What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2025-11-26 compared with 2025-08-22 · 58 added, 27 removed, 571 unchanged (13% of the section changed)

30 unchanged sentences

• the limited ability of third parties to influence corporate matters due to our dual class structure and to seek a merger, tender offer, or proxy contest due to Delaware law and provisions in our organizational documents.

Table o f Contents

Risks Related to Our Business and Industry

27 unchanged sentences

Interruptions in our services might adversely affect our reputation and operating results, cause us to issue refunds or service credits to customers, subject us to potential liabilities, result in contract terminations, or adversely affect our renewal rates.

Table o f Contents

The extent to which the continuing global economic and geopolitical volatility, and any resulting effect on customer spending, will continue to impact our business, financial condition, and operating results will depend on future developments, which are highly uncertain and difficult to predict.

23 unchanged sentences

As we continue to grow and change, we may find it difficult to maintain our corporate culture among a larger number of employees who are dispersed throughout various geographic regions, including difficulties due to managing the complexities of communicating with all employees.

Efforts to restructure our workforce, such as the Fiscal 2026 Restructuring Plan, may be disruptive and adversely impact employee morale or our corporate culture.

Efforts to restructure our workforce may be disruptive and adversely impact employee morale or our corporate culture.

Failure to maintain or adapt our culture could negatively affect our ability to attract new employees or to retain our current employees and our business and future growth prospects could be adversely affected.

Table o f Contents

The markets in which we participate are intensely competitive, and if we do not compete effectively, our operating results could be adversely affected.

9 unchanged sentences

In addition, other cloud or AI platform companies that provide services in different target markets or industries may develop applications or acquire companies that operate in our target markets or industries, and some potential customers may elect to develop their own internal applications.

As the market evolves and as existing and new market participants introduce new types of technologies, such as generative and agentic AI, and different approaches that enable organizations to address their HCM and financial needs, we expect this competition to intensify in the future.

As the market evolves and as existing and new market participants introduce new types of technologies, such as generative and agentic AI, and different approaches that enable organizations to address their HCM and financial needs, our ability to maintain market differentiation may affect our competitive position.

Furthermore, our current or potential competitors may be acquired by, or merge with, third parties with greater available resources and the ability to initiate or withstand substantial price competition.

2 unchanged sentences

With the introduction of new technologies, such as generative AI, we expect competition to intensify in the future.

If our competitors’ products, services, or technologies become more accepted than our products, if they are successful in bringing their products or services to market earlier than ours, or if their products or services are more technologically capable than ours, then our revenues could be adversely affected.

If our competitors’ products, services, or technologies, including generative and agentic AI capabilities, become more accepted than our products, if they are successful in bringing their products or services to market earlier than ours, or if their products or services are more technologically capable or resonate more with the market than ours, then our revenues could be adversely affected.

In addition, our competitors may offer their products and services at a lower price, or may offer price concessions, delayed payment terms, financing terms, or other terms and conditions that are more enticing to potential customers.

8 unchanged sentences

In addition, acquisitions of our partners by our competitors could end our strategic relationship with such acquired partner and result in a decrease in the number of our current and potential customers.

Table o f Contents

Our partner training and educational programs may not be effective or utilized consistently by partners.

13 unchanged sentences

• the need to adhere to local laws and regulations, including those related to data localization, privacy, and anti-corruption;

• difficulties in appropriately staffing and managing foreign operations and providing appropriate compensation for local markets;

• difficulties in leveraging executive presence and maintaining company culture globally;

• difficulties in appropriately staffing and managing foreign operations and providing appropriate compensation and benefits for local markets;

• difficulties in leveraging executive presence, maintaining company culture globally, and conforming with local cultural contexts and customs;

• different pricing environments, longer sales cycles, and longer trade receivables payment cycles, and collections issues;

10 unchanged sentences

• unstable economic and political conditions.

Table o f Contents

Certain of the above factors have and may continue to negatively impact our ability to sell our applications and offer services globally, reduce our competitive position in foreign markets, increase our costs of global operations, reduce demand for our applications and services from global customers, or subject us to legal or regulatory liability.

21 unchanged sentences

Additionally, acquisitions of our customers by other companies have led, and could continue to lead, to cancellation of our contracts with those customers, thereby reducing the number of our existing and potential customers.

Table o f Contents

The use of new and evolving technologies in our offerings at Workday, including AI, may result in reputational harm and increased litigation, and adversely affect our operating results.

5 unchanged sentences

The risks and challenges presented by these technologies could undermine public confidence in AI, which could slow its adoption and affect our business.

Many of our products are powered by AI, some of which include the use of large language models and generative and agentic AI, for use cases that could potentially impact human, civil, privacy, or employment rights and dignities.

To the extent that the products and technologies we develop and utilize rely on the use of large language models or agentic capabilities provided by third parties, we face additional uncertainties and liabilities.

Many of our products are powered by AI, some of which include the use of generative and agentic AI, for use cases that could potentially impact human, civil, privacy, or employment rights and dignities.

To the extent that the products and technologies we develop and deploy rely on the use of generative or agentic capabilities provided by third parties, we face additional uncertainties and liabilities.

Any failure to accurately identify and address our responsibilities and liabilities in this uncertain environment, and to adequately address relevant ethical and social issues that may arise with such technologies and use cases, as well as failure by others in our industry or actions taken by our customers, employees, or end users (including misuse of these technologies), could negatively affect the adoption of our offerings and subject us to reputational harm, regulatory action, or litigation, which may harm our financial condition and operating results.

We are currently defending against a lawsuit alleging that our products and services enable discrimination, and although we believe that such claims lack merit, and the majority of the claims have been dismissed, legal proceedings can be lengthy, expensive, and disruptive to our operations and customers (particularly where, as in the present litigation, the plaintiff may seek to also litigate against certain of Workday’s customers).

We are currently defending against a lawsuit alleging that certain of our AI-related products and services enable discrimination, and although we believe that such claims lack merit, and the majority of the claims have been dismissed, legal proceedings can be lengthy, expensive, and disruptive to our operations and customers (particularly where, as in the present litigation, the plaintiff may seek to also litigate against certain of Workday’s customers).

We may be subject to other litigation and regulatory actions that may cause financial, competitive, and developmental impacts, and could lead to legal liability.

8 unchanged sentences

Fluctuations in our quarterly results and related impacts to any earnings guidance we may issue from time to time, including any modification or withdrawal thereof, may negatively impact the value of our securities.

Table o f Contents

If we are not able to realize a return on our current development efforts or offer new features, enhancements, and modifications to our products and services that are desired by current or potential customers, our business and operating results could be adversely affected.

25 unchanged sentences

Any failure of our applications to operate effectively with future network platforms and other third-party technologies, or changes in such technologies that degrade the functionality of our products or give preferential treatment to competitive services, could reduce the demand for our applications, result in customer and end user dissatisfaction, and adversely affect our business and operating results.

Table o f Contents

We have acquired, and may in the future acquire, other companies, employee teams, or technologies, which could divert our management’s attention, result in additional indebtedness or dilution to our stockholders, and otherwise disrupt our operations and adversely affect our operating results.

28 unchanged sentences

In addition, if an acquired business fails to meet our expectations, our business, financial condition, and operating results may suffer.

Table o f Contents

If we are not able to realize a return on the investments we have made toward entering new markets and new lines of business, our business and operating results could be adversely affected.

We continue to seek opportunities to enter into new markets and/or new lines of business, some of which we may have very limited or no experience in.

For example, we have and continue to make significant targeted investments in entering the medium-enterprise and U.S.

federal government markets and see our success in these markets as key contributors to our future growth.

As an entrant to new markets and new lines of business, we may not be effective in convincing prospective customers that our solutions will address their needs, and we may not accurately estimate our infrastructure needs, human resource requirements, or operating expenses with regard to these new markets and new lines of business.

21 unchanged sentences

• our ability to recruit, develop, and retain diverse talent in our global labor markets;

Table o f Contents

• the availability and cost of high-quality verified emissions reductions and renewable energy credits;

19 unchanged sentences

The security measures we have in place vary in maturity across the organization and may not be sufficient to protect against security risks, preserve our operations and services and the integrity of customer and personal information, and prevent data loss, misappropriation, and other security breaches.

Our logging may also not be sufficient to fully investigate the scope of an incident.

Our information systems may be compromised by computer hackers, employees, contractors, or vendors, as well as software bugs, human error, technical malfunctions, or other malfeasance.

Our logging may not be and has not been sufficient to fully investigate the scope of an incident.

Our information systems have been and may in the future be compromised by computer hackers, employees, contractors, or vendors, as well as software bugs, human error, technical malfunctions, or other malfeasance.

Table o f Contents

Cybersecurity threats and attacks are often targeted at companies such as ours and may take a variety of forms ranging from individuals or groups of security researchers, including those who appear to offer a solution to a vulnerability in exchange for some compensation, and insiders, to sophisticated hacker organizations, including state-sponsored actors who may launch coordinated attacks, such as retaliatory cyber-attacks stemming from the Russia-Ukraine conflict or attacks motivated by the type of data that is processed by our customers, including our public sector customers, on our platform.

3 unchanged sentences

Key cybersecurity risks range from viruses, worms, ransomware, and other malicious software programs, to social engineering attacks, to fraud, to credential theft or abuse, to exploitation of software bugs or other defects, to targeted attacks against cloud services and other hosted software, to exploitation of unmanaged software or systems, any of which can result in a compromise of our applications or systems and the data we store or process, and can result in disclosure of Workday confidential information and intellectual property, production downtimes, reputational harm, and an increase in costs to the business.

For example, we recently were targeted as part of a social engineering campaign against many large organizations, resulting in unauthorized access to some commonly available business contact information in our third-party customer relationship management platform.

For example, we recently were targeted as part of a social engineering campaign against many large organizations, resulting in unauthorized access to some of our internal systems including some commonly available business contact information in our third-party customer relationship management platform.

As the techniques used to obtain unauthorized access or sabotage systems change frequently, are becoming increasingly sophisticated and complex, and often are not identified until they are launched against a target, and because evidence of unauthorized activity may not have been captured or retained, or may be proactively destroyed by unauthorized actors, we may be unable to anticipate these attacks, assess the true impact they may have on our business and operations, or to implement adequate preventative measures.

9 unchanged sentences

Any or all of these issues could negatively affect our ability to attract new customers, cause existing customers to elect to terminate or not renew their subscriptions, result in reputational damage, cause us to pay remediation and indemnity costs and/or issue service credits or refunds to customers for prepaid and unused subscription services, or result in lawsuits, regulatory fines, or other action or liabilities, any of which could adversely affect our business and operating results.

Table o f Contents

We rely on sophisticated information systems and technology, including those provided by third parties, for the secure collection, processing, transmission, and storage of confidential, proprietary, and personal information, and to support our business operations and the availability of our applications.

11 unchanged sentences

In addition, possible adverse interpretations of existing privacy-related laws and regulations by governments in countries where our customers operate, as well as the potential implementation of new legislation, could impose significant obligations in areas affecting our business or prevent us from offering certain services in jurisdictions where we operate.

Following the EU’s passage of the General Data Protection Regulation (“GDPR”), which became effective in May 2018, the global data privacy compliance landscape has grown increasingly complex, fragmented, and financially relevant to business operations.

Over the past five years, the global data privacy compliance landscape has grown increasingly complex, fragmented, and financially relevant to business operations.

As a result, our data processing creates current and prospective risks related to increased regulatory compliance costs, government enforcement actions and/or financial penalties for non-compliance, and reputational harm.

2 unchanged sentences

However, it is facing legal challenges.

Until challenges to the DPF make their way through the court system, uncertainty may continue about the legal requirements for transferring customer personal data to and from Europe, an integral process of our business that remains governed by, and subject to, GDPR requirements.

Failure to comply with the GDPR data processing requirements by either ourselves or our subcontractors could lead to regulatory enforcement actions, which can result in monetary penalties of up to 4% of worldwide revenue, private lawsuits, reputational damage, and loss of customers.

Other countries such as Russia, China, and India have also passed laws imposing varying degrees of restrictive data residency requirements.

Failure to comply with the GDPR data processing requirements by either ourselves or our subprocessors could lead to regulatory enforcement actions, which can result in monetary penalties of up to 4% of worldwide revenue, private lawsuits, reputational damage, and loss of customers.

Other new EU laws, including the EU Data Act, may impose additional rules and restrictions on the use of our products and services.

Other countries such as Russia, China, Vietnam, and India have also passed or are in the process of passing laws imposing varying degrees of restrictive data residency requirements.

Regulatory developments in the United States present additional risks.

8 unchanged sentences

The new rule imposes certain diligence, security, audit and record-keeping requirements, and may adversely impact certain of our global business operations, including by restricting access to data by subsidiaries, affiliates, and vendors.

Table o f Contents

Furthermore, the U.S.

27 unchanged sentences

Our failure to secure, protect, and enforce our intellectual property rights could have a serious adverse effect on our brand and business.

Table o f Contents

We may be sued by third parties for alleged infringement of their proprietary rights.

7 unchanged sentences

Furthermore, from time to time we may introduce or acquire new products, including in areas where we historically have not competed, which could increase our exposure to patent and other intellectual property claims.

Our applications utilize open source software, and any failure to comply with the terms of one or more of these open source licenses could negatively affect our business.

Our applications include software covered by open source licenses, which may include, by way of example, GNU General Public License and the Apache License.

Few terms used in open source licenses have been interpreted by United States courts, and there is a risk that such licenses could be construed in a manner that imposes unanticipated conditions or restrictions on our ability to market our applications.

Our applications utilize open source software, including open source AI models and platforms, and our strategy of investing in and acquiring such technologies introduces new and heightened risks.

Any failure to comply with the terms of one or more of these open source licenses, or to manage the unique risks of open source AI, could negatively affect our business.

Our applications include software covered by open source licenses, which may include, by way of example, the GNU General Public License and the Apache License.

Furthermore, our strategy includes acquiring and investing in open-source AI platforms and utilizing AI models that may be governed by novel or untested licenses with ambiguous terms, use-based restrictions, or uncertain legal interpretation.

Few terms used in either traditional or new AI-focused open source licenses have been interpreted by United States courts, and there is a risk that such licenses could be construed in a manner that imposes unanticipated conditions or restrictions on our ability to market our applications.

We attempt to comply with all open source licensing conditions that apply to our use of open source software.

By the terms of certain open source licenses, we could be required to release the source code of our proprietary software, and to make our proprietary software available under open source licenses, if we combine our proprietary software with open source software in a certain manner.

In the event that portions of our proprietary software are determined to be impacted by an open source license, we could be required to publicly release portions of our source code, re-engineer all or a portion of our technologies, or otherwise be limited in the use or licensing of our technologies, which could reduce or eliminate the value of our technologies, products, and services.

In addition, the license terms for certain previously open source software that we use have changed and the license terms for future versions of open source software that we use might change, requiring us to pay for a commercial license or re-engineer all or a portion of our technologies.

Our increasing integration of proprietary AI agents and platforms with open source components may heighten this “copyleft” risk.

In addition, the license terms for certain previously open source software or models that we use have changed and the license terms for future versions of open source software that we use might change, requiring us to pay for a commercial license or re-engineer all or a portion of our technologies.

In addition to risks related to open source license requirements, usage of open source software can lead to greater risks than use of third-party commercial software, as open source licensors generally do not provide warranties or controls on the origin of the software.

Many of the risks associated with usage of open source software cannot be eliminated and could negatively affect our business.

Beyond licensing compliance, our use of and investment in open source AI models and platforms create distinct and significant risks.

Open source AI models may be trained on data of unknown or uncertain provenance, which could include copyrighted or otherwise proprietary, confidential, or private information.

If our applications or the agents our customers build using our platforms incorporate such models, we could face claims for copyright infringement and other violations.

Open source AI components may also be subject to “data poisoning” and other security vulnerabilities.

Many of the risks associated with usage of open source software, particularly in the rapidly evolving field of AI, cannot be eliminated and could negatively affect our business.

Risks Related to Legal and Regulatory Matters

5 unchanged sentences

New and changing laws, regulations, executive orders, directives, and enforcement priorities can also create uncertainty about how such laws and regulations will be interpreted and applied to Workday.

Table o f Contents

For example, the technologies underlying AI and its uses are subject to a variety of laws and regulations, including those governing intellectual property, privacy, data protection, cybersecurity, consumer protection, competition, and equal opportunity, and are expected to be subject to new laws and regulations or new applications of existing laws and regulations.

12 unchanged sentences

The litigation and other claims are subject to inherent uncertainties and management’s view of these matters may change in the future.

A material adverse impact in our consolidated financial statements could occur for the period in which the effect of an unfavorable outcome becomes probable and reasonably estimable.

A material adverse impact in our condensed consolidated financial statements could occur for the period in which the effect of an unfavorable outcome becomes probable and reasonably estimable.

We are subject to risks related to government contracts and related procurement regulations, which may adversely impact our business and operating results.

7 unchanged sentences

Such authorization is subject to rigorous compliance and if we were to lose our authorization, it could inhibit or preclude our ability to contract with certain U.S.

federal government customers.

In addition, some customers may rely on our authorization under FedRAMP to help satisfy their own legal and regulatory compliance requirements.

federal and state government customers.

If we fail to maintain FedRAMP authorization, we may fail to retain existing customers or attract new customers that rely on our authorization under FedRAMP, which could subject us to liability, result in reputational harm, and adversely impact our financial condition or operating results.

We may be subject to additional audits and investigations relating to our government contracts, and any violations could result in various civil and criminal penalties and administrative sanctions, including termination of contracts, refunding or suspending of payments, forfeiture of profits, payment of fines, and suspension or debarment from future government business, as well as harm to our reputation and financial results.

Table o f Contents

Unanticipated tax laws or any change in the application of existing tax laws to us or our customers and unanticipated changes in our effective tax rate may adversely impact our profitability and financial results.

26 unchanged sentences

Prolonged decreases in our customers’ headcounts can materially impact our business and operating results in any given period.

Table o f Contents

We have a history of cumulative losses, and we may not sustain profitability on a GAAP basis in the future.

8 unchanged sentences

Additionally, in fiscal 2023, we entered into a credit agreement (“2022 Credit Agreement”) which provides for a revolving credit facility in an aggregate principal amount of $1.0 billion.

As of July 31, 2025, we had no outstanding revolving loans under the 2022 Credit Agreement.

As of October 31, 2025, we had no outstanding revolving loans under the 2022 Credit Agreement.

We may incur substantial additional debt in the future, some of which may be secured debt.

20 unchanged sentences

Additionally, instability in the global banking system has created bank-specific and broader financial institution liquidity risks and concerns, which may have an adverse impact on the companies we have invested or may invest in.

Table o f Contents

Further, valuations of non-marketable equity investments are inherently complex due to the lack of readily available market data and the anticipated valuation at the time of our investment may not meet our expectations.

15 unchanged sentences

Our Co-Founders have control over key decision making as a result of their control of a majority of our voting stock.

As of July 31, 2025, our Co-Founder and CEO Emeritus, David Duffield, together with his affiliates, held voting rights with respect to approximately 42 million shares of Class B common stock and 0.1 million shares of Class A common stock.

As of July 31, 2025, our Co-Founder and Executive Chair, Aneel Bhusri, together with his affiliates, held voting rights with respect to approximately 8 million shares of Class B common stock and 0.4 million shares of Class A common stock.

As of October 31, 2025, our Co-Founder and CEO Emeritus, David Duffield, together with his affiliates, held voting rights with respect to approximately 42 million shares of Class B common stock and 0.1 million shares of Class A common stock.

As of October 31, 2025, our Co-Founder and Executive Chair, Aneel Bhusri, together with his affiliates, held voting rights with respect to approximately 8 million shares of Class B common stock and 0.4 million shares of Class A common stock.

In addition, Mr.

13 unchanged sentences

Bhusri, in his capacity as a board member and officer, however, owes a fiduciary duty to our stockholders and must act in good faith in a manner he reasonably believes to be in the best interests of our stockholders.

Table o f Contents

The dual class structure of our common stock has the effect of concentrating voting control with our Co-Founders, as well as with other executive officers, directors, and affiliates, which limits or precludes the ability of non-affiliates to influence corporate matters.

Our Class B common stock has 10 votes per share and our Class A common stock, which is the stock that is publicly traded, has one vote per share.

Stockholders who hold shares of Class B common stock, including our executive officers, directors, and other affiliates, together hold a substantial majority of the voting power of our outstanding capital stock as of July 31, 2025.

Because of the ten-to-one voting ratio between our Class B and Class A common stock, the holders of our Class B common stock collectively will continue to control a majority of the combined voting power of our common stock and therefore be able to control all matters submitted to our stockholders for approval until the conversion of all shares of all Class A and Class B shares to a single class of common stock on the date that is the first to occur of (i) October 17, 2032, (ii) such time as the shares of Class B common stock represent less than 9% of the outstanding Class A and Class B common stock, (iii) nine months following the death of both Mr.

26 unchanged sentences

Securities litigation against us could result in substantial costs and divert our management’s attention from other business concerns, which could harm our business.

Table o f Contents

We may not realize the anticipated long-term stockholder value of our share repurchase programs.

25 unchanged sentences

• advance notice procedures apply for stockholders to nominate candidates for election as directors or to bring matters before an annual meeting of stockholders.

Table o f Contents

In addition, Section 203 of the DGCL imposes certain restrictions on mergers, business combinations, and other transactions between us and holders of 15% or more of our common stock, which may discourage, delay, or prevent a change in control of our company.

21 unchanged sentences

Consequently, stockholders must rely on sales of their common stock after price appreciation as the only way to realize any future gains on their investment.

Table o f Contents

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-Q

Item 1A. Risk Factors