end of the second quarter of fiscal 2024.

Further, in February 2024 , in an effort to strengthen and support our financial and operational efficiency while continuing to invest in product and related initiatives, we authorized an additional restructuring plan, which included a restructuring and reduction of the current workforce by approximately 6%.

We expect this restructuring plan to be completed during

DocuSign, Inc.| 2024 Form 10-K | 19

the first and second quarters of fiscal 2025.

These restructuring plans could negatively impact our ability to attract, integrate, retain and motivate key employees.

If we lose one or more of our senior management or other key employees and are unable to find adequate replacements, or if we fail to attract, integrate,

Docusign, Inc.

| 2025 Form 10-K | 19

retain and motivate members of our senior management team and key employees or otherwise fail to retain a significant portion of our workforce, our business could be harmed.

We also are dependent on the continued service of our existing software engineers because of the complexity of our products and solutions.

3 unchanged sentences

locations in the San Francisco Bay Area and Seattle.

Additionally, while we currently employ a hybrid model where employees have the flexibility to work from home, changes to our workplace arrangements could impact our ability to maintain our corporate culture or productivity, increase attrition or limit our ability to attract employees if individuals prefer to work full time at home or in the office.

Competition for employees in our industry (and especially in our principal U.S.

Additionally, while we currently employ a hybrid model where most employees have the flexibility to work from home, changes to our workplace arrangements could impact our ability to maintain our corporate culture or productivity, increase attrition or limit our ability to attract employees if individuals prefer to work full time at home or in the office.

Competition for employees in our industry (and especially with expertise in AI technology and at our principal U.S.

locations) is intense, and many of the companies we compete with for experienced personnel have greater resources than we do.

8 unchanged sentences

Further, government compliance requirements may change, restricting our ability to sell into the government sector until we have met those revised requirements.

Failure to meet government contract compliance obligations can create the risk of statutory penalties as well as standard breach of contract risk.

government shutdown, actual or perceived instability in the global banking sector, regional or global conflicts and public health crises, may adversely affect public sector demand for our products and solutions.

For example, recently proposed executive orders in the U.S.

may impose new limits or restrictions on federal contractors, and noncompliance with such limits or restrictions could impact our business with government entities.

Failure to meet government contract compliance obligations can also create the risk of statutory penalties as well as standard breach of contract risk.

Government demand and payment for our offerings are affected by public sector budgetary cycles and funding authorizations, and funding reductions or delays, including as a result of macro-economic factors, including inflation, changes in interest rates, government shutdowns or reductions in the government workforce, geopolitical conflicts and public health crises, may adversely affect public sector demand for our products and solutions.

We sell to public sector customers primarily through third-party resellers and distributors, who contract directly with government customers and are subject to complex laws, regulations and contractual requirements applicable to government contractors.

If our third-party resellers and distributors fail to comply with these obligations, are suspended, debarred or otherwise lose the ability to sell to public sector customers, our public sector sales and growth prospects could suffer and our operating results could be adversely affected.

In addition, both government agencies and entities in highly regulated industries may demand shorter subscription periods or other contract terms that differ from our standard arrangements, including terms that can lead those customers to obtain broader rights in our offerings than would be standard.

5 unchanged sentences

Our partners may cease marketing our subscription offerings or solutions with limited or no notice and with little or no penalty.

In addition, acquisitions of our partners by our competitors could result in a decrease in the number of our current and potential customers, as our partners may no longer facilitate the adoption of our products and solutions by potential customers.

Docusign, Inc.

| 2025 Form 10-K | 20

potential customers.

The loss of a substantial number of our partners, our possible inability to replace them or the failure to recruit additional partners could harm our growth objectives and operating results.

2 unchanged sentences

Failure to establish and maintain relationships with partners that can provide complementary technology offerings and software integrations could limit our ability to grow our business.

DocuSign, Inc.| 2024 Form 10-K | 20

Our products and solutions seamlessly integrate with hundreds of other software applications, including Google, Microsoft, Oracle, Salesforce, SAP, and ServiceNow.

Our products and solutions seamlessly integrate with hundreds of other software applications, including Google, Microsoft, Workday, Salesforce, SAP, and ServiceNow.

Our growth strategy includes expanding the use of our products and solutions through complementary technology offerings and software integrations, such as third-party APIs.

7 unchanged sentences

As part of our business strategy, we continually evaluate opportunities to acquire or invest in businesses, products or technologies that we believe could complement or expand our products and solutions, enhance our technical capabilities or otherwise offer growth opportunities.

For example, in May 2020, we acquired Seal Software Group Ltd., a provider of contract analytics software, and in July 2020 we acquired Liveoak Technologies, Inc., a provider of a secure agreement-collaboration and identity verification platform.

For example, in May 2024, we acquired Lexion, an AI-powered contract management platform which features intelligent contract repository and agreement workflow automation and reporting.

In the future, we may be unable to identify suitable acquisition candidates and, even if we do, we may not be able to complete desired acquisitions on favorable terms, if at all.

15 unchanged sentences

Our ability to increase our customer base and achieve broader market acceptance of our products and solutions depends to a significant extent on our ability to expand our marketing and sales operations.

We continue to make investments in our sales force and strategic partnerships, including expansion and training, both domestically and internationally.

We continue to make

Docusign, Inc.

| 2025 Form 10-K | 21

investments in our sales force and strategic partnerships, including expansion and training, both domestically and internationally.

We also dedicate significant resources to our sales and marketing efforts by investing in advertising campaigns on a variety of media platforms, including online and social media.

2 unchanged sentences

We may need to reduce or change our pricing model to remain competitive.

DocuSign, Inc.| 2024 Form 10-K | 21

Different pricing structures apply to our Docusign product offerings.

For DocuSign eSignature, we price our subscriptions based on the functionality required by our customers and the quantity of Envelopes provisioned.

We expect that we may need to change our pricing or pricing structures from time to time, including in connection with the launch of new or enhanced offerings for automating the agreement process or in response to competitive pressures.

As new or existing competitors introduce new competitive products or reduce their prices, we may be unable to attract new customers or retain existing customers based on our historical pricing.

For eSignature, we price our subscriptions based on the functionality required by our customers and the quantity of Envelopes required by our customers.

We expect that we may need to change our pricing or pricing structures from time to time, including in connection with the launch of our IAM platform and new or enhanced offerings or in response to competitive pressures.

For example, in the second quarter of fiscal 2025, we began to offer our IAM platform on a user-based subscription with transaction-based add-ons.

The rollout of our IAM platform and additional pricing model began gradually, starting in the second quarter of fiscal 2025.

Additionally, as new or existing competitors introduce new competitive products or reduce their prices, we may be unable to attract new customers or retain existing customers based on our historical pricing.

As we expand internationally, we must also determine the appropriate price to enable us to compete effectively in non-U.S.

11 unchanged sentences

These efforts may be costly and could adversely affect our financial results.

For example, in fiscal 2023, we launched a new enterprise resource planning (“ERP”) system, which is designed to accurately maintain our financial records, enhance the flow of financial information, improve data management, and provide timely information to our management team.

ERP system implementations are complex projects that require significant investment of capital and human resources, the reengineering of many business processes and the attention of many employees who would otherwise be focused on other aspects of our business.

Our failure to improve our systems and processes or their failure to operate in the intended manner, could harm our business, financial condition, and operating results.

Additionally, if the ERP system does not operate as intended, the effectiveness of our internal control over financial reporting could be adversely affected.

Additionally, from time to time, we realign our resources and talent to implement stage-appropriate business strategies, which could include furloughs, layoffs and reductions in force.

5 unchanged sentences

We have from time to time found defects in our products and solutions and may discover additional defects in the future that could result in data unavailability or unauthorized access or other harm to, or loss or corruption of, our customers’ data.

While we implement bug fixes and upgrades as part of our regularly scheduled system maintenance, we may not be able to reasonably anticipate and correct defects or errors before implementing our products and solutions.

While we implement

Docusign, Inc.

| 2025 Form 10-K | 22

bug fixes and upgrades as part of our regularly scheduled system maintenance, we may not be able to reasonably anticipate and correct defects or errors before implementing our products and solutions.

Consequently, we or our customers may discover defects or errors after our products and solutions have been employed.

If we fail to perform

DocuSign, Inc.| 2024 Form 10-K | 22

timely maintenance or if customers are otherwise dissatisfied with the frequency and/or duration of our maintenance services and related system outages, our existing customers could elect to not renew their subscriptions, delay or withhold payment to us, or cause us to issue credits, make refunds or pay penalties, and potential customers may not adopt our products and solutions and our brand and reputation could be harmed.

If we fail to perform timely maintenance or if customers are otherwise dissatisfied with the frequency and/or duration of our maintenance services and related system outages, our existing customers could elect to not renew their subscriptions, delay or withhold payment to us, or cause us to issue credits, make refunds or pay penalties, and potential customers may not adopt our products and solutions and our brand and reputation could be harmed.

In addition, the occurrence of any material defects, errors, disruptions in service or other performance problems with our software could result in warranty or other legal claims against us and diversion of our resources.

18 unchanged sentences

As a result, our past results may not be indicative of our future performance and comparing our operating results on a period-to-period basis may not be meaningful.

For example, we have, in the past, experienced net losses and, even in periods in which we generate net income, we may not be able to maintain or increase our level of profitability.

In addition to the other risks described herein, factors that may affect our operating results or cause our financial results to fluctuate include the following:

▪ general economic, market and industry conditions, including resulting from regional or global conflicts and as a result of inflation, volatile interest rates, actual or perceived instability in the global banking sector and increased debt and equity market volatility;

▪ general economic, market and industry conditions, including as a result of inflation, changes in interest rates or foreign exchange rates, increased debt and equity market volatility, tariffs and trade policy changes, geopolitical conflict or public health crises;

▪ fluctuations in demand for, or pricing of, our products and solutions, including due to the effects of global macro-economic conditions, and differing levels of demand for our products as our customers’ priorities, resources, financial conditions and economic outlook change;

Docusign, Inc.

| 2025 Form 10-K | 23

▪ our ability to attract new customers;

1 unchanged sentence

▪ timing of revenue recognition;

DocuSign, Inc.| 2024 Form 10-K | 23

▪ customer delays in purchasing decisions in anticipation of new products or product enhancements by us or our competitors;

6 unchanged sentences

▪ the amount and timing of costs associated with recruiting, training and integrating new employees, and retaining existing employees;

▪ the amount and timing of costs associated with our restructuring plans;

▪ the time and costs related to litigation, including securities litigation and litigation and claims involving our former CEO;

▪ the amount and timing of costs associated with restructuring plans;

▪ the time and costs related to litigation, including securities litigation;

▪ issues relating to acquisitions and partnerships with third parties;

▪ the impact of new accounting pronouncements;

▪ changes in laws and regulations that affect our business;

▪ changes in laws and regulations that affect our business, including trade policy changes;

▪ significant security breaches of, technical difficulties with, or interruptions to, the delivery and use of our products and solutions;

6 unchanged sentences

Customers frequently require considerable time to evaluate, test and qualify our offerings prior to entering into or expanding a subscription.

This is particularly true of DocuSign CLM and our other advanced offerings, where longer evaluation, testing and qualification processes often result in longer sales cycles than for our DocuSign eSignature product.

This is particularly true of CLM and our other advanced offerings, where longer evaluation, testing and qualification processes often result in longer sales cycles than for our eSignature product, and may also affect sales cycles for our IAM solutions as we market them to a growing number of potential customers.

The timing of our sales with our enterprise customers and related revenue recognition is difficult to predict because of the length and unpredictability of the sales cycle for these customers.

4 unchanged sentences

▪ the obstacles placed by customers’ procurement process;

▪ economic conditions, including due to inflation, volatile interest rates, a potential U.S.

government shutdown, increased debt and equity market volatility, and other factors impacting customer budgets;

▪ economic conditions, including due to inflation, changes in interest rates, government shutdowns or reductions in the government workforce, increased debt and equity market volatility, geopolitical conflict, public health crises and other factors impacting customer budgets;

▪ the customer’s integration complexity;

▪ the customer’s familiarity with e-signature and agreement automation processes;

▪ the complexity of contracts with certain large business customers, including customers in the public sector or other highly regulated industries;

▪ the complexity of contracts and regulatory requirements for certain large business customers, including customers in the public sector or other highly regulated industries;

▪ customer evaluation of competing products during the purchasing process;

▪ the competitive market for our products and services;

Docusign, Inc.

| 2025 Form 10-K | 24

▪ evolving customer demands.

Because we recognize revenue from subscriptions over the term of the relevant contract, downturns or upturns in sales contracts are not immediately reflected in full in our operating results.

DocuSign, Inc.| 2024 Form 10-K | 24

We recognize revenue over the term of each of our contracts, which are typically one year in length but may be up to three years or longer.

4 unchanged sentences

You should not rely on the revenue growth of any prior quarterly or annual period as an indication of our future performance.

As a result of our historical rapid growth and limited operating history, our ability to accurately forecast our future operating results is limited.

Future growth rates are also subject to a number of assumptions and uncertainties, including the effectiveness of our sales and growth strategy and general macro-economic conditions.

For example, it has been, and may continue to be, difficult for us to forecast our operating results due to recent macro-economic events, including interest rate hikes and rising rates of inflation and concerns about a potential economic downturn.

For example, it has been, and may continue to be, difficult for us to forecast our operating results due to recent macro-economic events, including interest rate volatility and inflation and concerns about a potential economic downturn.

Accordingly, we may be unable to prepare accurate internal financial forecasts or replace anticipated revenue that we do not receive as a result of delays arising from these factors.

If we do not address these risks successfully, our operating results could differ materially from our estimates and forecasts or the expectations of investors, causing our business to suffer and our stock price to decline.

We have historically experienced operating losses and may not achieve or sustain profitability in the future.

We began operations in 2003 and, until recently, we have historically experienced net losses.

We generated net income of $74.0 million in the year ended January 31, 2024 and a net loss of $97.5 million and $70.0 million in the years ended January 31, 2023 and 2022, respectively.

As of January 31, 2024, we had an accumulated deficit of $1.7 billion.

We will need to continue to generate and sustain increased revenue levels in future periods to become or remain profitable and, even in periods in which we generate net income, we may not be able to maintain or increase our level of profitability.

We intend to continue to incur significant expenses to support growth, further develop and enhance our products and solutions, expand our infrastructure and technology, incentivize and enable our sales organization and marketing activities, and grow our international operations and customer base.

Our efforts to grow our business may be costlier than we expect, and we may not be able to increase our revenue enough to offset our increased operating expenses.

We may incur significant losses in the future for a number of reasons, including the other risks described in this “Risk Factors” section, and unforeseen expenses, difficulties, complications and delays and other unknown events.

If we are unable to achieve or sustain profitability in the future, the value of our business and common stock may significantly decrease.

Our current operations are international in scope and we plan further geographic expansion, creating a variety of operational challenges.

12 unchanged sentences

▪ unexpected changes in laws and regulatory requirements, including but not limited to, taxes or trade laws;

DocuSign, Inc.| 2024 Form 10-K | 25

▪ more stringent regulations relating to privacy and data security and the unauthorized use of, or access to, commercial and personal information, particularly in Europe;

8 unchanged sentences

▪ regional or global conflicts, including sanctions or other laws and regulations prohibiting or limiting operations in certain jurisdictions;

Docusign, Inc.

| 2025 Form 10-K | 25

▪ political instability or terrorist activities;

24 unchanged sentences

We may require additional capital to support business growth and objectives, and this capital might not be available to us on reasonable terms, if at all, and may result in stockholder dilution.

DocuSign, Inc.| 2024 Form 10-K | 26

We fund our operations through payments by our customers for use of our product offerings and related services.

7 unchanged sentences

Additional financing may not be available on favorable terms, if at all.

In addition, in the event that we incur additional debt, including under the credit facility, the debt holders would have rights senior to holders of common stock to make claims on our assets.

In addition, in the event that we incur

Docusign, Inc.

| 2025 Form 10-K | 26

additional debt, including under the credit facility, the debt holders would have rights senior to holders of common stock to make claims on our assets.

Additionally, the credit facility restricts our ability to pay dividends on common stock and the terms of any future debt could restrict our operations.

1 unchanged sentence

If adequate funds are not available on acceptable terms when we require it, we may be unable to invest in future growth opportunities, which could harm our business, operating results and financial condition.

We have in the past incurred substantial indebtedness and may in the future incur substantial indebtedness that may decrease our business flexibility, access to capital and/or increase our borrowing costs, which may adversely affect our operations and financial results.

As of January 31, 2024, we had available borrowing capacity of $500.0 million under our credit facility.

If we decide to borrow a portion or the full amount under our credit facility, such indebtedness may:

▪ limit our ability to borrow additional funds for working capital, capital expenditures, acquisitions or other general business purposes;

▪ limit our ability to use our cash flow or obtain additional financing for future working capital, capital expenditures, acquisitions or other general business purposes;

▪ require us to use a substantial portion of our cash flow from operations to make debt service payments;

▪ limit our flexibility to plan for, or react to, changes in our business and industry;

▪ place us at a competitive disadvantage compared to our less leveraged competitors;

▪ increase our vulnerability to the impact of adverse economic and industry conditions, including inflation and volatile interest rates, and actual or perceived instability in the global banking sector.

Our ability to use our net operating loss carryforwards to offset future taxable income may be subject to certain limitations.

4 unchanged sentences

If our estimates or judgments relating to our critical accounting policies prove to be incorrect, our operating results could be adversely affected.

The preparation of financial statements in conformity with GAAP requires management to make estimates and assumptions that affect the amounts reported in our consolidated financial statements and accompanying notes.

We base our estimates on historical experience and on various other assumptions that we believe to be reasonable under

DocuSign, Inc.| 2024 Form 10-K | 27

the circumstances, as provided in the section titled “Management’s Discussion and Analysis of Financial Condition and Results of Operations.” Our operating results may be adversely affected if our assumptions change or if actual circumstances differ from those in our assumptions, which could cause our operating results to fall below the expectations of securities analysts and investors, resulting in a decline in the trading price of our common stock.

The preparation of financial statements in conformity with U.S.

generally accepted accounting principles (“GAAP”) requires management to make estimates and assumptions that affect the amounts reported in our consolidated financial statements and accompanying notes.

We base our estimates on historical experience and on various other assumptions that we believe to be reasonable under the circumstances, as provided in the section titled “Management’s Discussion and Analysis of Financial Condition and Results of Operations.” Our operating results may be adversely affected if our assumptions change or if actual circumstances differ from those in our assumptions, which could cause our operating results to fall below the expectations of securities analysts and investors, resulting in a decline in the trading price of our common stock.

We are exposed to fluctuations in currency exchange rates, which could negatively affect our operating results.

Our sales contracts are primarily denominated in U.S.

dollars, and therefore substantially all of our revenue is not subject to foreign currency risk.

dollars, and therefore a substantial portion of our revenue is not subject to foreign currency risk.

However, a strengthening of the U.S.

8 unchanged sentences

Any imposition by state or local governments or other jurisdictions of sales tax collection obligations on out-of-state or -jurisdiction sellers could also create additional administrative burdens for us, put us at a competitive disadvantage if they do not impose similar obligations on our competitors and decrease our future sales, which could have a material adverse impact on our business and operating results.

Docusign, Inc.

| 2025 Form 10-K | 27

Legal and Regulatory Risks

10 unchanged sentences

state attorney generals are interpreting federal and state consumer protection laws as imposing standards for the online collection, use, dissemination, and security of personal information.

For example, California has enacted the California Consumer Privacy Act (the “CCPA”), as amended by the California Privacy Rights Act (the “CPRA”), that subjects businesses to new regulations promulgated through a recently created enforcement agency called the California Privacy Protection Agency.

DocuSign, Inc.| 2024 Form 10-K | 28

Other states have passed comparable legislation, and some may pass similar legislation with potentially greater penalties, and more rigorous compliance requirements relevant to our business.

For example, California has enacted the California Consumer Privacy Act (as amended, the “CCPA”), that subjects businesses to new regulations promulgated through a recently created enforcement agency called the California Privacy Protection Agency.

Over a third of other U.S.

states have passed comparable legislation, and several additional U.S.

states may pass similar legislation with potentially greater penalties, and more rigorous compliance requirements relevant to our business.

▪ The Health Insurance Portability and Accountability Act (“HIPAA”) in the U.S.

3 unchanged sentences

Additionally, we are subject to various other laws and regulations affecting our business.

For example, the SEC recently adopted cybersecurity risk management and disclosure rules, which require mandatory disclosure of information pertaining to cybersecurity incidents and cybersecurity risk management, strategy and governance.

In March 2024, the SEC also adopted amendments that will require us to disclose certain climate-related information in our annual reports beginning with our annual report covering fiscal year ended January 31, 2026.

Additionally, California recently adopted the Climate Corporate Data Accountability Act and the Climate-Related Financial Risk Act, each of which mandate certain climate-related public disclosure requirements.

For example, the SEC has adopted cybersecurity risk management and disclosure rules, which require mandatory disclosure of information pertaining to cybersecurity incidents and cybersecurity risk management, strategy and governance.

In March 2024, the SEC also adopted (but subsequently stayed the implementation of) amendments that would require us to disclose certain climate-related information in our annual reports beginning with our annual report covering fiscal year ended January 31, 2026.

We expect that new laws, regulations and industry standards will continue to be proposed and enacted relating to privacy, data protection, marketing, advertising, electronic signatures, consumer communications and information security in the U.S., the EU and other jurisdictions, and we cannot determine the impact such future laws, regulations and standards may have on our business.

2 unchanged sentences

Any actual or perceived failure to comply with these or other laws or regulations could harm our business, and result in legal liability, regulatory action, or brand and reputational harm.

Docusign, Inc.

| 2025 Form 10-K | 28

Complying with laws and regulations related to privacy and data protection could result in additional costs and liabilities to us or inhibit sales of our software.

Internationally, many countries have established their own data privacy and security legal framework with which we, our customers and partners may need to comply.

For example, in Europe, the General Data Protection Regulation (the “GDPR”) has been enacted as national legislation for respective member states and contains robust obligations on data controllers and processors and fulsome documentation requirements for data protection compliance programs by companies.

As a result of our presence in Europe and the United Kingdom (“UK”) and our products and services being offered in the EU and the UK, we are subject to the GDPR, UK GDPR, the UK Data Protection Act 2018, and other similar regional European data protection regulations, all of which impose stringent data protection and cybersecurity requirements, and could increase the risk of non-compliance and the costs of providing our services in a compliant manner.

A wide variety of state, national, and international laws, regulations, and industry standards apply to the collection, use, retention, protection, disclosure, transfer and other processing of personal data and other information, the scope of which are consistently changing, subject to differing interpretations, and may be inconsistent across countries or conflict with other rules.

Data protection and privacy-related laws and regulations are evolving and may result in increasing regulatory and public scrutiny and escalating levels of enforcement and sanctions.

Complying with these various laws and regulations could cause us to incur substantial costs or require us to change our business practices, systems, and compliance procedures in a manner adverse to our business.

For more information on these laws and their impact on our business, see the risk factor “ We are subject to laws and regulations affecting our business, including those related to e-signature, marketing, advertising, privacy, data protection and information security.

Our actual or perceived failure to comply with laws or regulations could harm our business.

Internationally, virtually every jurisdiction in which we operate has established its own data privacy and security legal framework with which we, our customers and partners may need to comply.

For example, in Europe, the General Data Protection Regulation (the “EU GDPR”) contains robust obligations on data controllers and processors and fulsome documentation requirements for data protection compliance programs by companies.

As a result of our presence in Europe and the United Kingdom (“UK”) and our products and services being offered in the EU and the UK, we are subject to the EU GDPR and other similar regional European data privacy and protection regulations (collectively the “GDPR”), all of which impose stringent data protection and cybersecurity requirements, and could increase the risk of non-compliance and the costs of providing our services in a compliant manner.

We are also certified as a Privacy Rights Processor under the Asia-Pacific Economic Cooperation.

A breach of the GDPR, UK GDPR or other such data protection regulations, could result in regulatory investigations, reputational damage, fines and sanctions, orders to cease or change our processing of our data, enforcement notices, or assessment notices (for a compulsory audit).

Such penalties, which may include fines up to the greater of €20 million (£17.5 million) or 4% of global turnover, are in addition to any civil litigation claims by customers and data subjects.

A breach of the GDPR, or other such data protection regulations, could result in regulatory investigations, reputational damage, fines and sanctions, orders to cease or change our processing of our data, enforcement notices, or assessment notices (for a compulsory audit).

Such penalties, which under GDPR may include fines up to the greater of €20 million (£17.5 million) or 4% of global turnover, are in addition to any civil litigation claims by customers and data subjects.

We may also face civil claims including representative actions and other class action-type litigation (where individuals have suffered harm), potentially amounting to significant compensation or damages liabilities, as well as associated costs, diversion of internal resources, and reputational harm.

Additionally, both the GDPR and UK GDPR impose strict rules on the transfer of personal data out of the EU and the UK to a “third country,” or a country whose laws do not ensure an adequate level of data protection safeguards (such as the U.S.).

Additionally, the GDPR imposes strict rules on the transfer of personal data out of the EU or the UK to any country whose laws have not been deemed by regulators in the EU or UK to ensure an “adequate” level of data protection safeguards (such as the U.S.).

These obligations may evolve, be interpreted or applied in a manner that is inconsistent from one jurisdiction to another and may conflict with other requirements or our practices.

3 unchanged sentences

If this adequacy decision is reversed by the European Commission, it would require that companies implement protection measures such as the approved Standard Contractual Clauses for data transfers between the EU and the UK.

DocuSign, Inc.| 2024 Form 10-K | 29

Legal developments in Europe continue to evolve, creating complexity and uncertainty regarding transfers of personal data from the EU and the UK to the U.S.

On June 4, 2021, the European Commission finalized new versions of the Standard Contractual Clauses, with the Implementing Decision now in effect.

The UK Information Commissioner’s Office of the Data Protection Authority published the UK version of the Standard Contractual Clauses, and by March 2024, we will be required to use and honor these clauses for transfers of UK residents’ personal data to a foreign country that does not have adequate data protection.

On July 10, 2023, the European Commission adopted an adequacy decision for the EU-U.S.

Data Privacy Framework (a new cooperative effort between U.S.

and European officials to overcome the security issues raised by the EU-U.S.

Privacy Shield regarding personal transfers from the EU to the U.S.).

In October 2023, the UK ICO adopted the UK-U.S.

data bridge to allow self-certifying companies to effect personal data transfers from the UK to the U.S.

without additional safeguards.

This new Data Privacy Framework could be subject to legal challenge in front of the Court of Justice of the European Union, which had previously invalidated the Privacy Shield.

We currently utilize respective Binding Corporate Rules and Standard Contractual Clauses as the approved data transfer mechanisms by the EU Commission for corresponding applicable data transfer activity.

5 unchanged sentences

In particular, companies in the software industry are often required to defend against litigation claims based on allegations of infringement or other violations of intellectual property rights.

We have from time to time been subject to intellectual property claims and disputes and may be subject to such claims in the future.

We have from time to time been

Docusign, Inc.

| 2025 Form 10-K | 29

subject to intellectual property claims and disputes and may be subject to such claims in the future.

In addition, many of these companies have the capability to dedicate substantially greater resources to enforce their alleged intellectual property rights and to defend claims that may be brought against them.

16 unchanged sentences

However, the steps we take to protect our intellectual property may be inadequate.

While we have

DocuSign, Inc.| 2024 Form 10-K | 30

been issued patents in the U.S.

While we have been issued patents in the U.S.

and other countries and have additional patent applications pending, we may be unable to obtain patent protection for the technology covered in our patent applications.

3 unchanged sentences

Furthermore, legal standards relating to the validity, enforceability and scope of protection of intellectual property rights are uncertain.

Despite our precautions, it may be possible for unauthorized third parties to copy our products and use information that we regard as proprietary to create products and solutions that compete with ours.

Despite our precautions, it may be possible for unauthorized third parties to copy our products or aspects of our platform and use information that we regard as proprietary to create products and solutions that compete with ours.

Some license provisions protecting against unauthorized use, copying, transfer and disclosure of our products may be unenforceable under the laws of jurisdictions outside the U.S.

Additionally, we are unable to predict or assure that rights previously granted by third parties to intellectual property licensed or assigned to us will not hamper our ability to assert our intellectual property rights or hinder the settlement of currently pending or future disputes;

or that any of our pending or future copyright or trademark applications will be issued or have the coverage originally sought.

To the extent we expand our international activities, our exposure to unauthorized copying and use of our products and proprietary information may increase.

We enter into confidentiality and invention assignment agreements with our employees and consultants and enter into confidentiality agreements with the parties with whom we have strategic relationships and business alliances.

No assurance can be given that these agreements will be effective in controlling access to and distribution of our products and proprietary information.

No assurance can be given that these agreements will be effective in controlling access to and distribution of our products and proprietary information or prevent infringement, violation, or misappropriation of our intellectual property.

Further, these agreements do not prevent our competitors or partners from independently developing technologies that are substantially equivalent or superior to our products and solutions.

1 unchanged sentence

Litigation brought to protect and enforce our intellectual property rights could be costly, time consuming and distracting to management and could result in the impairment or loss of portions of our intellectual property.

Furthermore, our efforts to enforce our intellectual property rights may be met with defenses, counterclaims and countersuits attacking the validity and enforceability of our intellectual property rights.

Furthermore, our efforts to enforce our intellectual property rights may be

Docusign, Inc.

| 2025 Form 10-K | 30

met with defenses, counterclaims and countersuits attacking the validity and enforceability of our intellectual property rights.

Our inability to protect our proprietary technology against unauthorized copying or use, as well as any costly litigation or diversion of our management’s attention and resources, could delay further sales or the implementation of our products and solutions, impair the functionality of our products and solutions, delay introductions of new solutions, result in our substituting inferior or more costly technologies into our products and solutions or injure our reputation.

Moreover, there could be public announcements of the results of hearings, motions or other interim proceedings or developments, and if securities analysts or investors perceive these results to be negative, it could have a substantial adverse effect on the price of our common stock.

Any of these results could adversely affect our business, operating results and financial condition.

We will not be able to protect our intellectual property if we are unable to enforce our rights or if we do not detect unauthorized use of our intellectual property.

7 unchanged sentences

If a court or regulatory body determines that our products and solutions are inadequate to meet these requirements, documents executed through our products and solutions could, in some instances, be rendered unenforceable, resulting in potential loss of customers, liability under customer contracts, and brand and reputational damage.

We use AI in our business, and challenges with properly governing its use could result in reputational harm, competitive harm, and legal liability, and adversely affect our results of operations.

We currently use AI-powered tools and services as part of operating our business, and also incorporate AI features and applications into our products and solutions and are making further investments in expanding AI capabilities in our products and solutions.

AI technologies can be complex and are presently rapidly evolving, and while we believe that product features powered by next generation AI technologies, such as generative AI, will help drive the future growth of our business, there is no guarantee that such new product features will ultimately be successful, and our competitors and other third parties may incorporate AI into their products more quickly or more successfully than us, all of which could impair our ability to compete effectively and may adversely affect our results of operations.

DocuSign, Inc.| 2024 Form 10-K | 31

The development and use of AI features and applications present various intellectual property, data privacy, security and reliability risks that may impact our business.

We may choose to significantly invest in the development and maintenance of proprietary datasets and training models, and development of appropriate protections, safeguards, and policies for handling the processing of data with our AI features and applications, which may be costly, subject us to legal liability, and negatively impact our business, financial condition, and results of operations.

Existing laws and regulations may be interpreted, or new laws and regulations regarding AI may be adopted and interpreted, in ways which could negatively affect the way we use AI in our products.

For example, the European Parliament, the European Commission and Council reached a political agreement on December 8, 2023, regarding the EU Artificial Intelligence Act that, once finalized and entered into force, would prohibit certain AI applications and systems with unacceptable risk and impose additional requirements on the use of other high-risk or limited-risk AI applications or systems.

Intellectual property ownership issues, licensing and privacy rights surrounding AI technologies are evolving and have not been fully addressed by U.S.

For example, the U.S.

Federal Trade Commission initiated multiple AI-related inquiries in 2023 and 2024 and sent requests to technology companies, including DocuSign, seeking additional information about their AI usage and policies.

The continued use in our business and incorporation of AI-powered features and applications into our products and solutions may subject us to new and evolving regulatory scrutiny, litigation, social or ethical concerns, or other risks that could harm our business, reputation, brand, and our results of operations.

Additionally, AI technology may involve significant technical complexity, which will require specialized expertise and may increase compensation-related expenses.

We use open source software in our products, which could subject us to litigation or other actions.

2 unchanged sentences

Any use of open source software may involve security risks, making it easier for hackers and other third parties to determine how to compromise our platform.

From time to time, there have been claims challenging the ownership of open source software against companies that incorporate open source software into their products.

On occasion, companies that use open source software have faced claims challenging their use of open source software or compliance with open source license terms.

There is evolving legal precedent for interpreting the terms of certain open source licenses, including the determination of which works are subject to the terms of such licenses.

As a result, we could be subject to lawsuits by parties claiming ownership of what we believe to be open source software.

1 unchanged sentence

In addition, if we were to combine our proprietary software products with open source software in a certain manner, we could, under certain of the open source licenses, be required to release the source code of our proprietary software products.

If we inappropriately use or incorporate open source software subject to certain types of open source licenses that challenge the proprietary nature of our software products, we may be required to re-engineer our products, discontinue the sale of our products and solutions or take other remedial actions.

This would allow our competitors to create similar offerings with lower development effort and time and ultimately could result in a loss of sales for us.

Indemnity provisions in various agreements potentially expose us to substantial liability for intellectual property infringement, data protection and other losses.

Our agreements with some customers and other third parties include indemnification provisions under which we agree to indemnify them for losses suffered or incurred as a result of claims of intellectual property infringement, data protection, damages caused by us to property or persons, or other liabilities relating to or arising from our offerings, solutions or other contractual obligations.

Our agreements with some customers and other third parties include indemnification provisions under which we agree to indemnify them for losses suffered or incurred as a result of claims of intellectual property infringement, data protection, violations, data breaches or cyberattacks, damages caused by us to property or persons, or other liabilities relating to or arising from our offerings, solutions or other contractual obligations.

Some of these indemnity provisions provide for uncapped liability for which we would be responsible, and some indemnity provisions survive termination or expiration of the applicable agreement.

Large indemnity payments could harm our business, operating results and financial condition.

Although we normally contractually limit our liability with respect to such obligations, we may still incur substantial liability related to them and we may be required to cease use of certain functions of our products and solutions as a result of any such claims.

In addition, our customer agreements generally include a warranty that the proper use of DocuSign by a customer in accordance with the agreement and applicable law will be sufficient to meet the definition of an “electronic signature” as defined in the Electronic Signatures in Global and National Commerce Act (“ESIGN Act”) and eIDAS.

Any warranty or

DocuSign, Inc.| 2024 Form 10-K | 32

indemnification claim brought by our customers could result in damage to our reputation and harm our business and operating results.

Although we normally contractually limit our liability with respect to such obligations, such limitations may not be enforceable in all jurisdictions, and we may still incur substantial liability related to them and we may be required to cease use of certain functions of our products and solutions as a result of any such claims.

In addition, our customer agreements generally include a warranty that the proper use of Docusign by a customer in accordance with

Docusign, Inc.

| 2025 Form 10-K | 31

the agreement and applicable law will be sufficient to meet the definition of an “electronic signature” as defined in the Electronic Signatures in Global and National Commerce Act (“ESIGN Act”) and eIDAS.

Any warranty or indemnification claim brought by our customers could result in damage to our reputation and harm our business and operating results.

Changes in tax laws, rulings and interpretations may subject us to potential adverse tax consequences, which could negatively affect our financial position and results of operations.

1 unchanged sentence

and numerous other jurisdictions throughout the world, and the tax regimes we are subject to or operate under, including income and non-income taxes, are unsettled and may be subject to significant change.

The U.S., other jurisdictions or governmental bodies, such as the European Commission of the European Union, and intergovernmental economic organizations, such as the Organization for Economic Cooperation and Development, have made or could make unprecedented assertions about how taxation is determined and, in some cases, have proposed or enacted new laws that are contrary to the way in which rules and regulations have historically been interpreted and applied.

The U.S., other jurisdictions or governmental bodies, such as the European Commission of the European Union, and intergovernmental economic organizations, such as the Organization for Economic Cooperation and Development, have made or could make unprecedented assertions about how taxation is determined and, in some cases, have proposed or enacted new laws that are contrary to the way in which rules or regulations have historically been interpreted and applied.

For example, in 2021, the Organization for Economic Cooperation and Development announced Pillar Two Model Rules defining the global minimum tax, which calls for the taxation of large multinational corporations at a minimum of 15%.

Many non-U.S.

tax jurisdictions have either recently enacted legislation to adopt certain components of the Pillar Two Model Rules beginning in 2024, including the adoption of additional components in later years, or announced their plans to enact legislation in future years.

Our effective tax rate could increase in future years as a result of these changes, which could have an adverse impact on our business and operating results.

Additionally, our corporate structure and associated transfer pricing policies contemplate future growth into international markets, and consider the functions, risks and assets of the various entities involved in the intercompany transactions.

9 unchanged sentences

The Sarbanes-Oxley Act requires, among other things, that we maintain effective disclosure controls and procedures and internal control over financial reporting.

In order to maintain and improve the effectiveness of such controls, we have expended, and anticipate that we will continue to expend, significant resources.

For example, since our IPO, we have hired additional accounting and financial staff with appropriate public company experience and technical accounting knowledge to assist in our compliance efforts.

In order to maintain and improve the effectiveness of such controls, we have expended, and anticipate that we will continue to expend, significant resources, including on accounting and financial staff with appropriate public company experience and technical accounting knowledge to assist in our compliance efforts.

We have incurred and expect to continue to incur significant expenses and devote substantial management effort toward compliance with the auditor attestation requirements of Section 404 of the Sarbanes-Oxley Act.

To assist us in complying with these requirements we may need to hire more employees in the future, or engage outside consultants, which will increase our operating expenses.

Docusign, Inc.

| 2025 Form 10-K | 32

Despite significant investment, our current controls and any new controls that we develop may become inadequate because of changes in business conditions.

Any failure to implement and maintain effective internal control over financial reporting could adversely affect the results of periodic management evaluations and annual independent registered public accounting firm attestation reports regarding the effectiveness of our internal control over financial reporting that are required to be included in the periodic reports that we file with the SEC.

If our management team or independent registered public accounting firm were to furnish an adverse report, or if it is determined that we have a material weakness or significant deficiency in our internal control over financial reporting, investors could lose confidence in the accuracy and completeness of our financial reports, the market price of our common stock could

DocuSign, Inc.| 2024 Form 10-K | 33

decline, and we could be subject to sanctions or investigations by Nasdaq, the SEC or other regulatory authorities or shareholder litigation.

In addition, as we continue to scale and improve our operations, including our internal systems and processes, we currently utilize, and in the future may seek to implement, a variety of critical systems, such as billing, human resource, financial reporting and accounting systems.

The implementation and transition to any new critical system, such as the ERP system we implemented in 2023, may be disruptive to our business if they do not work as planned or if we experience issues related to such implementation or transition, which could have a material adverse effect on our operations and result in compromised internal reporting and processes.

The implementation and transition to any new critical system may be disruptive to our business if they do not work as planned or if we experience issues related to such implementation or transition, which could have a material adverse effect on our operations and result in compromised internal reporting and processes.

Moreover, since most of our employees (including those critical to maintaining an effective system of disclosure controls and internal control over financial reporting) are working and are expected to continue to work for the near term, in either a fully remote or a hybrid environment, risks that we have not contemplated may arise and result in our failure to maintain effective disclosure controls or internal control over financial reporting.

1 unchanged sentence

Our products and solutions are subject to U.S.

export controls, including the Export Administration Regulations and economic sanctions administered by the Office of Foreign Assets Control, and we incorporate encryption technology into certain of our products and solutions.

These encryption products and the underlying technology may be exported outside of the U.S.

5 unchanged sentences

Additionally, sanctions regimes are rapidly changing as a result of regional or global conflicts.

While we take precautions to prevent our products and solutions from being exported in violation of these laws, including obtaining authorizations for our encryption products, implementing IP address blocking and screenings against U.S.

While we take precautions to prevent our products and solutions from being exported in violation of these laws, including obtaining export authorizations, implementing IP address blocking and screenings against U.S.

government and international lists of restricted and prohibited persons, we cannot guarantee that the precautions we take will prevent violations of export control and sanctions laws.

4 unchanged sentences

however, no assurance can be given that our strategic partners will comply with such requirements.

Foreign governments also regulate the import and export of certain encryption and other technology, including import and export licensing requirements, and have enacted, and may in the future enact, sanctions and laws that could limit our ability to distribute our products and solutions or could limit our end-customers’ ability to implement our products and solutions in those countries.

Foreign governments also regulate the import and export of certain encryption and other technology, including import and export licensing requirements, and have enacted, and may in the future enact, sanctions and export control laws that could limit our ability to distribute our products and solutions or could limit our end-customers’ ability to implement our products and solutions in those countries.

Changes in our products and solutions or future changes in export and import regulations may create delays in the introduction of our products and solutions in international markets, prevent our end-customers with international operations from deploying our products and solutions globally or, in some cases, prevent the export or import of our products and solutions to certain countries, governments or persons altogether.

2 unchanged sentences

Any decreased use of our products and solutions or limitation on our ability to export or sell our products and solutions would adversely affect our business, operating results and prospects.

We are subject to anti-corruption, anti-bribery, anti-money laundering, and similar laws, and non-compliance with such laws can subject us to criminal and/or civil liability and harm our business.

Docusign, Inc.

| 2025 Form 10-K | 33

We are subject to anti-corruption, anti-bribe ry, anti-money laundering, and similar laws, and non-compliance with such laws can subject us to criminal and/or civil liability and harm our business.

We are subject to the FCPA, the U.S.

3 unchanged sentences

Bribery Act, and other anti-bribery and anti-money laundering laws in the countries in which we conduct activities.

As we increase our international sales and business and sales to the public sector internationally, we may engage with business partners and third-party intermediaries to market our products and solutions and to obtain necessary permits,

DocuSign, Inc.| 2024 Form 10-K | 34

licenses, and other regulatory approvals.

In addition, we or our third-party intermediaries may have direct or indirect interactions with officials and employees of government agencies or state-owned or affiliated entities.

3 unchanged sentences

Detecting, investigating and resolving actual or alleged violations can require a significant diversion of time, resources and attention from senior management.

In addition, noncompliance with anti-corruption, anti-bribery, or anti-money laundering laws could subject us to whistleblower complaints, investigations, sanctions, settlements, prosecution, other enforcement actions, disgorgement of profits, significant fines, damages, other civil and criminal penalties or injunctions, suspension and/or debarment from contracting with certain persons, the loss of export privileges, reputational harm, adverse media coverage and other collateral consequences.

In addition, noncompliance with anti-corruption, anti-bribery, or anti-money laundering laws could subject us to whistleblower complaints, investigations, sanctions, settlements, prosecution, other enforcement actions, disgorgement of profits, significant fines, damages, other civil and criminal penalties or injunctions, suspension and/or debarment from contracting with certain persons, the loss of export privileges, reputational har m, adverse media coverage and other collateral consequences.

If any subpoenas or investigations are launched, or governmental or other sanctions are imposed, or if we do not prevail in any possible civil or criminal litigation, our business, operating results and financial condition could be materially harmed.

10 unchanged sentences

▪ issuance of research reports by securities analysts, including publishing unfavorable reports;

▪ certain assumptions or perceptions made by our customers or industry and securities analysts related to our IAM platform;

▪ changes in the prices of subscriptions to our products and solutions;

12 unchanged sentences

In the past, companies that have experienced volatility in the market price of their securities have been subject to securities class action litigation.

We have been subject to, and may in the future be, subject to this type of litigation, which could result in substantial costs, divert our management’s attention from our business and adversely affect our business.

If securities or industry analysts do not publish research or publish unfavorable or inaccurate research about our business, our stock price and trading volume could decline.

The trading market for our common stock depends, in part, on the research and reports that securities or industry analysts publish about us or our business.

We do not have any control over these analysts.

If the number of analysts that cover us declines or if analysts do not publish research or reports about our business, delay publishing reports

DocuSign, Inc.| 2024 Form 10-K | 35

about our business or publish negative reports about our business, regardless of accuracy, our stock price and trading volume could decline.

Regardless of accuracy, unfavorable interpretations of our financial information and other public disclosures could have a negative impact on our stock price.

If our financial performance fails to meet analyst estimates or one or more of the analysts who cover us downgrade our common stock or change their opinion of our common stock, our stock price would likely decline.

We have been, and may in the future be, subject to this type of litigation, which could result in substantial costs, divert our management’s

Docusign, Inc.

| 2025 Form 10-K | 34

attention from our business and adversely affect our business.

For more information on our pending legal proceedings, see Item 3.

Legal Proceedings of this Form 10-K.

Anti-takeover provisions in our charter documents and under Delaware law could make an acquisition of our company more difficult, limit attempts by our stockholders to replace or remove our current management and limit the market price of our common stock.

19 unchanged sentences

Our amended and restated certificate of incorporation, however, provides that the U.S.

federal district courts will be the exclusive forum for

DocuSign, Inc.| 2024 Form 10-K | 36

resolving any complaint asserting a cause of action arising under the Securities Act.

federal district courts will be the exclusive forum for resolving any complaint asserting a cause of action arising under the Securities Act.

In December 2018, the Delaware Chancery Court issued an opinion invalidating provisions similar to ours limiting to U.S.

1 unchanged sentence

On March 18, 2020, however, the Delaware Supreme Court reversed the decision of the Delaware Chancery Court and held that such provisions are facially valid.

In light of that recent decision, we announced that we may in the future enforce our Federal Forum Provision.

In light of that recent decision, we announced that we may in the future enforce our Federal

Docusign, Inc.

| 2025 Form 10-K | 35

Forum Provision.

While there can be no assurance that federal courts or other state courts will follow the holding of the Delaware Supreme Court or determine that the Federal Forum Provision should be enforced in a particular case, application of the Federal Forum Provision generally means that suits brought by our stockholders to enforce any duty or liability created by the Securities Act must be brought in federal court and cannot be brought in state court.

7 unchanged sentences

Our operating results may vary based on the impact of changes in our industry or the global economy on us and our existing and prospective customers.

The revenue growth and potential profitability of our business depend on demand for our products and solutions.

The revenue growth and profitability of our business depend on demand for our products and solutions.

Current or future economic and global market uncertainties or downturns could adversely affect our business and operating results.

1 unchanged sentence

Negative conditions in the general economy both in the U.S.

and abroad, including conditions resulting from inflation, changes in interest rates, actual or perceived instability in the global banking sector, gross domestic product growth, financial and credit market fluctuations, political turmoil, natural catastrophes and the effects of climate change, public health crises, regional and global conflicts and terrorist attacks in the U.S., Europe, the Asia Pacific region or elsewhere, could cause a decrease in business investments, including spending on information technology, and negatively affect the growth of our business.

and abroad, including conditions resulting from inflation, changes in interest rates or foreign exchange rates, tariffs and trade policy changes, gross domestic product growth, financial and credit market fluctuations, geopolitical conflict, natural catastrophes and the effects of climate change, public health crises, and terrorist attacks in the U.S., Europe, the Asia Pacific region or elsewhere, could cause a decrease in business investments, including spending on information technology, and negatively affect the growth of our business.

In addition, unfavorable conditions in certain industry sectors could impact customers or partners disproportionately, which could also impact the demand for our products.

5 unchanged sentences

Natural catastrophic events and man-made problems such as power disruptions, computer viruses, data security breaches, regional or global conflicts, and terrorism may disrupt our business.

We rely heavily on our network infrastructure and information technology systems, including our security-related or ERP systems, for our business operations.

We rely heavily on our network infrastructure and information technology systems, including our security-related systems, for our business operations.

A disruption or failure of these systems in the event of online attack, earthquake, fire, terrorist attack, public health crisis, power loss, telecommunications failure or other similar catastrophic event, including as a result of the effects of climate change, could cause system interruptions, delays in accessing our service, reputational harm and loss of critical data or could prevent us from providing our products and solutions to our customers.

A catastrophic event that results in the destruction or disruption of our data centers, or our network infrastructure or information technology systems, including any errors, defects or failures in third-party hardware, could affect our ability to conduct normal business operations and adversely affect our operating results.

DocuSign, Inc.| 2024 Form 10-K | 37

sanctions or other laws and regulations prohibiting or limiting operations in certain jurisdictions, increased risks of potential cyberattacks, related impacts to our customers, or micro- or macro-economic effects on the global economy.

DocuSign, Inc.| 2024 Form 10-K | 38

Additionally, while we believe our exposure from the recent conflicts in Ukraine and the Middle East is limited, we could experience unanticipated disruptions to our business as a result of current or future regional and global conflicts, including sanctions or other laws and regulations prohibiting or limiting operations in certain jurisdictions, increased risks of potential cyberattacks, related impacts to our customers, or micro- or macro-economic effects on the global economy.

Docusign, Inc.

| 2025 Form 10-K | 36

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1A. Risk Factors