What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2024-08-28 compared with 2024-05-29 · 42 added, 37 removed, 532 unchanged (13% of the section changed)

163 unchanged sentences

Additionally, acquisitions of our customers by other companies have led, and could continue to lead, to cancellation of our contracts with those customers, thereby reducing the number of our existing and potential customers.

The use of new and evolving technologies in our offerings at Workday, including AI, may result in reputational harm and increased litigation.

The use of new and evolving technologies in our offerings at Workday, including AI, may result in reputational harm and increased litigation, and adversely affect our operating results.

We are increasingly building AI into Workday’s core and specific offerings.

As with many cutting-edge innovations, these technologies can present new risks and challenges.

A quickly evolving legal and regulatory environment may cause us to incur increased research and development costs, or divert resources from other development efforts, to address social, ethical, and other issues related to AI.

Furthermore, existing laws and regulations may apply to us in new ways, the nature and extent of which are difficult to predict and subject to change over time.

For example, the European Union’s AI Act puts new requirements on providers of AI technologies that will need to be addressed in alignment with various deadlines in the coming years.

Additionally, existing laws and regulations may apply to us in new ways, the nature and extent of which are difficult to predict and subject to change over time.

The risks and challenges presented by these technologies could undermine public confidence in AI, which could slow its adoption and affect our business.

Many of our products are powered by AI, some of which include the use of large language models and generative AI, for use cases that could potentially impact human, civil, privacy, or employment rights and dignities.

Our developers are also experimenting with the use of large language models provided by third parties for domain-specific use cases, and at this stage the line between developers and deployers of these technologies, including their respective responsibilities and liabilities, is unclear.

Our failure to accurately identify and address our responsibilities and liabilities in this uncertain environment, and adequately address relevant ethical and social issues that may arise with such technologies and use cases, as well as failure by others in our industry, or actions taken by our customers, employees, or end users (including misuse of these technologies), could negatively affect the adoption of our solutions and subject us to reputational harm, regulatory action, or litigation, which may harm our financial condition and operating results.

We already are defending against a lawsuit alleging that our products and services enable discrimination, and although we believe that such claims lack merit, and we succeeded in our initial motion to dismiss the claims, legal proceedings can be lengthy, expensive, and disruptive to our operations (particularly where, as in the present litigation, Plaintiff may seek to also litigate against certain of Workday’s customers).

We already are defending against a lawsuit alleging that our products and services enable discrimination, and although we believe that such claims lack merit, and the majority of the claims have been dismissed, legal proceedings can be lengthy, expensive, and disruptive to our operations and customers (particularly where, as in the present litigation, the plaintiff may seek to also litigate against certain of Workday’s customers).

We may be subject to other litigation and regulatory actions that may cause financial, competitive, and developmental impacts, and could lead to legal liability.

In addition, regardless of outcome, these types of claims could cause reputational harm to our brand.

In addition, regardless of outcome, these types of claims could cause reputational harm to our brand, including our ability to sell newly acquired products that use AI.

Our employees, customers, or customers’ employees who are dissatisfied with our public statements, policies, practices, or solutions related to the development and use of AI may express opinions that could introduce reputational or business harm, or cease their relationship with us.

14 unchanged sentences

We believe that developing and maintaining widespread positive awareness of our brand is critical to our growth.

However, brand promotion activities may not generate the customer awareness or increased revenues we anticipate, and even if they do, any increase in revenues may not offset the significant expenses we incur in building our brand.

However, brand promotion activities may not generate the awareness or increased revenues we anticipate, and even if they do, any increase in revenues may not offset the significant expenses we incur in building our brand.

If we fail to successfully promote and maintain positive awareness of our brand, or we fail to expand positive awareness of our newer solutions or products, we may fail to attract or retain customers necessary to realize a sufficient return on our brand-building efforts, or to achieve the widespread positive brand awareness that is critical for broad customer adoption of our applications and for the end user experience.

25 unchanged sentences

• adverse effects on our brand or existing business relationships with business partners and customers as a result of the acquisition, including integrating acquired technologies and a delay in market acceptance of and difficulty in transitioning new and existing customers to acquired product lines or services;

• risks and challenges presented by the use of innovative technologies that we acquire, such as AI;

• potential write-offs of acquired assets and potential financial and credit risks associated with acquired customers;

20 unchanged sentences

Catastrophic or climate-related events may disrupt our business.

Our corporate headquarters are located in Pleasanton, California, and we have data centers located in the United States, Canada, and Europe.

Our corporate headquarters are located in Pleasanton, California, and we have data centers located in North America and Europe.

The west coast of the United States contains active earthquake zones and the southeast is subject to seasonal hurricanes or other extreme weather conditions.

24 unchanged sentences

If our information technology systems are compromised or unauthorized access to customer or user data is otherwise obtained, our applications may be perceived as not being secure, our operations may be disrupted, our applications may become unavailable, customers and end users may reduce the use of or stop using our applications, and we may incur significant liabilities.

Our applications involve the storage and transmission of our customers’ and other users’ sensitive and proprietary information, including personal or identifying information regarding our customers, their employees, job candidates, customers, prospectus, and suppliers, as well as financial, accounting, health, and payroll data.

Our applications involve the storage and transmission of our customers’ and other users’ sensitive and proprietary information, including personal or identifying information regarding our customers, their employees, job candidates, customers, prospects, and suppliers, as well as financial, accounting, health, and payroll data.

Additionally, our operations and the availability of the services we provide also depend on our information technology systems.

10 unchanged sentences

As our market presence grows, we face increased risks of cybersecurity attack or other security threats.

Additionally, as AI technologies, including generative AI models, develop rapidly, threat actors are using these technologies to create sophisticated new attack methods that are increasingly automated, targeted, and coordinated and more difficult to defend against.

Key cybersecurity risks range from viruses, worms, ransomware, and other malicious software programs, to phishing attacks, to credential theft or abuse, to exploitation of software bugs or other defects, to targeted attacks against cloud services and other hosted software, to exploitation of unmanaged software or systems, any of which can result in a compromise of our applications or systems and the data we store or process, disclosure of Workday confidential information and intellectual property, production downtimes, reputational harm, and an increase in costs to the business.

10 unchanged sentences

Any or all of these issues could negatively affect our ability to attract new customers, cause existing customers to elect to terminate or not renew their subscriptions, result in reputational damage, cause us to pay remediation and indemnity costs and/or issue service credits or refunds to customers for prepaid and unused subscription services, or result in lawsuits, regulatory fines, or other action or liabilities, any of which could adversely affect our business and operating results.

We rely on sophisticated information systems and technology, including those provided by third parties, for the secure collection, processing, transmission, storage of confidential, proprietary, and personal information, and to support our business operations and the availability of our applications.

We rely on sophisticated information systems and technology, including those provided by third parties, for the secure collection, processing, transmission, and storage of confidential, proprietary, and personal information, and to support our business operations and the availability of our applications.

In the past several years, supply chain attacks have increased in frequency and severity.

As we are both a provider and consumer of information systems and technology, we are at higher risk of being impacted either directly or indirectly by these attacks.

The control systems, cybersecurity program, infrastructure, physical facilities of, and personnel associated with third parties that we rely on are beyond our control.

The control systems, cybersecurity program, infrastructure, physical facilities of, and personnel associated with third parties that we rely on or partner with are beyond our control.

Our customers may authorize third-party technology providers to access their customer data and any unauthorized use of the third-party technology may result in unauthorized access to such data.

The audits we periodically conduct of some of our third-party vendors do not guarantee the security of and may be unable to prevent security events impacting the information technology systems of third parties that are part of our supply chain or that provide valuable services to us, which have resulted and could result in the unauthorized access to data of Workday, our employees, our customers, our third-party partners, or other end users;

3 unchanged sentences

Privacy concerns, evolving regulation of cloud computing, cross-border data transfer, and other domestic or foreign laws and regulations may reduce the adoption of our applications, result in significant costs and compliance challenges, and adversely affect our business and operating results.

Legal requirements related to collecting, storing, handling, and transferring personal data are rapidly evolving at both the national and international level in ways that require our business to adapt to support customer compliance.

As the regulatory focus on privacy intensifies worldwide, and jurisdictions increasingly consider and adopt privacy laws, the potential risks related to managing personal data by our business may grow.

Legal requirements related to collecting, storing, handling, retaining, and transferring (collectively, “processing”) personal data are rapidly evolving at both the national and international level in ways that require our business to adapt to support customer compliance.

As the complexity of our products grow, the regulatory focus on privacy intensifies worldwide, and jurisdictions increasingly consider and adopt privacy laws, the risks related to processing personal data by our business also grow.

In addition, possible adverse interpretations of existing privacy-related laws and regulations by governments in countries where our customers operate, as well as the potential implementation of new legislation, could impose significant obligations in areas affecting our business or prevent us from offering certain services in jurisdictions where we operate.

Following the European Union’s (“EU”) passage of the General Data Protection Regulation (“GDPR”), which became effective in May 2018, the global data privacy compliance landscape has grown increasingly complex, fragmented, and financially relevant to business operations.

As a result, our business faces current and prospective risks related to increased regulatory compliance costs, government enforcement actions and/or financial penalties for non-compliance, and reputational harm.

As a result, our data processing creates current and prospective risks related to increased regulatory compliance costs, government enforcement actions and/or financial penalties for non-compliance, and reputational harm.

For example, a new EU-U.S.

14 unchanged sentences

Taken together, the costs of compliance with and other obligations imposed by data protection laws and regulations may require modification of our services, limit use and adoption of our services, reduce overall demand for our services, lead to significant fines, penalties, or liabilities for noncompliance, or slow the pace at which we close sales transactions, or otherwise cause us to modify our operations, any of which could harm our business.

The data protection laws set forth requirements impacting how personal data must be stored, accessed, and deleted within the products.

The perception of privacy concerns, whether or not valid, may inhibit the adoption, effectiveness, or use of our applications or otherwise impact our business.

28 unchanged sentences

Some of our applications include software covered by open source licenses, which may include, by way of example, GNU General Public License and the Apache License.

The terms of various open source licenses have not been interpreted by United States courts, and there is a risk that such licenses could be construed in a manner that imposes unanticipated conditions or restrictions on our ability to market our applications.

We attempt to avoid adverse licensing conditions in our use of open source software in our products and services.

Few terms used in open source licenses have been interpreted by United States courts, and there is a risk that such licenses could be construed in a manner that imposes unanticipated conditions or restrictions on our ability to market our applications.

We attempt to comply with all open source licensing conditions that apply to our use of open source software.

By the terms of certain open source licenses, we could be required to release the source code of our proprietary software, and to make our proprietary software available under open source licenses, if we combine our proprietary software with open source software in a certain manner.

In the event that portions of our proprietary software are determined to be impacted by an open source license, we could be required to publicly release the affected portions of our source code, re-engineer all or a portion of our technologies, or otherwise be limited in the licensing of our technologies, each of which could reduce or eliminate the value of our technologies and services.

In addition, the open source license terms for future versions of open source software that we use might change, requiring us to pay for a commercial license or re-engineer all or a portion of our technologies.

In addition to risks related to license requirements, usage of open source software can lead to greater risks than use of third-party commercial software, as open source licensors generally do not provide warranties or controls on the origin of the software.

In the event that portions of our proprietary software are determined to be impacted by an open source license, we could be required to publicly release portions of our source code, re-engineer all or a portion of our technologies, or otherwise be limited in the use or licensing of our technologies, which could reduce or eliminate the value of our technologies, products, and services.

In addition, the license terms for certain previously open source software that we use have changed and the license terms for future versions of open source software that we use might change, requiring us to pay for a commercial license or re-engineer all or a portion of our technologies.

In addition to risks related to open source license requirements, usage of open source software can lead to greater risks than use of third-party commercial software, as open source licensors generally do not provide warranties or controls on the origin of the software.

Many of the risks associated with usage of open source software cannot be eliminated and could negatively affect our business.

Risks Related to Legal and Regulatory Matters

Unfavorable laws, regulations, interpretive positions, or standards governing new and evolving technologies that we incorporate into our products and services could result in significant cost and compliance challenges and adversely affect our business and operating results.

Unfavorable laws, regulations, interpretive positions, or standards governing new and evolving technologies that we incorporate into our products and services, including those involving AI uses, could result in significant cost and compliance challenges and adversely affect our business and operating results.

Some of our products and services, such as Workday’s People Experience, Talent Optimization, and Financial product suites, currently utilize or will utilize new and evolving technologies such as AI.

2 unchanged sentences

Governments and agencies domestic and abroad may in the future change or amend existing laws, or adopt new laws, regulations, or guidance, or take other actions which may severely impact the permitted uses of our technologies.

For example, the technologies underlying AI and its uses are subject to a variety of laws and regulations, including those governing intellectual property, privacy, data protection cybersecurity, consumer protection, competition, and equal opportunity, and are expected to be subject to new laws and regulations or new applications of existing laws and regulations.

AI is the subject of ongoing review by various U.S.

governmental and regulatory agencies, and various U.S.

states and other foreign jurisdictions are applying, or are considering applying, their cybersecurity and data protection laws to AI and its uses or are considering general legal frameworks for AI and its uses, such as the EU AI Act.

Any failure by us to comply with applicable laws, regulations, guidance, or other rules could result in costly litigation, penalties, or fines.

10 unchanged sentences

We are subject to risks related to government contracts and related procurement regulations, which may adversely impact our business and operating results.

Our contracts with federal, state, local, and foreign government entities are subject to various procurement regulations and other requirements relating to their formation, administration, performance, and termination, which could adversely impact our business and operating results.

Our contracts with federal, state, local, and foreign government entities are subject to various procurement regulations and other requirements relating to their formation, administration, and performance, which could adversely impact our business and operating results.

Government certification requirements applicable to our platform, including FedRAMP, may change and, in doing so, restrict our ability to sell into the governmental sector until we have attained the full or revised certification.

These laws and regulations provide public sector customers various rights, many of which are not typically found in commercial contracts.

For instance, the process of evaluating potential conflicts of interest and developing necessary provisions and contract clauses, where needed, may delay or prevent Workday from being awarded certain U.S.

federal government contracts.

These laws and regulations provide public sector customers various with rights, many of which are not typically found in commercial contracts.

For example, some federal contracts provide for delays, interruptions, or termination by the government at any time, with or without cause, which can adversely affect our business and operating results and impact other existing or prospective government contracts.

Additionally, we have obtained authorization under FedRAMP, which allows us to enter into the U.S.

federal government market.

Such certification is subject to rigorous compliance and if we lose our certification, it could inhibit or preclude our ability to contract with certain U.S.

Such authorization is subject to rigorous compliance and if we were to lose our authorization, it could inhibit or preclude our ability to contract with certain U.S.

federal government customers.

In addition, some customers may rely on our authorization under FedRAMP to help satisfy their own legal and regulatory compliance requirements and our failure to maintain FedRAMP authorization would result in a breach under public sector contracts obtained on the basis of such authorization.

In addition, some customers may rely on our authorization under FedRAMP to help satisfy their own legal and regulatory compliance requirements and our failure to maintain FedRAMP authorization may result in a breach under public sector contracts obtained on the basis of such authorization.

This could subject us to liability, result in reputational harm, and adversely impact our financial condition or operating results.

We may be subject to audits and investigations relating to our government contracts, and any violations could result in various civil and criminal penalties and administrative sanctions, including termination of contracts, refunding or suspending of payments, forfeiture of profits, payment of fines, and suspension or debarment from future government business.

In addition, such contracts may provide for delays, interruptions, or termination by the government at any time, with or without cause, which may adversely affect our business and operating results and impact other existing or prospective government contracts.

We may be subject to additional audits and investigations relating to our government contracts, and any violations could result in various civil and criminal penalties and administrative sanctions, including termination of contracts, refunding or suspending of payments, forfeiture of profits, payment of fines, and suspension or debarment from future government business.

Unanticipated tax laws or any change in the application of existing tax laws to us or our customers and unanticipated changes in our effective tax rate may adversely impact our profitability and financial results.

16 unchanged sentences

Additionally, because much of our sales efforts are targeted at large enterprise customers, we may face greater costs, longer sales cycles, less predictability in completing some of our sales, and varying deployment timeframes.

Our typical sales cycles for new customers are six to twelve months but can extend for eighteen months or more, and we expect that this lengthy sales cycle may continue or expand as customers increasingly adopt applications across our platform.

Our typical sales cycles for many new customers are six to twelve months but can extend for eighteen months or more, and we expect that this lengthy sales cycle may continue or expand as customers increasingly adopt applications across our platform.

We have seen and may continue to see instances of increased scrutiny from existing and prospective customers and the lengthening of certain sales cycles.

17 unchanged sentences

Additionally, in April 2022, we entered into a 2022 Credit Agreement which provides for a revolving credit facility in an aggregate principal amount of $1.0 billion.

As of April 30, 2024, we had no outstanding revolving loans under the 2022 Credit Agreement.

As of July 31, 2024, we had no outstanding revolving loans under the 2022 Credit Agreement.

We may incur substantial additional debt in the future, some of which may be secured debt.

37 unchanged sentences

Our Co-Founders have control over key decision making as a result of their control of a majority of our voting stock.

As of April 30, 2024, our Co-Founder and CEO Emeritus David Duffield, together with his affiliates, held voting rights with respect to approximately 44 million shares of Class B common stock and 1 million shares of Class A common stock.

As of April 30, 2024, our Co-Founder and Executive Chair, Aneel Bhusri, together with his affiliates, held voting rights with respect to approximately 8 million shares of Class B common stock and 0.4 million shares of Class A common stock.

As of July 31, 2024, our Co-Founder and CEO Emeritus David Duffield, together with his affiliates, held voting rights with respect to approximately 43 million shares of Class B common stock and 1 million shares of Class A common stock.

As of July 31, 2024, our Co-Founder and Executive Chair, Aneel Bhusri, together with his affiliates, held voting rights with respect to approximately 8 million shares of Class B common stock and 0.4 million shares of Class A common stock.

In addition, Mr.

15 unchanged sentences

Our Class B common stock has 10 votes per share and our Class A common stock, which is the stock that is publicly traded, has one vote per share.

Stockholders who hold shares of Class B common stock, including our executive officers, directors, and other affiliates, together hold a substantial majority of the voting power of our outstanding capital stock as of April 30, 2024.

Because of the ten-to-one voting ratio between our Class B and Class A common stock, the holders of our Class B common stock collectively will continue to control a majority of the combined voting power of our common stock and therefore be able to control all matters submitted to our stockholders for approval until the conversion of all shares of all Class A and Class B shares to a single class of common stock on the date that is the first to occur of (i) October 17, 2032, (ii) such time as the shares of Class B common stock represent less than 9% of the outstanding Class A and Class B common stock, (iii) nine months following the death of both Mr.

27 unchanged sentences

We may not realize the anticipated long-term stockholder value of our share repurchase programs.

In November 2022, our Board of Directors authorized a program under which we were authorized to repurchase up to $500 million of our outstanding shares of Class A common stock.

As of April 30, 2024, we had completed the repurchase authorization under this program.

In February 2024, the Board of Directors authorized the 2024 Share Repurchase Program under which we may repurchase up to an additional $500 million of our Class A common stock.

The 2024 Share Repurchase Program has a term of 18 months, but the program may be modified, suspended, or terminated at any time.

In February 2024, the Board of Directors authorized the February 2024 Share Repurchase Program under which we may repurchase up to $500 million of our Class A common stock, and in August 2024, the Board of Directors authorized the August 2024 Share Repurchase Program under which we may repurchase up to an additional $1.0 billion of our Class A common stock.

The February 2024 Share Repurchase Program has a term of 18 months and the August 2024 Share Repurchase Program has no expiration date, but the programs may be modified, suspended, or terminated at any time.

Such repurchases may be made through open market transactions, including through the use of trading plans intended to qualify under Rule 10b5-1, through privately negotiated transactions, or by other means, in accordance with applicable securities laws and other restrictions.

45 unchanged sentences

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-Q

Item 1A. Risk Factors