What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2025-03-11 compared with 2024-03-08 · 114 added, 90 removed, 476 unchanged (30% of the section changed)

36 unchanged sentences

These problems may be caused by a variety of factors, including infrastructure and software or code changes, vendor issues, software and system defects, human error, viruses, worms, security attacks (internal and external), fraud, spikes in customer usage, and denial of service issues.

All of these issues may result in increased operational costs, delays in new feature rollouts, customer loss, reputational damage, and legal or regulatory liability, including liability under customer contracts or for losses suffered by our customers.

Such issues have, and may in the future, result in certain parties having unauthorized access to data.

For example, in November 2023, we discovered that an issue in our product affecting certain customers resulted in document notifications and PDF documents being sent to unintended recipients within the same organization.

Such issues have, and may in the future, result in certain parties having unauthorized access to data, which could increase the scope of our liability.

Because of the large amount of data that we collect and process in our systems, and the sensitive nature of such data, it is possible that these issues could result in significant disruption, data loss or corruption, or cause the data to be incomplete or contain inaccuracies that our customers and other users regard as significant.

Furthermore, our financial management application is essential to our and our customers’ financial planning, reporting, and compliance programs.

Furthermore, our applications are essential to many of the business processes for our customers.

For example, our financial management application is essential to our and our customers’ financial planning, reporting, and compliance programs.

Any interruption in our service may affect the availability, accuracy, or timeliness of such programs and as a result could damage our reputation, cause our customers to terminate their use of our applications, require us to issue refunds for prepaid and unused subscription services, require us to compensate our customers for certain losses, and prevent us from gaining additional business from current or future customers.

1 unchanged sentence

Our insurance policies, including our errors and omissions insurance, may be inadequate or may not be available in the future on acceptable terms, or at all, to protect against claims and other legal actions arising from breaches of our contracts, disruptions in our service, including those caused by cybersecurity incidents, failures or disruptions to our infrastructure, catastrophic events and disasters, or otherwise.

In addition, our policy may not cover all claims made against us and defending a suit, regardless of its merit, could be costly and divert management’s attention.

In addition, our policy may not cover all claims made against us and defending a suit, regardless of its merit, could be costly.

We depend on data centers and other infrastructure operated by third parties, as well as internet availability, and any disruption in these operations could adversely affect our business and operating results.

We host our applications and serve our customers and users globally from data centers operated by third parties and rely upon third-party hosted infrastructure partners to operate certain aspects of our services.

We host our applications and serve our customers and users globally from data centers operated by third parties and rely upon third-party partners to operate certain aspects of our services.

We control our applications and data, but we do not control the facilities, operations, and physical security of these locations.

Disruption of or interference at our data centers or hosted infrastructure partners has and could in the future impact our operations and our business could be adversely impacted.

Disruption of or interference at these locations has and could in the future impact our operations and our business could be adversely impacted.

For example, we have experienced disruptions at certain of our data centers in the U.S.

due to high temperatures and power outages that resulted in a brief temporary outage of our services for a subset of our customers.

Our data center and hosted infrastructure partner facilities may also be subject to cybersecurity breaches, capacity constraints, financial difficulties, break-ins, sabotage, intentional acts of vandalism and similar misconduct, natural catastrophic events, as well as local administrative actions, changes to legal or permitting requirements, and litigation to stop, limit, or delay operations.

These facilities may also be subject to cybersecurity breaches, capacity constraints, financial difficulties, break-ins, sabotage, intentional acts of vandalism and similar misconduct, natural catastrophic events, as well as local administrative actions, changes to legal or permitting requirements, and litigation to stop, limit, or delay operations, and our disaster recovery planning may not account for all eventualities.

Furthermore, our customers and other users access our applications through their internet service providers.

1 unchanged sentence

In addition, certain countries have implemented or may implement legislative and technological actions that either do or can effectively regulate access to the internet, including the ability of internet service providers to limit access to specific websites or content.

Any changes in third-party service levels at data centers or at our hosted infrastructure partners, or any errors, defects, disruptions, or other performance problems with our applications or the infrastructure on which they run, including internet infrastructure, could adversely affect our reputation and may damage our customers’ or other users’ stored files or result in lengthy interruptions in our services.

Any changes in third-party service levels at our hosted infrastructure providers, or any errors, defects, disruptions, or other performance problems with our applications or the infrastructure on which they run, including internet infrastructure, could adversely affect our reputation and may damage our customers’ or other users’ stored files or result in lengthy interruptions in our services.

Interruptions in our services might adversely affect our reputation and operating results, cause us to issue refunds or service credits to customers, subject us to potential liabilities, result in contract terminations, or adversely affect our renewal rates.

1 unchanged sentence

We operate on a global scale, and as a result, our business and revenues are impacted by global economic and geopolitical conditions.

Global economic developments, geopolitical volatilities, downturns or recessions, and global health crises may negatively affect us or our ability to accurately forecast and plan our future business activity.

In addition, geopolitical volatilities, including the Russia-Ukraine and Israel-Hamas conflicts, have led and could lead to further economic disruption.

Global economic developments, including increased tariffs, geopolitical volatilities, downturns or recessions, political instability, and global health crises may negatively affect us or our ability to accurately forecast and plan our future business activity.

In addition, volatile geopolitical situations have led and could lead to further economic disruption.

Any sustained adverse impacts from these and other recent macroeconomic events could materially and adversely affect our business, financial condition, operating results, and earnings guidance that we may issue from time to time, which could have a material effect on the value of our Class A common stock.

3 unchanged sentences

To the extent recent macroeconomic events adversely affect our business, financial condition, and operating results, it may also have the effect of heightening many of the other risks described in this “Risk Factors” section.

We may lose key employees or be unable to attract, train, and retain highly skilled employees.

We may lose key employees or be unable to attract, enable, and retain highly skilled employees.

Our success and future growth depend largely upon the continued services of our executive officers, other members of senior management, and other key employees.

1 unchanged sentence

Bhusri, assumed the role of sole CEO.

We do not have employment agreements with our executive officers or other key personnel that require them to continue to work for us for any specified period, and they could terminate their employment with us at any time.

We do not have employment agreements with our executive officers or other key employees that require them to continue to work for us for any specified period, and they could terminate their employment with us at any time.

Key employee changes have the potential to disrupt our business, impact our ability to preserve our culture, negatively affect our ability to attract and retain talent, or otherwise have a serious adverse effect on our business and operating results.

To execute our growth plan, we must attract, enable, and develop highly qualified talent.

Our ability to compete and succeed in a highly competitive environment is directly correlated to our ability to recruit and retain highly skilled employees, especially in the areas of product development, cybersecurity, senior sales executives, and engineers with significant experience in designing and developing software and internet-related services, including in the areas of AI.

To execute our growth plan, we must attract, enable, develop, and retain highly qualified talent.

The expansion of our sales infrastructure, both domestically and internationally, is necessary to grow our customer base and business.

1 unchanged sentence

We have experienced, and we expect to continue to experience, significant competition in hiring and retaining employees with appropriate qualifications.

We must also continue to retain and motivate existing employees through our compensation practices, company culture, and career development opportunities.

Further, our current and future office environments, such as our current hybrid work policies, may not meet the expectations of our employees or prospective employees, and may amplify challenges in recruiting.

In February 2025, we announced the Fiscal 2026 Restructuring Plan, which is intended to prioritize our investments and advance our growth and is currently expected to result in the reduction of approximately 8% of our workforce.

We expect this plan to be substantially complete by the second quarter of fiscal 2026, subject to local law and consultation requirements.

The Fiscal 2026 Restructuring Plan could negatively impact our ability to attract, retain, and motivate employees.

We must also continue to retain, develop, and motivate existing employees through our compensation practices, company culture, and career development opportunities.

Further, our current and future office environments and our current hybrid work policy may not meet the expectations of our employees or prospective employees, and may amplify challenges in recruiting and retention.

We believe that a critical component of our success has been our corporate culture and our core values.

As we continue to grow and change, we may find it difficult to maintain our corporate culture among a larger number of employees who are dispersed throughout various geographic regions.

Additionally, we and many of our stakeholders expect to have a corporate culture that embraces diversity and inclusion, and any inability to attract and retain diverse and qualified personnel may harm our corporate culture and our ability to innovate.

Failure to maintain or adapt our culture could negatively affect our ability to attract new personnel or to retain our current personnel and our business and future growth prospects could be adversely affected.

As we continue to grow and change, we may find it difficult to maintain our corporate culture among a larger number of employees who are dispersed throughout various geographic regions, including managing the complexities of communicating with all employees.

Efforts to restructure our workforce, such as the Fiscal 2026 Restructuring Plan, may be disruptive and adversely impact employee morale or our corporate culture.

Failure to maintain or adapt our culture could negatively affect our ability to attract new employees or to retain our current employees and our business and future growth prospects could be adversely affected.

The markets in which we participate are intensely competitive, and if we do not compete effectively, our operating results could be adversely affected.

The markets for enterprise cloud applications are highly competitive, with relatively low barriers to entry for some applications or services.

The markets for enterprise cloud applications, including AI-powered solutions, are highly competitive, with relatively low barriers to entry for some applications or services.

Some of our competitors are larger and have greater name recognition, significantly longer operating histories, access to larger customer bases, larger marketing budgets, and significantly greater resources to devote to the development, promotion, and sale of their products and services than we do.

2 unchanged sentences

Some customers may be hesitant to switch vendors or to adopt cloud applications such as ours and may prefer to maintain their existing relationships with competitors.

We also face competition from other enterprise software vendors, from regional competitors that only operate in certain geographic markets, and from vendors of specific applications that address only one or a portion of our applications, some of which offer cloud-based solutions.

These vendors include, without limitation:

Anaplan, Inc., ADP, Coupa Software Inc., Dayforce, Inc., Infor, Inc., Microsoft Corporation, and UKG Inc.

In order to take advantage of customer demand for cloud applications, legacy vendors are expanding their cloud applications through acquisitions, strategic alliances, and organic development.

In addition, other cloud companies that provide services in different target markets or industries may develop applications or acquire companies that operate in our target markets or industries, and some potential customers may elect to develop their own internal applications.

As the market matures and as existing and new market participants introduce new types of technologies and different approaches that enable organizations to address their HCM and financial needs, we expect this competition to intensify in the future.

In order to take advantage of customer demand for cloud and AI-powered applications, legacy vendors are expanding their cloud or AI-powered applications through acquisitions, strategic alliances, and organic development.

In addition, other cloud or AI platform companies that provide services in different target markets or industries may develop applications or acquire companies that operate in our target markets or industries, and some potential customers may elect to develop their own internal applications.

As the market matures and as existing and new market participants introduce new types of technologies, such as generative and agentic AI, and different approaches that enable organizations to address their HCM and financial needs, we expect this competition to intensify in the future.

Furthermore, our current or potential competitors may be acquired by, or merge with, third parties with greater available resources and the ability to initiate or withstand substantial price competition.

35 unchanged sentences

• restrictive governmental actions focused on cross-border trade, such as import and export restrictions, duties, quotas, tariffs, trade disputes, and barriers or sanctions, that may prevent us from offering certain portions of our products or services to a particular market, may increase our operating costs or may subject us to monetary fines or penalties;

• compliance challenges related to the complexity of multiple, conflicting, and changing governmental laws and regulations, including employment, tax, privacy, intellectual property, and data protection laws and regulations;

• increased compliance costs related to government regulatory reviews or audits, including those related to international cybersecurity and environmental, social, and governance (“ESG”) requirements;

4 unchanged sentences

• unstable economic and political conditions.

Any of the above factors may negatively impact our ability to sell our applications and offer services globally, reduce our competitive position in foreign markets, increase our costs of global operations, reduce demand for our applications and services from global customers, or subject us to legal or regulatory liability.

Certain of the above factors have and may continue to negatively impact our ability to sell our applications and offer services globally, reduce our competitive position in foreign markets, increase our costs of global operations, reduce demand for our applications and services from global customers, or subject us to legal or regulatory liability.

Additionally, the majority of our international costs are denominated in local currencies and we anticipate that over time an increasing portion of our sales contracts may be outside the U.S.

15 unchanged sentences

Our customers have no obligation to renew their subscriptions for our applications after the expiration of either the initial or renewed subscription period.

Our customers’ renewal rates may decline or fluctuate as a result of a number of factors, including their level of satisfaction with our applications and pricing, their awareness and adoption of the benefits and features of our applications, their ability to continue their operations and spending levels, reductions in their headcount, and the evolution of their business.

Our customers’ renewal rates fluctuate as a result of a number of factors, including their level of satisfaction with our applications and pricing, their awareness and adoption of the benefits and features of our applications, their ability to continue their operations and spending levels, reductions in their headcount, and the evolution of their business.

If our customers do not renew their subscriptions for our applications on similar pricing terms or renew for fewer elements of our applications, our revenues may decline, and we may not be able to meet our revenue projections, which could negatively impact our business and the market price of our Class A common stock.

Our future success also depends, in part, on our ability to sell additional products to our current customers, and the success rate of such endeavors is difficult to predict, especially with regard to any new lines of business that we may introduce from time to time.

This may require increasingly costly marketing and sales efforts that are targeted at senior management, and if these efforts are not successful, our business and operating results may suffer.

This has and may continue to require increasingly costly marketing and sales efforts that are targeted at senior management, and if these efforts are not successful, our business and operating results may suffer.

Additionally, acquisitions of our customers by other companies have led, and could continue to lead, to cancellation of our contracts with those customers, thereby reducing the number of our existing and potential customers.

The use of new and evolving technologies in our offerings at Workday, including AI, may result in reputational harm and increased litigation.

We are increasingly building AI into Workday’s core and specific offerings.

The use of new and evolving technologies in our offerings at Workday, including AI, may result in reputational harm and increased litigation, and adversely affect our operating results.

We are increasingly building AI into the Workday product suite and have recently made announcements about our plans to embrace agentic AI.

As with many cutting-edge innovations, these technologies can present new risks and challenges.

A quickly evolving legal and regulatory environment may cause us to incur increased research and development costs, or divert resources from other development efforts, to address social, ethical, and other issues related to AI.

Furthermore, existing laws and regulations may apply to us in new ways, the nature and extent of which are difficult to predict and subject to change over time.

A quickly evolving technical, legal, and regulatory environment may cause us to incur increased research and development costs, or divert resources from other development efforts, to address ethical, legal, operational, or compliance requirements or other issues related to AI.

For example, the European Union’s (“EU”) AI Act (“EU AI Act”) puts new requirements on providers of AI technologies and we are currently analyzing the EU AI Act to ensure compliance in alignment with various deadlines in the coming years.

Additionally, existing laws and regulations may apply to us in new ways, the nature and extent of which are difficult to predict and subject to change over time.

The risks and challenges presented by these technologies could undermine public confidence in AI, which could slow its adoption and affect our business.

Many of our products are powered by AI, some of which include the use of large language models and generative AI, for use cases that could potentially impact human, civil, privacy, or employment rights and dignities.

Our developers are also experimenting with the use of large language models provided by third parties for domain-specific use cases, and at this stage the line between developers and deployers of these technologies, including their respective responsibilities and liabilities, is unclear.

Our failure to accurately identify and address our responsibilities and liabilities in this uncertain environment, and adequately address relevant ethical and social issues that may arise with such technologies and use cases, as well as failure by others in our industry, or actions taken by our customers, employees, or end users (including misuse of these technologies), could negatively affect the adoption of our solutions and subject us to reputational harm, regulatory action, or litigation, which may harm our financial condition and operating results.

We already are defending against a lawsuit alleging that our products and services enable discrimination, and although we believe that such claims lack merit, and we succeeded in our initial motion to dismiss the claims, legal proceedings can be lengthy, expensive, and disruptive to our operations (particularly where, as in the present litigation, Plaintiff may seek to also litigate against certain of Workday’s customers).

To the extent that our products and technologies rely on the use of large language models provided by third parties, we may face additional uncertainties and liabilities.

Any failure to accurately identify and address our responsibilities and liabilities in this uncertain environment, and adequately address relevant ethical and social issues that may arise with such technologies and use cases, as well as failure by others in our industry, or actions taken by our customers, employees, or end users (including misuse of these technologies), could negatively affect the adoption of our offerings and subject us to reputational harm, regulatory action, or litigation, which may harm our financial condition and operating results.

We already are defending against a lawsuit alleging that our products and services enable discrimination, and although we believe that such claims lack merit, and the majority of the claims have been dismissed, legal proceedings can be lengthy, expensive, and disruptive to our operations and customers (particularly where, as in the present litigation, the plaintiff may seek to also litigate against certain of Workday’s customers).

We may be subject to other litigation and regulatory actions that may cause financial, competitive, and developmental impacts, and could lead to legal liability.

In addition, regardless of outcome, these types of claims could cause reputational harm to our brand.

In addition, regardless of outcome, these types of claims could cause reputational harm to our brand, including our ability to sell newly acquired products that use AI.

Our employees, customers, or customers’ employees who are dissatisfied with our public statements, policies, practices, or solutions related to the development and use of AI may express opinions that could introduce reputational or business harm, or cease their relationship with us.

7 unchanged sentences

If we are not able to realize a return on our current development efforts or offer new features, enhancements, and modifications to our services that are desired by current or potential customers, our business and operating results could be adversely affected.

Developing software applications and related enhancements, features, and modifications is expensive, and the investment in product development often involves a long return on investment cycle.

Developing software applications and related enhancements, features, and modifications, including those involving AI, is expensive, and the investment in product development often involves a long return on investment cycle.

Accelerated application introductions and short application life cycles require high levels of expenditures that could adversely affect our operating results if not offset by revenue increases, and we believe that we must continue to dedicate a significant amount of resources to our development efforts to maintain our competitive position.

1 unchanged sentence

If we are unable to provide new features, enhancements to user experience, and modifications in a timely and cost-effective manner that achieve market acceptance, align with customer expectations, and that keep pace with rapid technological developments and changing regulatory landscapes, it may negatively impact our customer renewal rates, limit the market for our solutions, or impair our ability to attract new customers and our business and operating results could be adversely affected.

For example, AI is propelling advancements in technology, but if we fail to innovate and keep up with advancements in AI technology, if Workday AI solutions fail to operate as expected or do not meet customer expectations, or if we do not have sufficient access to development resources and the technologies required to build and improve our applications, such as the datasets required to train our AI models, our business and reputation may be harmed.

For example, AI is propelling advancements in technology, but if we fail to innovate and keep up with advancements in AI technology, if Workday Illuminate solutions fail to be delivered as planned or at all, fail to operate as expected or to meet customer expectations, or if we do not have sufficient access to development resources and the technologies required to build and improve our applications, our business and reputation may be harmed.

If we fail to develop and maintain widespread positive awareness of our brand, our business may suffer.

We believe that developing and maintaining widespread positive awareness of our brand is critical to our growth.

However, brand promotion activities may not generate the customer awareness or increased revenues we anticipate, and even if they do, any increase in revenues may not offset the significant expenses we incur in building our brand.

However, brand promotion activities may not generate the awareness or increased revenues we anticipate, and even if they do, any increase in revenues may not offset the significant expenses we incur in building our brand.

If we fail to successfully promote and maintain positive awareness of our brand, or we fail to expand positive awareness of our newer solutions or products, we may fail to attract or retain customers necessary to realize a sufficient return on our brand-building efforts, or to achieve the widespread positive brand awareness that is critical for broad customer adoption of our applications and for the end user experience.

Any unfavorable publicity or perception of our brand or our applications could negatively impact our ability to attract and retain customers and also make it more difficult to hire and retain employees.

We have and may continue to experience reputational harm from, among other things, the introduction of new products, features, or services that do not meet customer expectations;

our use of new and evolving technologies, including AI;

service outages or disruptions;

issues with product quality or performance;

backlash from customers, government entities, or other stakeholders that disagree with our product offering decisions or public policy, ethical, or political positions;

significant litigation or regulatory actions that negatively reflect on our business practices;

and data security breaches or compliance failures.

Any unfavorable publicity or perception of our brand or our applications, including any unfavorable candidate or end user experience, could negatively impact our ability to attract and retain customers and also make it more difficult to hire and retain employees.

If we are unable to successfully integrate our applications with a variety of third-party technologies, our business and operating results could be adversely affected.

We depend on relationships with third-party technology and content providers and other key suppliers, and are also dependent on third parties for the license of certain software and development tools that are incorporated into or used with our applications or used to help improve our own internal systems, processes, or controls.

For example, we leverage software and services for development tools and to deliver applications from many third-party suppliers including AWS and Google LLC.

For example, we leverage software and services for development tools and to deliver applications from many third-party suppliers including AWS and Google Cloud.

If the operations of these third parties are disrupted, our own operations may suffer, which could adversely impact our operating results.

20 unchanged sentences

• adverse effects on our brand or existing business relationships with business partners and customers as a result of the acquisition, including integrating acquired technologies and a delay in market acceptance of and difficulty in transitioning new and existing customers to acquired product lines or services;

• risks and challenges presented by the use of innovative technologies that we acquire, such as AI;

• potential write-offs of acquired assets and potential financial and credit risks associated with acquired customers;

20 unchanged sentences

Catastrophic or climate-related events may disrupt our business.

Our corporate headquarters are located in Pleasanton, California, and we have data centers located in the United States, Canada, and Europe.

Our corporate headquarters are located in Pleasanton, California, and we have data centers and partner with public cloud service providers located in the United States and Europe.

The west coast of the United States contains active earthquake zones and the southeast is subject to seasonal hurricanes or other extreme weather conditions.

12 unchanged sentences

• the evolving regulatory requirements affecting ESG standards or disclosures;

• the ability of suppliers to meet our sustainability, diversity, and other ESG standards;

• our ability to recruit, develop, and retain diverse talent in our labor markets;

• the ability of suppliers to meet our sustainability and other ESG standards;

• our ability to recruit, develop, and retain diverse talent in our global labor markets;

• the availability and cost of high-quality verified emissions reductions and renewable energy credits;

5 unchanged sentences

If our ESG practices do not align with or meet evolving investor or other stakeholder expectations and standards, then our reputation, our ability to attract or retain employees, and our attractiveness as an investment, business partner, acquirer, or service provider could be negatively impacted.

For example, an increasing number of stakeholders, regulators, and lawmakers have expressed or pursued contrary views towards ESG initiatives, including the proposal or enactment of “anti-ESG” policies, legislation, executive orders, or initiatives or the issuance of related legal opinions.

Conflicting regulations and a lack of harmonization of ESG legal and regulatory environments across the jurisdictions in which we operate may create enhanced compliance risks and costs.

We may also face increasing scrutiny from our investors, customers, employees, and other stakeholders relating to the appropriate role of ESG practices and disclosure.

Further, our failure or perceived failure to pursue or fulfill our goals and objectives or to satisfy various reporting standards on a timely basis, or at all, could have similar negative impacts or expose us to government enforcement actions and private litigation.

1 unchanged sentence

If our information technology systems are compromised or unauthorized access to customer or user data is otherwise obtained, our applications may be perceived as not being secure, our operations may be disrupted, our applications may become unavailable, customers and end users may reduce the use of or stop using our applications, and we may incur significant liabilities.

Our applications involve the storage and transmission of our customers’ and other users’ sensitive and proprietary information, including personal or identifying information regarding our customers, their employees, job candidates, customers, prospectus, and suppliers, as well as financial, accounting, health, and payroll data.

Our applications involve the storage and transmission of our customers’ and other users’ sensitive and proprietary information, including personal or identifying information regarding our customers, their employees, job candidates, customers, prospects, and suppliers, as well as financial, accounting, health, and payroll data.

Additionally, our operations and the availability of the services we provide also depend on our information technology systems.

2 unchanged sentences

damage our reputation and brand;

or result in loss of customer, consumer, and partner confidence in the security of our applications, an increase in our insurance premiums, loss of authorization under the Federal Risk and Authorization Management Program (“FedRAMP”) or other authorizations, impairment to our business, and other potential liabilities or related fees, expenses, or loss of revenues.

or result in loss of customer, consumer, and partner confidence in the security of our applications, an increase in our insurance premiums, suspension or loss of authorization under the Federal Risk and Authorization Management Program (“FedRAMP”) or other authorizations, impairment to our business, and other potential liabilities or related fees, expenses, or loss of revenues.

The financial and personnel resources we employ to implement and maintain security measures, including our information security risk insurance policy, may not be sufficient to address our security needs.

2 unchanged sentences

Our information systems may be compromised by computer hackers, employees, contractors, or vendors, as well as software bugs, human error, technical malfunctions, or other malfeasance.

Cybersecurity threats and attacks are often targeted at companies such as ours and may take a variety of forms ranging from individuals or groups of security researchers, including those who appear to offer a solution to a vulnerability in exchange for some compensation, to sophisticated hacker organizations, including state-sponsored actors who may launch coordinated attacks, such as retaliatory cyber attacks stemming from the Russia-Ukraine conflict.

Cybersecurity threats and attacks are often targeted at companies such as ours and may take a variety of forms ranging from individuals or groups of security researchers, including those who appear to offer a solution to a vulnerability in exchange for some compensation, and insiders, to sophisticated hacker organizations, including state-sponsored actors who may launch coordinated attacks, such as retaliatory cyber-attacks stemming from the Russia-Ukraine conflict or attacks motivated by the type of data that is processed by our customers, including our public sector customers, on our platform.

In the normal course of business, we are and have been the target of malicious cyber-attack attempts and have experienced other security events.

As our market presence grows, we face increased risks of cybersecurity attack or other security threats.

Key cybersecurity risks range from viruses, worms, ransomware, and other malicious software programs, to phishing attacks, to exploitation of software bugs or other defects, to targeted attacks against cloud services and other hosted software, to exploitation of unmanaged software or systems, any of which can result in a compromise of our applications or systems and the data we store or process, disclosure of Workday confidential information and intellectual property, production downtimes, reputational harm, and an increase in costs to the business.

Additionally, as AI technologies, including generative AI models, develop rapidly, threat actors are using these technologies to create sophisticated new attack methods that are increasingly automated, targeted, and coordinated and more difficult to defend against.

Key cybersecurity risks range from viruses, worms, ransomware, and other malicious software programs, to phishing attacks, to fraud, to credential theft or abuse, to exploitation of software bugs or other defects, to targeted attacks against cloud services and other hosted software, to exploitation of unmanaged software or systems, any of which can result in a compromise of our applications or systems and the data we store or process, disclosure of Workday confidential information and intellectual property, production downtimes, reputational harm, and an increase in costs to the business.

As the techniques used to obtain unauthorized access or sabotage systems change frequently, are becoming increasingly sophisticated and complex, and often are not identified until they are launched against a target, and because evidence of unauthorized activity may not have been captured or retained, or may be proactively destroyed by unauthorized actors, we may be unable to anticipate these attacks, assess the true impact they may have on our business and operations, or to implement adequate preventative measures.

Future cyber-attacks and other security events may have a significant or material impact on our business and operating results.

There may also be attacks targeting any vulnerabilities in our applications, internally built infrastructure, enhancements, and updates to our existing offerings, or in the many different underlying networks and services that power the internet that our products depend on, most of which are not under our control or the control of our vendors, partners, or customers.

There may also continue to be attacks targeting any vulnerabilities in our applications, internally built infrastructure, enhancements, and updates to our existing offerings, or in the many different underlying networks and services that power the internet that our products depend on, most of which are not under our control or the control of our vendors, partners, or customers.

Systems and processes designed to protect our applications, systems, software, and data, as well as customer data and other user data, and to prevent data loss and detect security breaches, may not be effective against all cybersecurity threats or perceived threats.

We have been subject to such incidents, including through third-party service providers and in connection with acquisitions we have made.

In addition, our software development practices have not and may not identify all potential privacy or security issues, and inadvertent disclosures of data have occurred and may occur.

In addition, our software development practices have not and may not identify all potential privacy or security issues, and inadvertent disclosures of data have occurred and may occur again.

Additionally, remote work and resource access, including our hybrid work model, has and may continue to result in an increased risk of cybersecurity-related events such as phishing attacks, exploitation of any cybersecurity flaws that may exist, an increase in the number cybersecurity threats or attacks, and other security challenges as a result of our employees and our service providers continuing to work remotely from non-corporate managed networks.

3 unchanged sentences

Any or all of these issues could negatively affect our ability to attract new customers, cause existing customers to elect to terminate or not renew their subscriptions, result in reputational damage, cause us to pay remediation and indemnity costs and/or issue service credits or refunds to customers for prepaid and unused subscription services, or result in lawsuits, regulatory fines, or other action or liabilities, any of which could adversely affect our business and operating results.

We rely on sophisticated information systems and technology, including those provided by third parties, for the secure collection, processing, transmission, storage of confidential, proprietary, and personal information, and to support our business operations and the availability of our applications.

We rely on sophisticated information systems and technology, including those provided by third parties, for the secure collection, processing, transmission, and storage of confidential, proprietary, and personal information, and to support our business operations and the availability of our applications.

In the past several years, supply chain attacks have increased in frequency and severity.

As we are both a provider and consumer of information systems and technology, we are at higher risk of being impacted either directly or indirectly by these attacks.

The control systems, cybersecurity program, infrastructure, physical facilities of, and personnel associated with third parties that we rely on are beyond our control.

The control systems, cybersecurity program, infrastructure, physical facilities of, and personnel associated with third parties that we rely on or partner with are beyond our control.

Our customers may authorize third-party technology providers to access their customer data and any unauthorized use of the third-party technology may result in unauthorized access to such data.

The audits we periodically conduct of some of our third-party vendors do not guarantee the security of and may be unable to prevent security events impacting the information technology systems of third parties that are part of our supply chain or that provide valuable services to us, which have resulted and could result in the unauthorized access to data of Workday, our employees, our customers, our third-party partners, or other end users;

3 unchanged sentences

Privacy concerns, evolving regulation of cloud computing, cross-border data transfer, and other domestic or foreign laws and regulations may reduce the adoption of our applications, result in significant costs and compliance challenges, and adversely affect our business and operating results.

Legal requirements related to collecting, storing, handling, and transferring personal data are rapidly evolving at both the national and international level in ways that require our business to adapt to support customer compliance.

As the regulatory focus on privacy intensifies worldwide, and jurisdictions increasingly consider and adopt privacy laws, the potential risks related to managing personal data by our business may grow.

Legal requirements related to collecting, storing, handling, retaining, and transferring (collectively, “processing”) personal data are rapidly evolving at both the national and international level in ways that require our business to adapt to support customer compliance.

As the complexity of our products grow, the regulatory focus on privacy intensifies worldwide, and jurisdictions increasingly consider and adopt privacy laws, the risks related to processing personal data by our business also grow.

In addition, possible adverse interpretations of existing privacy-related laws and regulations by governments in countries where our customers operate, as well as the potential implementation of new legislation, could impose significant obligations in areas affecting our business or prevent us from offering certain services in jurisdictions where we operate.

Following the European Union’s (“EU”) passage of the General Data Protection Regulation (“GDPR”), which became effective in May 2018, the global data privacy compliance landscape has grown increasingly complex, fragmented, and financially relevant to business operations.

As a result, our business faces current and prospective risks related to increased regulatory compliance costs, government enforcement actions and/or financial penalties for non-compliance, and reputational harm.

Following the EU’s passage of the General Data Protection Regulation (“GDPR”), which became effective in May 2018, the global data privacy compliance landscape has grown increasingly complex, fragmented, and financially relevant to business operations.

As a result, our data processing creates current and prospective risks related to increased regulatory compliance costs, government enforcement actions and/or financial penalties for non-compliance, and reputational harm.

For example, a new EU-U.S.

14 unchanged sentences

Taken together, the costs of compliance with and other obligations imposed by data protection laws and regulations may require modification of our services, limit use and adoption of our services, reduce overall demand for our services, lead to significant fines, penalties, or liabilities for noncompliance, or slow the pace at which we close sales transactions, or otherwise cause us to modify our operations, any of which could harm our business.

The data protection laws set forth requirements impacting how personal data must be stored, accessed, and deleted within the products.

The perception of privacy concerns, whether or not valid, may inhibit the adoption, effectiveness, or use of our applications or otherwise impact our business.

26 unchanged sentences

Furthermore, from time to time we may introduce or acquire new products, including in areas where we historically have not competed, which could increase our exposure to patent and other intellectual property claims.

Some of our applications utilize open source software, and any failure to comply with the terms of one or more of these open source licenses could negatively affect our business.

Some of our applications include software covered by open source licenses, which may include, by way of example, GNU General Public License and the Apache License.

The terms of various open source licenses have not been interpreted by United States courts, and there is a risk that such licenses could be construed in a manner that imposes unanticipated conditions or restrictions on our ability to market our applications.

We attempt to avoid adverse licensing conditions in our use of open source software in our products and services.

Our applications utilize open source software, and any failure to comply with the terms of one or more of these open source licenses could negatively affect our business.

Our applications include software covered by open source licenses, which may include, by way of example, GNU General Public License and the Apache License.

Few terms used in open source licenses have been interpreted by United States courts, and there is a risk that such licenses could be construed in a manner that imposes unanticipated conditions or restrictions on our ability to market our applications.

We attempt to comply with all open source licensing conditions that apply to our use of open source software.

By the terms of certain open source licenses, we could be required to release the source code of our proprietary software, and to make our proprietary software available under open source licenses, if we combine our proprietary software with open source software in a certain manner.

In the event that portions of our proprietary software are determined to be impacted by an open source license, we could be required to publicly release the affected portions of our source code, re-engineer all or a portion of our technologies, or otherwise be limited in the licensing of our technologies, each of which could reduce or eliminate the value of our technologies and services.

In addition, the open source license terms for future versions of open source software that we use might change, requiring us to pay for a commercial license or re-engineer all or a portion of our technologies.

In addition to risks related to license requirements, usage of open source software can lead to greater risks than use of third-party commercial software, as open source licensors generally do not provide warranties or controls on the origin of the software.

In the event that portions of our proprietary software are determined to be impacted by an open source license, we could be required to publicly release portions of our source code, re-engineer all or a portion of our technologies, or otherwise be limited in the use or licensing of our technologies, which could reduce or eliminate the value of our technologies, products, and services.

In addition, the license terms for certain previously open source software that we use have changed and the license terms for future versions of open source software that we use might change, requiring us to pay for a commercial license or re-engineer all or a portion of our technologies.

In addition to risks related to open source license requirements, usage of open source software can lead to greater risks than use of third-party commercial software, as open source licensors generally do not provide warranties or controls on the origin of the software.

Many of the risks associated with usage of open source software cannot be eliminated and could negatively affect our business.

Risks Related to Legal and Regulatory Matters

Unfavorable laws, regulations, interpretive positions, or standards governing new and evolving technologies that we incorporate into our products and services could result in significant cost and compliance challenges and adversely affect our business and operating results.

Some of our products and services, such as Workday’s People Experience, Talent Optimization, and Financial product suites, currently utilize or will utilize new and evolving technologies such as AI.

Unfavorable laws, regulations, interpretive positions, or standards governing new and evolving technologies that we incorporate into our products and services, including those involving AI uses, could result in significant cost and compliance challenges and adversely affect our business and operating results.

Many of our products and services currently utilize or will utilize new and evolving technologies such as AI.

The overall regulatory environment governing these types of technologies is likely to evolve as government interest in these technologies increases.

1 unchanged sentence

Governments and agencies domestic and abroad may in the future change or amend existing laws, or adopt new laws, regulations, or guidance, or take other actions which may severely impact the permitted uses of our technologies.

New and changing laws, regulations, executive orders, directives, and enforcement priorities can also create uncertainty about how such laws and regulations will be interpreted and applied to Workday.

For example, the technologies underlying AI and its uses are subject to a variety of laws and regulations, including those governing intellectual property, privacy, data protection cybersecurity, consumer protection, competition, and equal opportunity, and are expected to be subject to new laws and regulations or new applications of existing laws and regulations.

AI is the subject of ongoing review by various U.S.

governmental and regulatory agencies, and various U.S.

states and other foreign jurisdictions are applying, or are considering applying, their cybersecurity, data protection, and product safety laws to AI and its uses or are considering general legal frameworks for AI and its uses, such as the EU AI Act.

Any failure by us to comply with applicable laws, regulations, guidance, or other rules could result in costly litigation, penalties, or fines.

10 unchanged sentences

We are subject to risks related to government contracts and related procurement regulations, which may adversely impact our business and operating results.

Our contracts with federal, state, local, and foreign government entities are subject to various procurement regulations and other requirements relating to their formation, administration, performance, and termination, which could adversely impact our business and operating results.

Government certification requirements applicable to our platform, including FedRAMP, may change and, in doing so, restrict our ability to sell into the governmental sector until we have attained the full or revised certification.

These laws and regulations provide public sector customers various rights, many of which are not typically found in commercial contracts.

For instance, the process of evaluating potential conflicts of interest and developing necessary provisions and contract clauses, where needed, may delay or prevent Workday from being awarded certain U.S.

federal government contracts.

Additionally, we have obtained authorization under FedRAMP, which allows us to enter into the U.S.

Our contracts with federal, state, local, and foreign government entities are subject to various procurement regulations and other requirements relating to their formation, administration, and performance, which could adversely impact our business and operating results.

Government certification requirements applicable to our platform may change and, in doing so, restrict our ability to sell into the governmental sector until we have attained the authorization to use or certification.

These laws and regulations provide public sector customers with various rights, many of which are not typically found in commercial contracts.

For example, some federal contracts provide for delays, interruptions, or termination by the government at any time, with or without cause, which can adversely affect our business and operating results and impact other existing or prospective government contracts.

Additionally, we have obtained authorization under FedRAMP, which allows us to participate in the U.S.

federal government market.

Such certification is subject to rigorous compliance and if we lose our certification, it could inhibit or preclude our ability to contract with certain U.S.

Such authorization is subject to rigorous compliance and if we were to lose our authorization, it could inhibit or preclude our ability to contract with certain U.S.

federal government customers.

In addition, some customers may rely on our authorization under FedRAMP to help satisfy their own legal and regulatory compliance requirements and our failure to maintain FedRAMP authorization would result in a breach under public sector contracts obtained on the basis of such authorization.

This could subject us to liability, result in reputational harm, and adversely impact our financial condition or operating results.

We may be subject to audits and investigations relating to our government contracts, and any violations could result in various civil and criminal penalties and administrative sanctions, including termination of contracts, refunding or suspending of payments, forfeiture of profits, payment of fines, and suspension or debarment from future government business.

In addition, such contracts may provide for delays, interruptions, or termination by the government at any time, with or without cause, which may adversely affect our business and operating results and impact other existing or prospective government contracts.

In addition, some customers may rely on our authorization under FedRAMP to help satisfy their own legal and regulatory compliance requirements.

If we fail to maintain FedRAMP authorization, we may fail to retain existing customers or attract new customers that rely on our authorization under FedRAMP, which could subject us to liability, result in reputational harm, and adversely impact our financial condition or operating results.

We may be subject to additional audits and investigations relating to our government contracts, and any violations could result in various civil and criminal penalties and administrative sanctions, including termination of contracts, refunding or suspending of payments, forfeiture of profits, payment of fines, and suspension or debarment from future government business.

Unanticipated tax laws or any change in the application of existing tax laws to us or our customers and unanticipated changes in our effective tax rate may adversely impact our profitability and financial results.

15 unchanged sentences

Consequently, a decline in new or renewed subscription contracts in any single quarter may not be reflected in our revenue results for that quarter but will negatively impact our revenue in future quarters.

Additionally, because much of our sales efforts are targeted at large enterprise customers, we may face greater costs, longer sales cycles, less predictability in completing some of our sales, and varying deployment timeframes.

Our typical sales cycles for new customers are six to twelve months but can extend for eighteen months or more, and we expect that this lengthy sales cycle may continue or expand as customers increasingly adopt applications across our platform.

Additionally, because much of our sales efforts are targeted at large enterprise customers, we face greater costs, longer sales cycles, less predictability in completing some of our sales, and varying deployment timeframes.

Our typical sales cycles for many new customers are six to twelve months but can extend for eighteen months or more, and we expect that this lengthy sales cycle may continue or expand as customers increasingly adopt applications across our platform.

We have seen and may continue to see instances of increased scrutiny from existing and prospective customers and the lengthening of certain sales cycles.

5 unchanged sentences

Furthermore, our subscription-based model is largely based on the size of our customers’ employee headcount.

Therefore, the addition or loss of employees by our customers, including any significant reductions in force by our customers, or customer insolvencies resulting from severe economic hardship, could have an impact on our subscription services revenues in any given period.

Should there be any prolonged decrease in our customers’ headcounts, we could experience reduced subscription services revenues upon renewal or potentially outside of the renewal period, which could materially impact our business and operating results in any given period.

Therefore, the addition or loss of employees by our customers, including any significant reductions in force by our customers, or customer insolvencies resulting from severe economic hardship, can and has had an impact on our subscription services revenues.

Prolonged decreases in our customers’ headcounts can materially impact our business and operating results in any given period.

We have a history of cumulative losses, and we may not sustain profitability on a GAAP basis in the future.

Until recently, we had incurred significant net losses on a GAAP basis since our inception in 2005 and our quarterly operating results may fluctuate in the future.

We expect our operating expenses to increase in the future due to substantial investments we have made and continue to make to acquire new customers and develop our applications, anticipated increases in sales and marketing expenses, employee headcount growth expenses, product development expenses, operations costs, and general and administrative costs.

We expect our operating expenses to increase in the future due to substantial investments we have made and continue to make to acquire new customers and develop our applications, anticipated increases in sales and marketing expenses, product development expenses, operations costs, and general and administrative costs.

If our revenue growth does not meet estimates, we may not be able to adjust our spending quickly enough to avoid an adverse impact on our financial results, and therefore we may incur losses on a GAAP basis in the future.

48 unchanged sentences

In addition, Mr.

Bhusri holds 0.2 million restricted stock units, which will be settled in an equivalent number of shares of Class A common stock.

Bhusri holds 0.2 million restricted stock units (“RSUs”), which will be settled in an equivalent number of shares of Class A common stock.

Further, Messrs.

9 unchanged sentences

In addition, Mr.

Bhusri has the ability to control the management and affairs of our company as a result of his position as a member of our Board of Directors and an officer of Workday.

Bhusri has the ability to significantly influence the management and affairs of our company as a result of his position as a member of our Board of Directors and an officer of Workday.

Bhusri, in his capacity as a board member and officer, however, owes a fiduciary duty to our stockholders and must act in good faith in a manner he reasonably believes to be in the best interests of our stockholders.

31 unchanged sentences

We may not realize the anticipated long-term stockholder value of our share repurchase programs.

In November 2022, our Board of Directors authorized a program under which we may repurchase up to $500 million of our outstanding shares of Class A common stock (“2022 Share Repurchase Program”), and in February 2024, the Board of Directors authorized a new program under which we may purchase up to an additional $500 million of our Class A common stock (“2024 Share Repurchase Program”).

The 2022 and 2024 Share Repurchase Programs each have a term of 18 months, but the programs may be modified, suspended, or terminated at any time.

Such repurchases may be made through open market transactions, through privately negotiated transactions, or by other means, including through the use of trading plans intended to qualify under Rule 10b5-1, in accordance with applicable securities laws and other restrictions.

In February 2024, our Board of Directors authorized a program under which we were authorized to repurchase up to $500 million of our outstanding shares of Class A common stock.

In the third quarter of fiscal 2025, we had completed the repurchase authorization under this program.

In August 2024, our Board of Directors authorized the repurchase of up to $1.0 billion of our outstanding shares of Class A common stock (“August 2024 Share Repurchase Program”).

Such repurchases may be made through open market transactions, including through the use of trading plans intended to qualify under Rule 10b5-1, through privately negotiated transactions, or by other means, in each case in accordance with applicable securities laws and other restrictions.

The August 2024 Share Repurchase Program has no expiration date, may be suspended or discontinued at any time, and does not obligate us to acquire any amount of Class A common stock.

Any failure to repurchase stock after we have announced our intention to do so may negatively impact our reputation and investor confidence in us and may negatively impact our stock price.

The existence of the 2022 and 2024 Share Repurchase Programs could cause our stock price to trade higher than it otherwise would and could potentially reduce the market liquidity for our stock.

The 2022 and 2024 Share Repurchase Programs may not enhance long-term stockholder value because the market price of our common stock may decline below the levels at which we repurchased shares and short-term stock price fluctuations could reduce the effectiveness of this program.

Repurchasing our common stock will reduce the amount of cash we have available to fund working capital, repayment of debt, capital expenditures, strategic acquisitions or business opportunities, and other general corporate purposes, and we may fail to realize the anticipated long-term stockholder value of the 2022 and 2024 Share Repurchase Programs.

Since first authorizing a share repurchase program, there have been periods of time during which we have been unable to repurchase shares, for example, due to the possession of material nonpublic information.

The existence of our share repurchase programs could cause our stock price to trade higher than it otherwise would and could potentially reduce the market liquidity for our stock.

Our share repurchase programs may not enhance long-term stockholder value because the market price of our common stock may decline below the levels at which we repurchased shares and short-term stock price fluctuations could reduce the effectiveness of this program.

Furthermore, the timing and amount of any repurchases, if any, will be subject to liquidity, market and economic conditions, compliance with applicable legal requirements such as Delaware surplus and solvency tests, and other relevant factors.

40 unchanged sentences

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1A. Risk Factors