What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2026-03-06 compared with 2025-03-11 · 263 added, 233 removed, 357 unchanged (58% of the section changed)

1 unchanged sentence

You should carefully consider the risks and uncertainties described below, together with all of the other information in this report, including the consolidated financial statements and the related notes included elsewhere in this Annual Report on Form 10-K, before making an investment decision.

The risks and uncertainties described below reflect our beliefs and opinions as to the factors and events that could materially and adversely affect our business or the market price of our securities in the future.

References to past events are provided by way of example only and are not intended to be a complete listing or a representation as to whether or not any of the risks, events, or uncertainties described below have occurred in the past.

The risks and uncertainties described below are not the only ones we face.

7 unchanged sentences

• any compromise of our information technology systems or security measures (including of our critical suppliers and service partners), or the unauthorized access of customer or user data;

• any slowdown or failure of our technical operations infrastructure, including our data centers and computing infrastructure operated by third parties, or the impact of service outages or delays in the deployment of our applications, or the failure of our applications to perform properly;

• any slowdown or failure of our technical operations infrastructure, including data centers operated by third parties, or the impact of service outages or delays in the deployment of our applications, or the failure of our applications to perform properly;

• our ability to compete effectively in the intensely competitive markets in which we participate, including against non-specialist AI-native solutions;

• privacy concerns and evolving domestic or foreign laws and regulations;

• the impact of continuing global economic and geopolitical volatility;

• any loss of key employees or the inability to attract, develop, and retain highly skilled employees;

• our ability to compete effectively in the intensely competitive markets in which we participate;

• our reliance on our network of partners to drive additional growth of our revenues;

• exposure to risks inherent to sales to customers outside the United States or with international operations;

• our ability to realize a return on our current development efforts or offer new features, such as those involving AI, enhancements, and modifications to our products and services, and our ability to realize a return on the investments we have made toward entering new markets and new lines of business;

• exposure to risks inherent to international expansion and sales to customers outside the U.S.

or with international operations;

• our ability to realize the expected business or financial benefits of company, employee, or technology acquisitions;

• government contracts and related procurement regulations;

• any dissatisfaction of our users with the deployment, training, and support services provided by us and our partners;

• the fluctuation of our quarterly results;

• our ability to realize a return on our current development efforts or offer new features, enhancements, and modifications to our products and services, and our ability to realize a return on the investments we have made toward entering new markets and new lines of business;

• delays in the reflection of downturns or upturns in new sales in our operating results associated with long sales cycles and our subscription model;

• our ability to predict the rate of customer subscription renewals or adoptions;

• new and evolving technologies such as AI;

• the technical, legal, and regulatory environment in connection with our use of new and evolving technologies in our offerings, such as AI;

• any adverse litigation results;

• our ability to successfully integrate our applications with third-party technologies;

• our ability to realize the expected business or financial benefits of company, employee, or technology acquisitions;

• any failure to protect our intellectual property rights or any lawsuits against us for alleged infringement of third-party proprietary rights;

• government contracts and related procurement regulations;

• the impact of continuing global economic and geopolitical volatility;

• the fluctuation of our quarterly results;

• our existing and future debt obligations;

3 unchanged sentences

We have experienced significant growth in the number of users, transactions, and data that our operations infrastructure supports.

If we do not accurately predict our infrastructure requirements or fail to adapt and scale, we may experience service outages or delays, or significant increases in operating costs, which may adversely affect our business and operating results.

If we do not accurately predict our infrastructure requirements or fail to adapt and scale, we may see an increase in service outages or delays, or significant increases in operating costs, which may adversely affect our business and operating results.

We have experienced, and may in the future experience, defects, system disruptions, outages, and other performance problems, including the failure of our applications to perform properly.

These problems may be caused by a variety of factors, including infrastructure and software or code changes, vendor issues, software and system defects, human error, viruses, worms, security attacks (internal and external), fraud, spikes in customer usage, and denial of service issues.

For example, in July 2025, we identified and subsequently remediated an issue impacting reporting from high-volume data sources in the tenants of certain customers that may have yielded incomplete queries without displaying an error message.

In addition, we may also encounter difficulties integrating acquired technologies, which may result in the failure of our applications to perform properly.

All of these issues may result in increased operational costs, delays in new feature rollouts, customer loss, reputational damage, and legal or regulatory liability, including liability under customer contracts.

8 unchanged sentences

We depend on data centers and other infrastructure operated by third parties, as well as internet availability, and any disruption in these operations could adversely affect our business and operating results.

We host our applications and serve our customers and users globally from data centers operated by third parties and rely upon third-party partners to operate certain aspects of our services.

We host our applications and serve our customers and users globally from data centers operated by third parties and rely upon third-party vendors to operate certain aspects of our services.

We control our applications and data, but we do not control the facilities, operations, and physical security of these locations.

Disruption of or interference at these locations has and could in the future impact our operations and our business could be adversely impacted.

For example, we have experienced disruptions at certain of our data centers in the U.S.

For example, we have experienced disruptions at certain of our co-location data centers in the U.S.

due to high temperatures and power outages that resulted in a brief temporary outage of our services for a subset of our customers.

3 unchanged sentences

In addition, certain countries have implemented or may implement legislative and technological actions that either do or can effectively regulate access to the internet, including the ability of internet service providers to limit access to specific websites or content.

Any changes in third-party service levels at our hosted infrastructure providers, or any errors, defects, disruptions, or other performance problems with our applications or the infrastructure on which they run, including internet infrastructure, could adversely affect our reputation and may damage our customers’ or other users’ stored files or result in lengthy interruptions in our services.

Any changes in service levels with our infrastructure providers, or any errors, defects, disruptions, or other performance problems with our applications or the infrastructure on which they run, including internet infrastructure, could adversely affect our reputation and may damage our customers’ or other users’ data or result in lengthy interruptions in our services.

Interruptions in our services might adversely affect our reputation and operating results, cause us to issue refunds or service credits to customers, subject us to potential liabilities, result in contract terminations, or adversely affect our renewal rates.

The extent to which the continuing global economic and geopolitical volatility, and any resulting effect on customer spending, will continue to impact our business, financial condition, and operating results will depend on future developments, which are highly uncertain and difficult to predict.

We operate on a global scale, and as a result, our business and revenues are impacted by global economic and geopolitical conditions.

Global economic developments, including increased tariffs, geopolitical volatilities, downturns or recessions, political instability, and global health crises may negatively affect us or our ability to accurately forecast and plan our future business activity.

In addition, volatile geopolitical situations have led and could lead to further economic disruption.

Any sustained adverse impacts from these and other recent macroeconomic events could materially and adversely affect our business, financial condition, operating results, and earnings guidance that we may issue from time to time, which could have a material effect on the value of our Class A common stock.

Our future revenues rely on continued demand by existing customers and the acquisition of new customers who may be subject to economic hardship due to recent macroeconomic events, including concerns about inflation or the interest rate environment, and may delay or reduce their enterprise software spending to preserve capital and liquidity.

In connection with recent macroeconomic events, we have experienced and may continue to experience delays in purchasing decisions from existing and prospective customers, increased demand for price concessions and delayed payment terms, and a reduction in customer demand.

Our business, financial condition, and operating results may be negatively impacted in future periods due to the prolonged impacts of recent macroeconomic events, which may not be fully reflected in our operating results and overall financial performance until future periods.

To the extent recent macroeconomic events adversely affect our business, financial condition, and operating results, it may also have the effect of heightening many of the other risks described in this “Risk Factors” section.

We may lose key employees or be unable to attract, enable, and retain highly skilled employees.

Our success and future growth depend largely upon the continued services of our executive officers, other members of senior management, and other key employees.

Effective February 1, 2024, the start of our fiscal 2025, in accordance with an established succession plan, Aneel Bhusri stepped down from his role as Co-CEO and assumed the role of Executive Chair, and Carl Eschenbach, formerly Co-CEO alongside Mr.

Bhusri, assumed the role of sole CEO.

We do not have employment agreements with our executive officers or other key employees that require them to continue to work for us for any specified period, and they could terminate their employment with us at any time.

Key employee changes have the potential to disrupt our business, impact our ability to preserve our culture, negatively affect our ability to attract and retain talent, or otherwise have a serious adverse effect on our business and operating results.

To execute our growth plan, we must attract, enable, develop, and retain highly qualified talent.

Our ability to compete and succeed in a highly competitive environment is directly correlated to our ability to recruit and retain highly skilled employees, especially in the areas of product development, cybersecurity, senior sales executives, and engineers with significant experience in designing and developing software and internet-related services, including in AI.

The expansion of our sales infrastructure, both domestically and internationally, is necessary to grow our customer base and business.

Our business may be adversely affected if our efforts to attract and enable new members of our direct sales force do not generate a corresponding increase in revenues.

We have experienced, and we expect to continue to experience, significant competition in hiring and retaining employees with appropriate qualifications.

In February 2025, we announced the Fiscal 2026 Restructuring Plan, which is intended to prioritize our investments and advance our growth and is currently expected to result in the reduction of approximately 8% of our workforce.

We expect this plan to be substantially complete by the second quarter of fiscal 2026, subject to local law and consultation requirements.

The Fiscal 2026 Restructuring Plan could negatively impact our ability to attract, retain, and motivate employees.

We must also continue to retain, develop, and motivate existing employees through our compensation practices, company culture, and career development opportunities.

Further, our current and future office environments and our current hybrid work policy may not meet the expectations of our employees or prospective employees, and may amplify challenges in recruiting and retention.

We believe that a critical component of our success has been our corporate culture and our core values.

As we continue to grow and change, we may find it difficult to maintain our corporate culture among a larger number of employees who are dispersed throughout various geographic regions, including managing the complexities of communicating with all employees.

Efforts to restructure our workforce, such as the Fiscal 2026 Restructuring Plan, may be disruptive and adversely impact employee morale or our corporate culture.

Failure to maintain or adapt our culture could negatively affect our ability to attract new employees or to retain our current employees and our business and future growth prospects could be adversely affected.

The markets in which we participate are intensely competitive, and if we do not compete effectively, our operating results could be adversely affected.

The markets for enterprise cloud applications, including AI-powered solutions, are highly competitive, with relatively low barriers to entry for some applications or services.

Some of our competitors are larger and have greater name recognition, significantly longer operating histories, access to larger customer bases, larger marketing budgets, and significantly greater resources to devote to the development, promotion, and sale of their products and services than we do.

Some of our competitors are larger and have greater name recognition, significantly longer operating histories, access to larger customer bases, larger marketing budgets, and significantly greater resources to devote to the research, development, promotion, and sale of their products and services than we do.

This may allow our competitors to respond more effectively than us to new or emerging technologies and changes in market conditions.

3 unchanged sentences

These vendors include, without limitation:

Anaplan, Inc., ADP, Coupa Software Inc., Dayforce, Inc., Infor, Inc., Microsoft Corporation, and UKG Inc.

Anaplan, Inc., ADP, Coupa Software Inc., Dayforce, Inc., Microsoft, ServiceNow, Inc., and UKG Inc.

We may also face greater competition from non-specialist solutions relying on generic large language models (“LLMs”), generative AI, and general-purpose agents to address a broad range of business needs.

In order to take advantage of customer demand for cloud and AI-powered applications, legacy vendors are expanding their cloud or AI-powered applications through acquisitions, strategic alliances, and organic development.

In addition, other cloud or AI platform companies that provide services in different target markets or industries may develop applications or acquire companies that operate in our target markets or industries, and some potential customers may elect to develop their own internal applications.

As the market matures and as existing and new market participants introduce new types of technologies, such as generative and agentic AI, and different approaches that enable organizations to address their HCM and financial needs, we expect this competition to intensify in the future.

As the market evolves and as existing and new market participants introduce new types of technologies, such as generative and agentic AI, and different approaches that enable organizations to address their HCM and financial needs, our ability to maintain market differentiation may affect our competitive position.

Furthermore, our current or potential competitors may be acquired by, or merge with, third parties with greater available resources and the ability to initiate or withstand substantial price competition.

Our competitors may also establish cooperative relationships among themselves or with third parties that may further enhance their offerings or resources.

Our competitors may also establish cooperative relationships among themselves or with third parties that may further enhance their offerings, integrations, or resources.

Many of our competitors also have major distribution agreements with consultants, system integrators, and resellers and such partners may prefer to maintain their existing relationships with competitors.

With the introduction of new technologies, such as generative AI, we expect competition to intensify in the future.

If our competitors’ products, services, or technologies become more accepted than our products, if they are successful in bringing their products or services to market earlier than ours, or if their products or services are more technologically capable than ours, then our revenues could be adversely affected.

As we attempt to sell our products and solutions to potential and current customers, we must demonstrate that our products and solutions are superior to other solutions available to their organizations, including generic LLMs, software created using natural language prompts and generative AI (referred to as vibe coding) and other emerging technologies.

If our competitors’ products, services, or technologies, including generative and agentic AI capabilities, become more accepted than our products, if their customer support efforts are preferred by customers, if they are successful in bringing their products or services to market earlier than ours, if they scale at a faster rate, or if their products or services are more technologically capable or resonate more with the market than ours, including having more or easier to use integrations for software solutions used and preferred by our customers, then our revenues could be adversely affected.

In addition, our competitors may offer their products and services at a lower price, or may offer price concessions, delayed payment terms, financing terms, or other terms and conditions that are more enticing to potential customers.

Due to the complex nature of implementing financial management solutions, the lifecycle of the contracts for such solutions tends to be long.

Therefore, if we lose a current customer to a competitor or fail to secure a prospective customer for financials management solutions, there is a long duration before we will be able to approach that customer again with our sales efforts for such solutions.

Therefore, if we lose a current customer to a competitor or fail to secure a prospective customer for financial management solutions, there is a long duration before we will be able to approach that customer again with our sales efforts for such solutions.

Pricing pressures and increased competition could result in reduced sales, reduced margins, losses, or a failure to maintain or improve our competitive market position, any of which could adversely affect our business and operating results.

We may lose key employees or be unable to attract, enable, and retain highly skilled employees.

Our success and future growth depend largely upon the continued services of our executive officers, other members of senior management, and other key employees.

We have and may continue to execute our growth plan through strategic investments to attract and retain executive officers, senior management, or other key employees that may not be offset by increased performance or revenues.

In February 2026, Aneel Bhusri, formerly Executive Chair, assumed the role of CEO and Carl Eschenbach ceased to serve as CEO.

Key employee and executive leadership changes have the potential to disrupt our business, impact our ability to preserve our culture, negatively affect our ability to attract and retain talent, or otherwise have a serious adverse effect on our business and operating results.

To execute our growth plan, we must attract, enable, develop, and retain highly qualified talent.

Our ability to compete and succeed in a highly competitive environment is directly correlated to our ability to recruit and retain highly skilled and experienced employees, especially in the areas of product development, cybersecurity, senior sales executives, and engineers with significant experience in designing and developing software and internet-related services, especially in AI and emerging technologies.

The expansion of our sales infrastructure, both domestically and internationally, is necessary to grow our customer base and business.

Our business may be adversely affected if our efforts to attract and enable new members of our direct sales force do not generate a corresponding increase in revenues.

We have experienced, and we expect to continue to experience, significant competition in hiring and retaining employees with appropriate qualifications.

We must also continue to retain, develop, and motivate existing employees through our compensation practices, company culture, and career development opportunities.

The compensation and incentives we have available to attract, retain, and motivate employees may not meet the expectations of current and prospective employees as the competition for talent intensifies.

For example, our equity awards may become less effective if our stock price decreases or increases at a slower rate than our talent competitors.

We believe that a critical component of our success has been our corporate culture and our core values.

As we continue to grow and change, we may find it difficult to maintain our corporate culture among a larger number of employees who are dispersed throughout various geographic regions, including difficulties due to managing the complexities of communicating with all employees.

Efforts to restructure our workforce may be disruptive and adversely impact employee morale or our corporate culture.

We rely on our network of partners to drive additional growth of our revenues, and if these partners fail to perform, our ability to sell and distribute our products may be impacted, and our operating results and growth rate may be harmed.

1 unchanged sentence

If the operations of these partners are disrupted, including as a direct or indirect result of recent macroeconomic conditions, our own operations may suffer, which could adversely impact our operating results.

Identifying partners, and negotiating and documenting relationships with them, requires significant time and resources, and we cannot ensure that these partnerships will result in increased customer adoption or usage of our applications or increased revenue.

Identifying partners, negotiating and documenting relationships with them, and marketing and promoting partnerships requires significant time and resources, and we cannot ensure that these partnerships will result in increased customer adoption or usage of our applications or increased revenue.

We may be at a disadvantage if our competitors are effective in providing incentives to our current or potential partners to favor their products or services or to prevent or reduce subscriptions to our services, or in negotiating better rates or terms with such partners, particularly in international markets where our potential partners may have existing relationships with our competitors.

1 unchanged sentence

Our partner training and educational programs may not be effective or utilized consistently by partners.

New partners may require extensive training and/or may require significant time and resources to achieve productivity.

Changes to our direct go-to-market models may cause friction with our partners and may increase the risk in our partner ecosystem.

The actions of our partners may subject us to lawsuits, potential liability, and reputational harm if, for example, any of our partners misrepresent the functionality of our products to customers, fail to perform services to our customers’ expectations, or violate laws or our corporate policies.

In addition, our partners may utilize our platform to develop products and services that could potentially compete with products and services that we offer currently or in the future.

New partners may require extensive training and/or may require significant time and resources to achieve productivity, and such requirements may deter potential partners due to the significant time and financial investment required.

Changes to our direct go-to-market models and expanded product and service offerings may cause friction with our partners, require increased time and financial investment, and may increase the risk in our partner ecosystem.

The actions of our partners may subject us to lawsuits, potential liability, and reputational harm if, for example, any of our partners misrepresent the functionality of our products to prospective or current customers, fail to perform services to our customers’ expectations, or violate laws or our corporate policies, such as laws and policies around privacy, cybersecurity, and responsible AI.

In addition, we resell certain products and services offered by our partners and could incur potential liability and reputational harm if our partners fail to provide such products and services as represented to customers.

Our partners may utilize our platform to develop products and services that could potentially compete with products and services that we offer currently or in the future.

Concerns over competitive matters or intellectual property ownership could constrain these partnerships.

If we fail to effectively manage and grow our network of partners, maintain good relationships with our partners, or properly monitor the quality and efficacy of their service delivery, or if our partners do not effectively market and sell our subscription services, use greater efforts to market and sell their own products or services or those of our competitors, or fail to meet the needs or expectations of our customers, our ability to sell our products and efficiently provide our services may be impacted, and our operating results and growth rate may be harmed.

Sales to customers outside the United States or with international operations expose us to risks inherent in global operations.

The growth of our business and future prospects depends on our ability to increase our sales outside of the United States as a percentage of our total revenues.

Operating globally requires significant resources and management attention and subjects us to regulatory, economic, and political risks that are different from those in the United States.

Our investments and efforts to further expand internationally may not be successful in creating additional demand for our applications outside of the United States or in effectively selling subscriptions to our applications in all of the markets we enter.

If we are not able to realize a return on our current development efforts or offer new features, enhancements, and modifications to our products and services that are desired by current or potential customers, our business and operating results could be adversely affected.

Developing software applications and related enhancements, features, and modifications, including those involving AI, including generative and agentic AI or other emerging technologies, is expensive, and the investment in product development often involves a long return on investment cycle.

We believe that we must continue to dedicate a significant amount of resources to our development efforts to maintain our competitive position.

Accelerated application introductions and short application life cycles require high levels of expenditures that could adversely affect our operating results if not offset by revenue increases.

However, we may not receive significant revenues from these investments for several years, if at all.

If we are unable to provide new features, enhancements to user experience, and modifications in a timely and cost-effective manner that achieve market acceptance, align with customer expectations, and that keep pace with rapid technological developments and changing regulatory landscapes, it may negatively impact our customer renewal rates, limit the market for our solutions, or impair our ability to attract new customers and our business and operating results could be adversely affected.

For example, AI is propelling advancements in technology, but if we fail to innovate and keep up with advancements in AI technology, if Workday’s AI-powered solutions, including our current and planned agentic AI solutions, fail to be delivered as planned or at all, fail to operate as expected or to meet customer expectations, if we fail to successfully monetize our AI-powered solutions, or if we do not have sufficient access to development resources and the technologies required to build and improve our applications, our business and reputation may be harmed.

If we are not able to realize a return on the investments we have made toward entering new markets and new lines of business, our business and operating results could be adversely affected.

We continue to seek opportunities to enter into new markets and/or new lines of business, some of which we may have very limited or no experience in.

For example, we have and continue to make significant targeted investments in entering the medium-enterprise and U.S.

federal government markets and see our success in these markets as key contributors to our future growth.

Additionally, we have made and continue to make significant investments in platform offerings and AI, including generative AI and agentic capabilities.

As an entrant to new markets and new lines of business, we may not be effective in convincing prospective customers that our solutions will address their needs, and we may not accurately estimate our infrastructure needs, human resource requirements, or operating expenses with regard to these new markets and new lines of business.

We may also fail to accurately anticipate adoption rates of these new lines of business or their underlying technology.

Also, we may not be able to properly price our solutions in these new markets, which could negatively affect our ability to sell to customers.

Furthermore, customers in these new markets or of the new lines of business may demand more or different features and professional services, which may require us to devote even greater research and development, sales, support, and professional services resources to such customers.

If we fail to generate adequate revenues from these new markets and lines of business, or if we fail to do so within the envisioned timeframe, it could have an adverse effect on our business, financial condition, and operating results.

Our international presence, continued expansion, and sales to customers outside the U.S.

or with international operations expose us to risks inherent in global operations.

The growth of our business and future prospects depends on our ability to further expand our operations and increase our sales outside of the U.S.

as a percentage of our total revenues.

Operating globally requires significant resources and management attention and subjects us to regulatory, economic, and political risks that are different from those in the U.S.

Our investments and efforts to further expand internationally may not be successful in creating additional demand for our applications outside of the U.S.

or in effectively selling subscriptions to our applications in all of the markets we enter.

Risks associated with doing business on a global scale that could adversely affect our business, include:

1 unchanged sentence

• the need to successfully develop and execute on a localized go-to-market strategy;

• the need to adhere to local laws and regulations, including those related to data localization, privacy, and anti-corruption;

• difficulties in appropriately staffing and managing foreign operations and providing appropriate compensation for local markets;

• difficulties in leveraging executive presence and maintaining company culture globally;

• the need to adhere to local laws and regulations, including those related to data localization, privacy, and anti-corruption, which may make it more difficult to penetrate certain international market segments with highly specialized compliance, contracting, and data sovereignty requirements;

• difficulties in appropriately staffing and managing foreign operations and providing appropriate compensation and benefits for local markets;

• difficulties in leveraging executive presence, maintaining company culture globally, and conforming with local cultural contexts and customs;

• increased travel, real estate, infrastructure, and legal and regulatory compliance costs associated with international operations;

• different pricing environments, longer sales cycles, and longer trade receivables payment cycles, and collections issues;

• new and different sources of competition;

• potentially weaker protection for intellectual property and other legal rights than in the United States and practical difficulties in enforcing intellectual property and other rights;

• laws, customs, and business practices favoring local competitors;

• restrictive governmental actions focused on cross-border trade, such as import and export restrictions, duties, quotas, tariffs, trade disputes, and barriers or sanctions, that may prevent us from offering certain portions of our products or services to a particular market, may increase our operating costs or may subject us to monetary fines or penalties;

• compliance challenges related to the complexity of multiple, conflicting, and changing governmental laws and regulations, including employment, tax, privacy, intellectual property, financial services, AI, and data protection laws and regulations;

• increased compliance costs related to government regulatory reviews or audits, including those related to international cybersecurity and environmental, social, and governance (“ESG”) requirements;

• potentially weaker protection for intellectual property and other legal rights than in the U.S.

and practical difficulties in enforcing intellectual property and other rights;

• laws, contracting approaches, customs, and business practices favoring local vendors over U.S.-based companies, which may be increased by geopolitical tensions;

• restrictive governmental actions focused on cross-border trade, such as import and export restrictions, duties, quotas, potential or imposed tariffs, trade disputes, and barriers or sanctions, as well as any retaliatory actions, that may prevent us from offering certain portions of our products or services to a particular market, may increase our operating costs, or may subject us to monetary fines or penalties;

• increased compliance costs related to government regulatory reviews or audits, including those related to international cybersecurity and sustainability requirements;

• increased financial accounting and reporting burdens and complexities;

9 unchanged sentences

If we are not able to successfully hedge against the risks associated with foreign currency fluctuations, our financial condition and operating results could be adversely affected.

We have acquired, and may in the future acquire, other companies, employee teams, or technologies, which could divert our management’s attention, result in additional indebtedness or dilution to our stockholders, and otherwise disrupt our operations and adversely affect our operating results.

We have acquired, and may in the future acquire, other companies, employee teams, or technologies to complement or expand our applications, enhance our technical capabilities, obtain personnel, or otherwise offer growth opportunities.

The pursuit of acquisitions may divert the attention of management, disrupt ongoing business, and cause us to incur various expenses in identifying, investigating, and pursuing suitable acquisitions, whether or not they are consummated.

These impacts may continue through integration activities.

Moreover, we may be unable to complete proposed transactions timely or at all for a variety of reasons, such as our failure to obtain any necessary funding, the failure to obtain required regulatory or other approvals, or the impact of litigation or other disputes.

We also may not achieve the anticipated benefits from an acquisition due to a number of factors, including:

• inability or difficulty integrating the intellectual property, technology infrastructure, and operations of the acquired business, including difficulty in addressing potential identified or unknown security risks or vulnerabilities of the acquired business or product;

• inability to retain key personnel or challenges in integrating the workforce from the acquired company, including the inability to maintain our culture and values;

• acquisition-related costs, liabilities, or tax impacts, some of which may be unanticipated;

• the impact on stockholder dilution and our operating results from the additional stock-based compensation issued in connection with the acquisition;

• difficulty in leveraging the data of the acquired business if it includes personal data;

• a failure to maintain the information systems of an acquired business, including difficulties in increasing or maintaining the security standards for acquired technology, which could increase the risk of a security breach of such system;

• a failure to implement, restore, or maintain controls, procedures, or policies at the acquired company and an increased risk of non-compliance;

• multiple product lines or service offerings as a result of our acquisitions that are offered, priced, and supported differently, as well as the potential for such acquired product lines and service offerings to impact the profitability of existing products;

• the opportunity cost of diverting management and financial resources away from other products, services, and strategic initiatives;

• difficulties and additional expenses associated with synchronizing product offerings, customer relationships, and contract portfolio terms and conditions between Workday and the acquired business;

• known and unknown liabilities or risks associated with the acquired businesses, including those arising from existing contractual obligations or litigation matters;

• adverse effects on our brand, reputation, or existing business relationships with business partners and customers as a result of the acquisition, including integrating acquired technologies and a delay in market acceptance of and difficulty in transitioning new and existing customers to acquired product lines or services;

• risks and challenges presented by the use of innovative technologies that we acquire, such as AI;

• potential write-offs of acquired assets and potential financial and credit risks associated with acquired customers;

• inability to maintain relationships with key customers, suppliers, and partners of the acquired business;

• difficulty in predicting and controlling the effect of integrating multiple acquisitions concurrently;

• lack of experience in new markets, products, or technologies;

• difficulty in integrating operations and assets of an acquired foreign entity with differences in language, culture, or country-specific currency and regulatory risks;

• the inability to obtain (or a material delay in obtaining) regulatory approvals necessary to complete transactions or to integrate operations, or potential remedies imposed by regulatory authorities as a condition to or following the completion of a transaction, which may include divestitures, ownership or operational restrictions or other structural or behavioral remedies;

• the failure of strategic acquisitions to perform as expected or to meet financial projections, which may be heightened due to recent macroeconomic events and market volatility.

In addition, a significant portion of the purchase price of companies we acquire has been and may in the future be allocated to acquired goodwill and other intangible assets, which must be assessed for impairment at least annually.

In the future, if our acquisitions do not yield expected returns, we may be required to take charges to our operating results based on this impairment assessment process, which could adversely affect our operating results.

Acquisitions could also result in use of substantial portions of our available cash, which may limit other potential uses of cash, and dilutive issuances of equity securities or the issuance of debt, which could adversely affect our operating results.

If we finance acquisitions by issuing debt, we could face constraints related to the terms of and repayment obligation related to the incurrence of such indebtedness.

In addition, if an acquired business fails to meet our expectations, our business, financial condition, and operating results may suffer.

Our business could be adversely affected if our users are not satisfied with the deployment, training, and support services provided by us and our partners.

Implementation of our applications may be technically complicated because they are designed to enable complex and varied business processes across large organizations, integrate data from a broad and complex range of workflows and systems, and may involve deployment in a variety of environments.

Incorrect or improper implementation or use of our applications could result in customer and user dissatisfaction and harm our business and operating results.

Incorrect or improper implementation or use of our applications, including generative and agentic AI capabilities, could result in customer and user dissatisfaction and harm our business and operating results.

In order for our customers to successfully implement our applications, they need access to highly skilled and trained service professionals.

Third parties provide a majority of deployment services for our customers, but professional services may also be performed by our own staff or by a combination of the two.

If customers are not satisfied with the quality and timing of work performed by us or a third party or with the type of professional services or applications delivered, or if we or a third party have not delivered on commitments made to our customers, then we could incur additional costs to address the situation, the revenue recognition of the contract could be impacted, and the dissatisfaction with our services could damage our ability to expand the applications subscribed to by our customers.

If customers are not satisfied with the quality, timing, and cost of work performed by us or a third party or with the type of professional services or applications delivered, or if we or a third party have not delivered on commitments made to our customers, then we could incur additional costs to address the situation, the revenue recognition of the contract could be impacted, and the dissatisfaction with our services could damage our ability to expand the applications subscribed to by our customers.

Negative publicity related to our customer relationships, regardless of its accuracy, may further damage our business by affecting our ability to compete for new business with current and prospective customers both domestic and abroad.

3 unchanged sentences

Our future success depends on the rate of customer subscription renewals, and our revenues or operating results could be adversely impacted if we do not achieve renewals at expected rates or on anticipated terms.

Our customers have no obligation to renew their subscriptions for our applications after the expiration of either the initial or renewed subscription period.

Our customers’ renewal rates fluctuate as a result of a number of factors, including their level of satisfaction with our applications and pricing, their awareness and adoption of the benefits and features of our applications, their ability to continue their operations and spending levels, reductions in their headcount, and the evolution of their business.

If our customers do not renew their subscriptions for our applications on similar pricing terms or renew for fewer elements of our applications, our revenues may decline, and we may not be able to meet our revenue projections, which could negatively impact our business and the market price of our Class A common stock.

Our customers have no obligation to renew their subscriptions for our applications after the expiration of either the initial or renewed subscription period and it is difficult to predict attrition rates given our varied customer base and the number of multi-year subscription contracts.

Our customers’ renewal rates fluctuate as a result of a number of factors, including our mix of customer base and their level of satisfaction with our offerings and pricing, their awareness and adoption of the benefits and features of our applications, their ability to continue their operations and spending levels, reductions in their headcount, the evolution of their business, and the macroeconomic environment.

Acquisitions of our customers by other companies have led, and could continue to lead, to cancellation of our contracts with those customers, thereby reducing the number of our existing and potential customers.

If our customers do not renew their subscriptions for our applications on similar pricing terms or renew for fewer elements of our offerings or for a lower headcount, our revenues may decline, and we may not be able to meet our revenue projections, which could negatively impact our business and the market price of our Class A common stock.

Our future success also depends, in part, on our ability to sell additional products to our current customers, and the success rate of such endeavors is difficult to predict, especially with regard to any new lines of business that we may introduce from time to time.

This has and may continue to require increasingly costly marketing and sales efforts that are targeted at senior management, and if these efforts are not successful, our business and operating results may suffer.

Additionally, acquisitions of our customers by other companies have led, and could continue to lead, to cancellation of our contracts with those customers, thereby reducing the number of our existing and potential customers.

The use of new and evolving technologies in our offerings at Workday, including AI, may result in reputational harm and increased litigation, and adversely affect our operating results.

We are increasingly building AI into the Workday product suite and have recently made announcements about our plans to embrace agentic AI.

Similarly, the rate at which our customers purchase new or enhanced services depends on a number of factors, including general economic conditions and customer receptiveness to any price changes related to these additional features and services.

The markets and monetization strategies for certain of our offerings, including our agentic AI solutions and Workday Data Cloud, remain relatively new and uncertain and as a result, our expansion into such offerings, and related investments, may present additional risks and challenges.

For example, we offer certain capabilities, including our AI agents, through Flex Credits, our new subscription-based flexible pricing model for certain AI solutions and platform capabilities, and may increase the number of products through which we do so.

We have limited experience with determining optimal pricing for Flex Credits-based contracts and may face customer resistance to new pricing models or have lower levels of customer adoption of our AI solutions than we expect, which could negatively impact our business and operating results.

The use of new and evolving technologies in our offerings at Workday, including generative and agentic AI capabilities, may result in reputational harm and increased litigation, and adversely affect our operating results.

We are increasingly building and integrating AI into the Workday product suite, including generative and agentic AI, and we are increasingly using AI products and technologies in the course of running our business at Workday.

As with many cutting-edge innovations, these technologies can present new risks and challenges.

A quickly evolving technical, legal, and regulatory environment may cause us to incur increased research and development costs, or divert resources from other development efforts, to address ethical, legal, operational, or compliance requirements or other issues related to AI.

For example, the European Union’s (“EU”) AI Act (“EU AI Act”) puts new requirements on providers of AI technologies and we are currently analyzing the EU AI Act to ensure compliance in alignment with various deadlines in the coming years.

Additionally, existing laws and regulations may apply to us in new ways, the nature and extent of which are difficult to predict and subject to change over time.

The risks and challenges presented by these technologies could undermine public confidence in AI, which could slow its adoption and affect our business.

Many of our products are powered by AI, some of which include the use of large language models and generative AI, for use cases that could potentially impact human, civil, privacy, or employment rights and dignities.

To the extent that our products and technologies rely on the use of large language models provided by third parties, we may face additional uncertainties and liabilities.

Any failure to accurately identify and address our responsibilities and liabilities in this uncertain environment, and adequately address relevant ethical and social issues that may arise with such technologies and use cases, as well as failure by others in our industry, or actions taken by our customers, employees, or end users (including misuse of these technologies), could negatively affect the adoption of our offerings and subject us to reputational harm, regulatory action, or litigation, which may harm our financial condition and operating results.

We already are defending against a lawsuit alleging that our products and services enable discrimination, and although we believe that such claims lack merit, and the majority of the claims have been dismissed, legal proceedings can be lengthy, expensive, and disruptive to our operations and customers (particularly where, as in the present litigation, the plaintiff may seek to also litigate against certain of Workday’s customers).

For example, the European Union’s (“EU”) AI Act (“EU AI Act”) puts new requirements on providers and deployers of AI technologies and we are currently working to ensure compliance with corresponding deadlines.

Additionally, existing laws and regulations apply to the development and deployment of AI in new ways, the nature and extent of which are difficult to predict and subject to change over time.

The risks and challenges presented by these technologies could undermine public confidence in AI and could increase costs and burdens to us and our customers, which could slow its adoption and affect our business.

Many of our products are powered by AI, some of which include the use of generative and agentic AI, for use cases that could potentially impact human, civil, privacy, or employment rights and dignities.

To the extent that the products and technologies we develop and deploy rely on the use of generative or agentic capabilities provided by third parties, we face additional uncertainties and liabilities, especially where such third-party capabilities may be insufficient, biased, inaccurate, or of poor quality.

Any failure to accurately identify and address our responsibilities and liabilities in this uncertain environment, including with respect to third-party capabilities, and to adequately address relevant ethical and social issues that may arise with such technologies and use cases, as well as failure by others in our industry or actions taken by our customers, employees, suppliers, or end users (including misuse of these technologies), could negatively affect the adoption of our offerings and subject us to reputational harm, regulatory action, or litigation, which may harm our financial condition and operating results.

We are currently defending against a lawsuit alleging that certain of our AI-related products and services enable discrimination, and although we believe that such claims lack merit, and the majority of the claims have been dismissed, legal proceedings can be lengthy, expensive, and disruptive to our operations and customers (particularly where, as in the present litigation, the plaintiff may seek to also litigate against certain of Workday’s customers).

We may be subject to other litigation and regulatory actions that may cause financial, competitive, and developmental impacts, and could lead to legal liability.

In addition, regardless of outcome, these types of claims could cause reputational harm to our brand, including our ability to sell newly acquired products that use AI.

Regardless of outcome, these types of claims have and could continue to cause reputational harm to our brand, including our ability to sell newly acquired products that use AI.

Our employees, customers, or customers’ employees who are dissatisfied with our public statements, policies, practices, or solutions related to the development and use of AI may express opinions that could introduce reputational or business harm, or cease their relationship with us.

Our quarterly results may fluctuate significantly and may not fully reflect the underlying performance of our business.

Our quarterly operating results, including our revenues, subscription revenue backlog, operating margin, profitability, and cash flow, may vary significantly in the future and period-to-period comparisons of our operating results may not be meaningful.

Accordingly, the results of any one quarter should not be relied upon as an indication of future performance.

Additionally, we typically sign a significantly higher percentage of agreements with new customers as well as renewal agreements with existing customers in the fourth quarter of each year, and this year-over-year compounding effect in billing patterns causes the value of invoices that we generate in the fourth quarter to continually increase in proportion to our billings in the other three quarters of our fiscal year.

Our quarterly financial results may fluctuate as a result of a variety of factors, including the risks described in this “Risk Factors” section, many of which are outside of our control, and as a result, may not fully reflect the underlying performance of our business.

The extent to which recent macroeconomic events could continue to impact our operating results will depend on future developments, which are highly uncertain and difficult to predict.

Fluctuations in our quarterly results and related impacts to any earnings guidance we may issue from time to time, including any modification or withdrawal thereof, may negatively impact the value of our securities.

If we are not able to realize a return on our current development efforts or offer new features, enhancements, and modifications to our services that are desired by current or potential customers, our business and operating results could be adversely affected.

Developing software applications and related enhancements, features, and modifications, including those involving AI, is expensive, and the investment in product development often involves a long return on investment cycle.

Accelerated application introductions and short application life cycles require high levels of expenditures that could adversely affect our operating results if not offset by revenue increases, and we believe that we must continue to dedicate a significant amount of resources to our development efforts to maintain our competitive position.

However, we may not receive significant revenues from these investments for several years, if at all.

For example, AI is propelling advancements in technology, but if we fail to innovate and keep up with advancements in AI technology, if Workday Illuminate solutions fail to be delivered as planned or at all, fail to operate as expected or to meet customer expectations, or if we do not have sufficient access to development resources and the technologies required to build and improve our applications, our business and reputation may be harmed.

If we fail to develop and maintain widespread positive awareness of our brand, our business may suffer.

We believe that developing and maintaining widespread positive awareness of our brand is critical to our growth.

However, brand promotion activities may not generate the awareness or increased revenues we anticipate, and even if they do, any increase in revenues may not offset the significant expenses we incur in building our brand.

If we fail to successfully promote and maintain positive awareness of our brand, or we fail to expand positive awareness of our newer solutions or products, we may fail to attract or retain customers necessary to realize a sufficient return on our brand-building efforts, or to achieve the widespread positive brand awareness that is critical for broad customer adoption of our applications and for the end user experience.

We believe that developing and maintaining widespread positive awareness of our brand is critical to our growth and that the importance of maintaining positive brand awareness will increase as competition in our markets increases.

Successfully promoting and maintaining our brand will depend on our ability to provide reliable solutions that meet the needs of our customers, our ability to successfully differentiate our products and solutions from those of our competitors, and the effectiveness of our marketing efforts.

We have and may continue to experience reputational harm from, among other things, the introduction of new products, features, or services that do not meet customer expectations;

3 unchanged sentences

backlash from customers, government entities, or other stakeholders that disagree with our product offering decisions or public policy, ethical, or political positions;

significant litigation or regulatory actions that negatively reflect on our business practices;

significant litigation or regulatory or government actions that negatively reflect on our business practices;

and data security breaches or compliance failures.

Additionally, the performance of our partners may affect our brand and reputation if customers do not have a positive experience with our partners’ solutions or services.

Any unfavorable publicity or perception of our brand or our applications, including any unfavorable candidate or end user experience, could negatively impact our ability to attract and retain customers and also make it more difficult to hire and retain employees.

5 unchanged sentences

To the extent that our applications depend upon the successful integration and operation of third-party software in conjunction with our software, any undetected errors or defects in this third-party software, as well as cybersecurity threats or attacks related to such software could prevent the deployment or impair the functionality of our applications, delay new application introductions, result in a failure of our applications, result in increased costs, including warranty and other related claims from customers, and injure our reputation.

As Workday Mobile becomes increasingly important to Workday’s customer experience, we also need to continuously modify and enhance our applications to keep pace with changes in third-party internet-related hardware, iOS, Android, other mobile-related operating systems, platforms, and technologies, and other third-party software, communication, browser, and database technologies, as well as with customer expectations.

Any failure of our applications to operate effectively with future network platforms and other third-party technologies, or changes in such technologies that degrade the functionality of our products or give preferential treatment to competitive services, could reduce the demand for our applications, result in customer and end user dissatisfaction, and adversely affect our business and operating results.

These impacts may continue through integration activities.

Moreover, we may be unable to complete proposed transactions timely or at all due to a failure to obtain any necessary funding to complete an acquisition in a timely manner or on favorable terms, the failure to obtain required regulatory or other approvals, litigation, or other disputes, which may obligate us to pay a termination fee.

We also may not achieve the anticipated benefits from an acquisition due to a number of factors, including:

• inability or difficulty integrating the intellectual property, technology infrastructure, and operations of the acquired business, including difficulty in addressing security risks of the acquired business;

• inability to retain key personnel or challenges in integrating the workforce from the acquired company, including the inability to maintain our culture and values;

• acquisition-related costs, liabilities, or tax impacts, some of which may be unanticipated;

• difficulty in leveraging the data of the acquired business if it includes personal data;

• a failure to maintain the information systems of an acquired business, which could increase the risk of a security breach of such system;

• a failure to implement, restore, or maintain controls, procedures, or policies at the acquired company and an increased risk of non-compliance;

• the opportunity cost of diverting management and financial resources away from other products, services, and strategic initiatives;

• unknown liabilities or risks associated with the acquired businesses, including those arising from existing contractual obligations or litigation matters;

• adverse effects on our brand or existing business relationships with business partners and customers as a result of the acquisition, including integrating acquired technologies and a delay in market acceptance of and difficulty in transitioning new and existing customers to acquired product lines or services;

• risks and challenges presented by the use of innovative technologies that we acquire, such as AI;

• potential write-offs of acquired assets and potential financial and credit risks associated with acquired customers;

• inability to maintain relationships with key customers, suppliers, and partners of the acquired business;

• difficulty in predicting and controlling the effect of integrating multiple acquisitions concurrently;

• lack of experience in new markets, products, or technologies;

• difficulty in integrating operations and assets of an acquired foreign entity with differences in language, culture, or country-specific currency and regulatory risks;

• the failure of strategic acquisitions to perform as expected or to meet financial projections, which may be heightened due to recent macroeconomic events and market volatility.

In addition, a significant portion of the purchase price of companies we acquire may be allocated to acquired goodwill and other intangible assets, which must be assessed for impairment at least annually.

Moreover, we may experience additional or unexpected changes in how we are required to account for our acquisitions pursuant to U.S.

generally accepted accounting principles (“GAAP”), including arrangements that we may assume in an acquisition.

If we finance acquisitions by issuing debt, we could face constraints related to the terms of and repayment obligation related to the incurrence of such indebtedness.

In addition, if an acquired business fails to meet our expectations, our business, financial condition, and operating results may suffer.

If we are not able to realize a return on the investments we have made toward entering new markets and new lines of business, our business and operating results could be adversely affected.

We continue to seek opportunities to enter into new markets and/or new lines of business, some of which we may have very limited or no experience in.

We may also fail to accurately anticipate adoption rates of these new lines of business or their underlying technology.

Also, we may not be able to properly price our solutions in these new markets, which could negatively affect our ability to sell to customers.

Furthermore, customers in these new markets or of the new lines of business may demand more features and professional services, which may require us to devote even greater research and development, sales, support, and professional services resources to such customers.

We operate on a global scale, and as a result, our business and revenues are impacted by global economic and geopolitical conditions.

Global economic developments, including new or increased tariffs, geopolitical volatilities, downturns or recessions, political instability, and global health crises may negatively affect us or our ability to accurately forecast and plan our future business activity.

In addition, volatile economic and geopolitical situations have led and could lead to further economic disruption.

Our future revenues rely on continued demand by existing customers and the acquisition of new customers who may be subject to economic hardship due to recent macroeconomic events, including concerns about the impact of potential or imposed tariffs, inflation or the interest rate environment, and may delay or reduce their enterprise software spending to preserve capital and liquidity.

Our quarterly results may fluctuate significantly and may not fully reflect the underlying performance of our business.

Accordingly, the results of any one quarter should not be relied upon as an indication of future performance.

The extent to which recent macroeconomic events could continue to impact our operating results will depend on future developments, which are highly uncertain and difficult to predict.

Catastrophic or climate-related events may disrupt our business.

Our corporate headquarters are located in Pleasanton, California, and we have data centers and partner with public cloud service providers located in the United States and Europe.

The west coast of the United States contains active earthquake zones and the southeast is subject to seasonal hurricanes or other extreme weather conditions.

Our corporate headquarters are located in Pleasanton, California, and we host our applications in data centers operated by third parties located in the U.S., Europe, Canada, and the Asia-Pacific region.

The west coast of the U.S.

contains active earthquake zones and the southeast is subject to seasonal hurricanes or other extreme weather conditions.

Additionally, we rely on internal technology systems, our website, our network, and third-party infrastructure and enterprise applications, which are located in a wide variety of regions, for our development, marketing, operational support, hosted services, and sales activities.

In the event of a major earthquake, hurricane, or other natural disaster, or a catastrophic event such as fire, power loss, telecommunications failure, vandalism, civil unrest, cyber-attack, geopolitical instability, war, terrorist attack, insurrection, pandemics or other public health emergencies, or the effects of climate change (such as drought, flooding, heat waves, wildfires, increased storm severity, and sea level rise), we may be unable to continue our operations and have, and may in the future, endure system interruptions, and may experience delays in our product development, lengthy interruptions in our services, breaches of data security, and loss of critical data, all of which could cause reputational harm or otherwise have an adverse effect on our business and operating results.

In the event of a major earthquake, hurricane, or other natural disaster, or a catastrophic event such as fire, power loss, telecommunications failure, vandalism, civil unrest, cyber-attack, geopolitical instability, war, terrorist attack, acts of violence, insurrection, pandemics or other public health emergencies, or the effects of climate change (such as drought, flooding, heat waves, wildfires, increased storm severity, and sea level rise), we may be unable to continue our operations and have, and may in the future, endure system interruptions, and may experience delays in our product development, lengthy interruptions in our services, breaches of data security, and loss of critical data, all of which could cause reputational harm or otherwise have an adverse effect on our business and operating results.

In addition, the impacts of climate change on the global economy and our industry are rapidly evolving.

We may be subject to increased regulations, reporting requirements, standards, or stakeholder expectations regarding climate change that may impact our business, financial condition, and operating results.

Our aspirations and disclosures related to ESG matters expose us to risks that could adversely affect our reputation and performance.

The positions we take on ESG matters, human capital management initiatives, and ethical issues from time to time may impact our brand, reputation, or ability to attract or retain customers.

In particular, our brand and reputation are associated with our public commitments to environmental sustainability (including our science-based targets), strong corporate governance practices, equality, inclusivity, and ethical use, and any perceived changes in our dedication to these commitments could impact our relationships with potential and current customers, employees, stockholders, and other stakeholders.

These commitments reflect our current plans and aspirations and are not guarantees that we will be able to achieve them.

Our failure to accomplish or accurately track and report on these goals on a timely basis, or at all, could adversely affect our reputation, financial performance, and growth, and expose us to increased scrutiny from the investment community as well as enforcement authorities.

Our ability to achieve any ESG objective is subject to numerous risks, many of which are outside of our control.

Examples of such risks include:

• the availability and cost of low- or non-carbon-based energy sources;

• the evolving regulatory requirements affecting ESG standards or disclosures;

• the ability of suppliers to meet our sustainability and other ESG standards;

• our ability to recruit, develop, and retain diverse talent in our global labor markets;

• the availability and cost of high-quality verified emissions reductions and renewable energy credits;

• the ability to renew existing or execute on new virtual power purchase agreements.

Standards for tracking and reporting ESG matters continue to evolve.

In addition, our processes and controls may not always comply with evolving standards for identifying, measuring, and reporting ESG metrics, including ESG-related disclosures that may be required of public companies by the SEC or other regulatory bodies, and such standards may change over time, which could result in significant revisions to our current goals, reported progress in achieving such goals, or ability to achieve such goals in the future.

It is likely that increasing regulatory requirements and regulatory scrutiny related to ESG matters will continue to expand globally and result in higher associated compliance costs.

Further, we may rely on data and calculations provided by third parties to measure and report our ESG metrics and if the data input or calculations are incorrect or incomplete, our brand, reputation, and financial performance may be adversely affected.

If our ESG practices do not align with or meet evolving investor or other stakeholder expectations and standards, then our reputation, our ability to attract or retain employees, and our attractiveness as an investment, business partner, acquirer, or service provider could be negatively impacted.

For example, an increasing number of stakeholders, regulators, and lawmakers have expressed or pursued contrary views towards ESG initiatives, including the proposal or enactment of “anti-ESG” policies, legislation, executive orders, or initiatives or the issuance of related legal opinions.

Conflicting regulations and a lack of harmonization of ESG legal and regulatory environments across the jurisdictions in which we operate may create enhanced compliance risks and costs.

We may also face increasing scrutiny from our investors, customers, employees, and other stakeholders relating to the appropriate role of ESG practices and disclosure.

Further, our failure or perceived failure to pursue or fulfill our goals and objectives or to satisfy various reporting standards on a timely basis, or at all, could have similar negative impacts or expose us to government enforcement actions and private litigation.

Our disclosures related to corporate responsibility and sustainability-related matters expose us to risks that could adversely affect our reputation and performance.

The positions we take on corporate responsibility and sustainability-related matters, human capital management initiatives, and ethical issues from time to time may impact our brand, reputation, or ability to attract or retain customers.

In particular, our brand and reputation are associated with our environmental sustainability commitments (including our science-based targets), strong corporate governance practices, inclusivity, and ethical use, and any perceived changes in our dedication to these commitments could impact our relationships with potential and current customers, employees, stockholders, and other stakeholders.

Standards and requirements for tracking and reporting corporate responsibility and sustainability-related matters continue to evolve.

Our failure to accomplish stated commitments or accurately track and report on these matters on a timely basis, or at all, could adversely affect our reputation and could expose us to increased scrutiny from the investment community as well as enforcement authorities.

In addition, our processes and controls may not always comply with evolving standards for identifying, measuring, and reporting sustainability metrics, including sustainability-related disclosures that may be required by various regulatory bodies, and such standards have and may continue to change over time.

If our sustainability or other corporate responsibility practices do not align with or meet evolving investor or other stakeholder expectations and standards, then our reputation, our ability to attract or retain employees, and our attractiveness as an investment, business partner, acquirer, or service provider could be negatively impacted.

Conflicting laws, regulations, and executive orders and a lack of harmonization of legal and regulatory environments and stakeholder expectations across the jurisdictions in which we operate may create enhanced compliance risks and costs.

Risks Related to Cybersecurity, Data Privacy, and Intellectual Property

8 unchanged sentences

The security measures we have in place vary in maturity across the organization and may not be sufficient to protect against security risks, preserve our operations and services and the integrity of customer and personal information, and prevent data loss, misappropriation, and other security breaches.

Our logging may also not be sufficient to fully investigate the scope of an incident.

Our information systems may be compromised by computer hackers, employees, contractors, or vendors, as well as software bugs, human error, technical malfunctions, or other malfeasance.

Cybersecurity threats and attacks are often targeted at companies such as ours and may take a variety of forms ranging from individuals or groups of security researchers, including those who appear to offer a solution to a vulnerability in exchange for some compensation, and insiders, to sophisticated hacker organizations, including state-sponsored actors who may launch coordinated attacks, such as retaliatory cyber-attacks stemming from the Russia-Ukraine conflict or attacks motivated by the type of data that is processed by our customers, including our public sector customers, on our platform.

In the normal course of business, we are and have been the target of malicious cyber-attack attempts and have experienced other security events.

As our market presence grows, we face increased risks of cybersecurity attack or other security threats.

Our logging may not be and has not been sufficient to fully investigate the scope of an incident.

Our information systems have been and may in the future be compromised by computer hackers, employees, contractors, or vendors, as well as software bugs, human error, technical malfunctions, or other malfeasance.

Cybersecurity threats and attacks are often targeted at companies such as ours and may take a variety of forms ranging from individuals or groups of security researchers, including those who appear to offer a solution to a vulnerability in exchange for some compensation, and insiders, to sophisticated hacker organizations, including state-sponsored actors who may launch coordinated attacks, or attacks motivated by the type of data that is processed by our customers, including our public sector customers, on our platform.

These threats may be directed not only at us, but also at third parties in our supply chain, including cloud service providers, software vendors, open-source software maintainers, and other service providers or partners whose products or services are integrated with or support our platform and solutions.

In the normal course of business, we are and have been the target of malicious cyber-attack attempts and have experienced other security events, including those involving attempts to exploit vulnerabilities in third-party technologies or services on which we rely.

As our market presence grows and as our ecosystem of partners, integrations, and service providers expands, we face increased risks of cybersecurity attack or other security threats, including supply chain attacks.

Additionally, as AI technologies, including generative AI models, develop rapidly, threat actors are using these technologies to create sophisticated new attack methods that are increasingly automated, targeted, and coordinated and more difficult to defend against.

Key cybersecurity risks range from viruses, worms, ransomware, and other malicious software programs, to phishing attacks, to fraud, to credential theft or abuse, to exploitation of software bugs or other defects, to targeted attacks against cloud services and other hosted software, to exploitation of unmanaged software or systems, any of which can result in a compromise of our applications or systems and the data we store or process, disclosure of Workday confidential information and intellectual property, production downtimes, reputational harm, and an increase in costs to the business.

As the techniques used to obtain unauthorized access or sabotage systems change frequently, are becoming increasingly sophisticated and complex, and often are not identified until they are launched against a target, and because evidence of unauthorized activity may not have been captured or retained, or may be proactively destroyed by unauthorized actors, we may be unable to anticipate these attacks, assess the true impact they may have on our business and operations, or to implement adequate preventative measures.

Future cyber-attacks and other security events may have a significant or material impact on our business and operating results.

Threat actors may also target our AI models in ways that we cannot yet anticipate.

Examples of key cybersecurity risks include viruses, worms, ransomware, and other malicious software programs, along with social engineering attacks, fraud, credential theft or abuse, exploitation of software bugs or other defects, targeted attacks against cloud services and other hosted software, and exploitation of unmanaged software or systems, any of which can result in a compromise of our applications or systems and the data we store or process, and can result in disclosure of Workday confidential information and intellectual property, production downtimes, reputational harm, and an increase in costs to the business.

For example, in August 2025, we were targeted as part of a social engineering campaign against many large organizations, resulting in unauthorized access to some of our internal systems including some commonly available business contact information in our third-party customer relationship management platform.

As the techniques used to obtain unauthorized access or sabotage systems change frequently, are becoming increasingly sophisticated and complex, and often are not identified until they are launched against a target, and because evidence of unauthorized activity may not have been captured or retained, or may be proactively destroyed by unauthorized actors, we may be unable to anticipate or timely detect these attacks, assess the true impact they may have on our business and operations, or to implement adequate preventative measures.

Any cyber-attacks and other security events may have a significant or material impact on our business and operating results.

There may also continue to be attacks targeting any vulnerabilities in our applications, internally built infrastructure, enhancements, and updates to our existing offerings, or in the many different underlying networks and services that power the internet that our products depend on, most of which are not under our control or the control of our vendors, partners, or customers.

2 unchanged sentences

In addition, our software development practices have not and may not identify all potential privacy or security issues, and inadvertent disclosures of data have occurred and may occur again.

Additionally, remote work and resource access, including our hybrid work model, has and may continue to result in an increased risk of cybersecurity-related events such as phishing attacks, exploitation of any cybersecurity flaws that may exist, an increase in the number cybersecurity threats or attacks, and other security challenges as a result of our employees and our service providers continuing to work remotely from non-corporate managed networks.

Additionally, remote work and resource access, including our hybrid work model, has and may continue to result in an increased risk of cybersecurity-related events, including phishing and other social engineering attacks, exploitation of any cybersecurity flaws that may exist, an increase in the number cybersecurity threats or attacks, and other security challenges as a result of our employees and our service providers continuing to work remotely from non-corporate managed networks.

These risks may be further heightened by efforts by malicious actors to obtain or misuse authorized access credentials through deception or impersonation, including by posing as legitimate employees, contractors, or by infiltrating our workforce or service providers through fraudulent recruitment, onboarding, or credential-harvesting activities.

If successful, such attacks could enable threat actors to gain persistent access to our systems, move laterally within our environment, exfiltrate sensitive data, disrupt operations, or facilitate additional cyber-attacks, and may be more difficult to detect or prevent due to the use of seemingly legitimate accounts and remote access tools.

Furthermore, we have acquired or partnered with a number of companies, products, services, and technologies over the years, and incorporated third-party products, services, and technologies into our own products and services.

11 unchanged sentences

or could otherwise adversely affect our business, financial condition, operating results, or reputation.

Privacy concerns, evolving regulation of cloud computing, cross-border data transfer, and other domestic or foreign laws and regulations may reduce the adoption of our applications, result in significant costs and compliance challenges, and adversely affect our business and operating results.

Legal requirements related to collecting, storing, handling, retaining, and transferring (collectively, “processing”) personal data are rapidly evolving at both the national and international level in ways that require our business to adapt to support customer compliance.

As the complexity of our products grow, the regulatory focus on privacy intensifies worldwide, and jurisdictions increasingly consider and adopt privacy laws, the risks related to processing personal data by our business also grow.

In addition, possible adverse interpretations of existing privacy-related laws and regulations by governments in countries where our customers operate, as well as the potential implementation of new legislation, could impose significant obligations in areas affecting our business or prevent us from offering certain services in jurisdictions where we operate.

Following the EU’s passage of the General Data Protection Regulation (“GDPR”), which became effective in May 2018, the global data privacy compliance landscape has grown increasingly complex, fragmented, and financially relevant to business operations.

Privacy concerns, evolving regulation of cloud computing, cross-border data transfer, and other domestic or foreign laws and regulations, including those that seek to regulate access to data, may reduce the adoption of our applications, result in significant costs and compliance challenges, and adversely affect our business and operating results.

As the complexity of our products grows, the regulatory focus on privacy intensifies worldwide, and jurisdictions increasingly consider and adopt privacy laws, the risks related to our business’s processing of personal data also grow.

In addition, possible adverse interpretations of existing privacy-related laws and regulations by regulators in jurisdictions where our customers operate, as well as the potential adoption of new privacy-related requirements, could impose significant obligations affecting our business or prevent us from offering certain services in jurisdictions where we operate.

Over the past five years, the global data privacy compliance landscape has grown increasingly complex, fragmented, and financially relevant to business operations.

As a result, our data processing creates current and prospective risks related to increased regulatory compliance costs, government enforcement actions and/or financial penalties for non-compliance, and reputational harm.

For example, a new EU-U.S.

Data Privacy Framework (“DPF”) is in place under which EU data can legally be transferred to the United States.

However, it is expected to face legal challenges.

Until challenges to the DPF make their way through the court system, uncertainty may continue about the legal requirements for transferring customer personal data to and from Europe, an integral process of our business that remains governed by, and subject to, GDPR requirements.

Failure to comply with the GDPR data processing requirements by either ourselves or our subcontractors could lead to regulatory enforcement actions, which can result in monetary penalties of up to 4% of worldwide revenue, private lawsuits, reputational damage, and loss of customers.

Other countries such as Russia, China, and India have also passed laws imposing varying degrees of restrictive data residency requirements.

Regulatory developments in the United States present additional risks.

For example, the EU-U.S.

Data Privacy Framework (“DPF”) is in place under which EU data can legally be transferred to the U.S.

However, it is facing legal challenges.

As legal challenges to the DPF remain unresolved, uncertainty may continue regarding the legal requirements for transferring personal data from Europe, an integral aspect of our business that remains governed by, and subject to, General Data Protection Regulation (“GDPR”) requirements.

Failure to comply with the GDPR data processing requirements by either ourselves or our subprocessors could lead to regulatory enforcement actions, which can result in monetary penalties of up to 4% of worldwide revenue, private lawsuits, reputational damage, and loss of customers.

Other new EU laws, including the EU Data Act, which primarily governs access to and use of non-personal data generated by digital services, have been, and may continue to be implemented, interpreted, and enforced in ways that impose additional rules and restrictions on the deployment, operation, or use of our products and services and may require us to adapt our business practices or contractual arrangements to comply with such requirements.

Other countries such as Russia, China, Vietnam, and India have also passed or are in the process of passing laws imposing new requirements, including requirements related to consent and varying degrees of restrictive data residency or localization.

Regulatory developments in the U.S.

present additional risks.

For example, the California Consumer Privacy Act (“CCPA”) took effect on January 1, 2020, and the California Privacy Rights Act (“CPRA”), which expands upon the CCPA, came into effect on January 1, 2023.

The CCPA and CPRA give California consumers, including employees, certain rights similar to those provided by the GDPR, and also provide for statutory damages or fines on a per violation basis that could be very large depending on the severity of the violation.

Numerous states have enacted, or are considering, privacy laws as well, creating a patchwork of state laws that may create compliance challenges.

In addition, numerous states have enacted, or are considering, comprehensive privacy laws and other laws that touch on the processing of personal data in specific contexts, including in connection with artificial intelligence and automated systems, further contributing to a fragmented and evolving regulatory landscape that has and may continue to create compliance challenges.

Additionally, a final rule issued by the U.S.

Department of Justice establishing a “Data Security Program” came into effect on April 8, 2025.

The rule prohibits or restricts certain transactions that could result in access to bulk U.S.

sensitive personal data or U.S.

government-related data by countries of concern, including China (which includes Hong Kong and Macau).

The rule imposes certain diligence, security, audit and record-keeping requirements, and may adversely impact certain of our global business operations, including by restricting or conditioning certain data access or transfers involving subsidiaries, affiliates, and vendors.

Furthermore, the U.S.

Congress is considering numerous privacy bills, and the U.S.

Federal Trade Commission continues to fine companies for unfair or deceptive data protection practices and may undertake its own privacy rulemaking exercise.

In addition to government activity, privacy advocacy and other industry groups have established or may establish various new, additional, or different self-regulatory standards that customers may require us to adhere to and which may place additional burdens on us.

Increasing sensitivity of individuals to unauthorized processing of personal data, whether real or perceived, and an increasingly uncertain trust climate has and may continue to create a negative public reaction to technologies, products, and services such as ours or otherwise expose us to liability.

Taken together, the costs of compliance with and other obligations imposed by data protection laws and regulations may require modification of our services, limit use and adoption of our services, reduce overall demand for our services, lead to significant fines, penalties, or liabilities for noncompliance, or slow the pace at which we close sales transactions, or otherwise cause us to modify our operations, any of which could harm our business.

The data protection laws set forth requirements impacting how personal data must be stored, accessed, and deleted within the products.

The perception of privacy concerns, whether or not valid, may inhibit the adoption, effectiveness, or use of our applications or otherwise impact our business.

Federal Trade Commission continues to bring enforcement actions for unfair or deceptive data protection practices and may undertake its own privacy-related rulemaking.

Increasing sensitivity of individuals to the unauthorized processing of personal data, whether real or perceived, and an increasingly uncertain trust climate has and may continue to create negative public reaction to technologies, products, and services such as ours or otherwise expose us to liability.

In addition, as AI technologies are increasingly used across the industry, including in connection with data analytics, automation, customer service, and decision-support features, the speed, scale, and complexity of data processing may increase, which may heighten data privacy risks.

AI-enabled or agentic AI features may be targeted, misused, or produce outputs or inferences that implicate personal data in ways that are difficult to anticipate or control, potentially resulting in regulatory scrutiny, litigation, or reputational harm, even in the absence of a data breach.

Taken together, the costs of compliance with and other obligations imposed by data protection laws and regulations have and may continue to require modification of our services and operations, limit use or adoption of our services, slow the pace at which we close sales transactions, or otherwise adversely affect our business.

In addition, data protection laws, regulations and related enforcement activities may lead to significant fines, penalties, or liabilities for noncompliance.

These requirements may impact how personal data must be stored, accessed, and deleted within the products and services and impose certain limitations on how it may be used or shared.

Further, the perception of privacy concerns, whether or not valid, may inhibit the adoption, effectiveness, or use of our applications or otherwise impact our business.

Compliance with applicable laws and regulations regarding personal data may require changes in services, business practices, or internal systems that result in increased costs, lower revenue, reduced efficiency, or greater difficulty competing with foreign-based firms which could adversely affect our business and operating results.

3 unchanged sentences

However, the steps we take to protect our intellectual property rights may be inadequate.

We have patent applications pending in the United States and throughout the world, but we may be unable to obtain patent protection for the technology covered in our patent applications.

We have patent applications pending in the U.S.

and throughout the world, but we may be unable to obtain patent protection for the technology covered in our patent applications.

In addition, any patents issued to us in the future may not provide us with competitive advantages or may be successfully challenged by third parties.

1 unchanged sentence

Despite our precautions, it may be possible for unauthorized third parties, including those affiliated with state-sponsored actors, to copy or reverse engineer our applications, including with the assistance of insiders, and use information that we regard as proprietary to create products and services that compete with ours.

Some license provisions protecting against unauthorized use, copying, transfer, and disclosure of our technology may be unenforceable under the laws of jurisdictions outside the United States.

In addition, the laws of some countries do not protect proprietary rights to the same extent as the laws of the United States.

Some license provisions protecting against unauthorized use, copying, transfer, and disclosure of our technology may be unenforceable under the laws of jurisdictions outside the U.S.

In addition, the laws of some countries do not protect proprietary rights to the same extent as the laws of the U.S.

We enter into confidentiality and invention assignment agreements with our employees and consultants and enter into confidentiality agreements with the parties with whom we have strategic relationships and business alliances.

14 unchanged sentences

Furthermore, from time to time we may introduce or acquire new products, including in areas where we historically have not competed, which could increase our exposure to patent and other intellectual property claims.

Our applications utilize open source software, and any failure to comply with the terms of one or more of these open source licenses could negatively affect our business.

Our applications include software covered by open source licenses, which may include, by way of example, GNU General Public License and the Apache License.

Few terms used in open source licenses have been interpreted by United States courts, and there is a risk that such licenses could be construed in a manner that imposes unanticipated conditions or restrictions on our ability to market our applications.

Our applications utilize open source software, including open source AI models and platforms, and our strategy of investing in and acquiring such technologies introduces new and heightened risks.

Any failure to comply with the terms of one or more of these open source licenses, or to manage the unique risks of open source AI, could negatively affect our business.

Our applications include software covered by open source licenses, which may include, by way of example, the GNU General Public License and the Apache License.

Furthermore, our strategy includes acquiring and investing in open-source AI platforms and utilizing AI models that may be governed by novel or untested licenses with ambiguous terms, use-based restrictions, or uncertain legal interpretation.

Few terms used in either traditional or new AI-focused open source licenses have been interpreted by U.S.

courts, and there is a risk that such licenses could be construed in a manner that imposes unanticipated conditions or restrictions on our ability to market our applications.

We attempt to comply with all open source licensing conditions that apply to our use of open source software.

By the terms of certain open source licenses, we could be required to release the source code of our proprietary software, and to make our proprietary software available under open source licenses, if we combine our proprietary software with open source software in a certain manner.

In the event that portions of our proprietary software are determined to be impacted by an open source license, we could be required to publicly release portions of our source code, re-engineer all or a portion of our technologies, or otherwise be limited in the use or licensing of our technologies, which could reduce or eliminate the value of our technologies, products, and services.

In addition, the license terms for certain previously open source software that we use have changed and the license terms for future versions of open source software that we use might change, requiring us to pay for a commercial license or re-engineer all or a portion of our technologies.

Our increasing integration of proprietary AI agents and platforms with open source components may heighten this “copyleft” risk.

In addition, the license terms for certain previously open source software or models that we use have changed and the license terms for future versions of open source software that we use might change, requiring us to pay for a commercial license or re-engineer all or a portion of our technologies.

In addition to risks related to open source license requirements, usage of open source software can lead to greater risks than use of third-party commercial software, as open source licensors generally do not provide warranties or controls on the origin of the software.

Many of the risks associated with usage of open source software cannot be eliminated and could negatively affect our business.

Beyond licensing compliance, our use of and investment in open source AI models and platforms create distinct and significant risks.

Open source AI models may be trained on data of unknown or uncertain provenance, which could include copyrighted or otherwise proprietary, confidential, or private information.

If our applications or the agents our customers build using our platforms incorporate such models, we could face claims for copyright infringement and other violations.

Open source AI components may also be subject to “data poisoning” and other security vulnerabilities.

Many of the risks associated with usage of open source software, particularly in the rapidly evolving field of AI, cannot be eliminated and could negatively affect our business.

Risks Related to Legal and Regulatory Matters

7 unchanged sentences

AI is the subject of ongoing review by various U.S.

governmental and regulatory agencies, and various U.S.

and international governmental and regulatory agencies, and various U.S.

states and other foreign jurisdictions are applying, or are considering applying, their cybersecurity, data protection, and product safety laws to AI and its uses or are considering general legal frameworks for AI and its uses, such as the EU AI Act.

4 unchanged sentences

These new technologies could subject us to additional litigation brought by private parties, which could be costly, time-consuming, and distracting to management and could result in substantial expenses and losses.

We are subject to risks related to government contracts and related procurement regulations, which may adversely impact our business and operating results.

Our contracts with federal, state, local, and foreign government entities are subject to various procurement regulations and other requirements relating to their formation, award, administration, and performance, which present certain risks and challenges not present in private commercial agreements.

These risks and challenges include varying governmental budgeting processes and appropriations, contracting policies and requirements, changes in governmental administrations and policies, fluctuations due to government spending cuts and shutdowns, pressure to reduce deficits through spending reductions, highly competitive and lengthy bidding processes, and adherence to complex regulatory requirements and executive orders, and may impact government spending or result in termination of government contracts or delays in contract awards, which could adversely affect our business and operating results.

Further, we have experienced and may in the future experience challenges by third parties to contracts awarded with government entities, and our contracting with certain government entities may result in negative publicity or reputational harm.

Laws and regulations provide public sector customers with various rights, many of which are not typically found in commercial contracts.

For example, some governmental contracts provide for termination by the government at any time, with or without cause, which can adversely affect our business and operating results and impact other existing or prospective government contracts.

federal, state, and local government and foreign government contracts are generally subject to government funding authorizations and appropriations, and contracts may also be terminated due to a lack of government funds.

Changes in government procurement policies, priorities, regulations, or technology initiatives may negatively impact our potential for growth in the government sector.

We have made, and may continue to make, significant investments to support our efforts to sell to government entities, including obtaining various authorizations and certifications.

For example, we have obtained authorization under FedRAMP, which allows us to participate in the U.S.

federal government market.

Such authorization is subject to rigorous compliance and if we were to lose our authorization, it could inhibit or preclude our ability to contract with certain U.S.

federal and state government customers.

If we fail to maintain FedRAMP authorization, we may fail to retain existing customers or attract new customers that rely on our authorization under FedRAMP, which could subject us to liability, result in reputational harm, and adversely impact our financial condition or operating results.

Government certification requirements applicable to our products and services may change, which could restrict our ability to sell into the public sector until we have received a certification or until we can account for these changes in our service or corporate controls.

We may be subject to additional audits and investigations relating to our government contracts, and any violations could result in various civil and criminal penalties and administrative sanctions, including termination of contracts, suspension of payments, payment of fines, and suspension or debarment from future government business, as well as harm to our reputation and financial results.

Adverse litigation results could have a material adverse impact on our business.

We are regularly involved with claims, suits, purported class or representative actions, and may be involved in regulatory and government investigations and other proceedings, involving competition, intellectual property, data security and privacy, bankruptcy, tax and related compliance, labor and employment, commercial disputes, and other matters.

Such claims, suits, actions, regulatory and government investigations, and other proceedings can impose a significant burden on management and employees, could prevent us from offering one or more of our applications, services, or features to others, could require us to change our technology or business practices, or could result in monetary damages, fines, civil or criminal penalties, reputational harm, or other adverse consequences.

Adverse outcomes in some or all of these claims may result in significant monetary damages or injunctive relief that could adversely affect our ability to conduct our business.

1 unchanged sentence

A material adverse impact in our consolidated financial statements could occur for the period in which the effect of an unfavorable outcome becomes probable and reasonably estimable.

We are subject to risks related to government contracts and related procurement regulations, which may adversely impact our business and operating results.

Our contracts with federal, state, local, and foreign government entities are subject to various procurement regulations and other requirements relating to their formation, administration, and performance, which could adversely impact our business and operating results.

Government certification requirements applicable to our platform may change and, in doing so, restrict our ability to sell into the governmental sector until we have attained the authorization to use or certification.

These laws and regulations provide public sector customers with various rights, many of which are not typically found in commercial contracts.

For example, some federal contracts provide for delays, interruptions, or termination by the government at any time, with or without cause, which can adversely affect our business and operating results and impact other existing or prospective government contracts.

Additionally, we have obtained authorization under FedRAMP, which allows us to participate in the U.S.

federal government market.

Such authorization is subject to rigorous compliance and if we were to lose our authorization, it could inhibit or preclude our ability to contract with certain U.S.

federal government customers.

In addition, some customers may rely on our authorization under FedRAMP to help satisfy their own legal and regulatory compliance requirements.

We may be subject to additional audits and investigations relating to our government contracts, and any violations could result in various civil and criminal penalties and administrative sanctions, including termination of contracts, refunding or suspending of payments, forfeiture of profits, payment of fines, and suspension or debarment from future government business.

Unanticipated tax laws or any change in the application of existing tax laws to us or our customers and unanticipated changes in our effective tax rate may adversely impact our profitability and financial results.

We operate and are subject to taxes in the United States and numerous other jurisdictions throughout the world.

Changes to federal, state, local, or international tax laws on income, sales, use, indirect, or other tax laws, statutes, rules, regulations, or ordinances on multinational corporations are currently being considered by the United States and other countries where we do business.

These contemplated legislative initiatives include, but are not limited to, changes to transfer pricing policies and definitional changes to permanent establishment that could be applied solely or disproportionately to services provided over the internet.

We operate and are subject to taxes in the U.S.

and numerous other jurisdictions throughout the world.

Changes to federal, state, local, or international tax laws on income, sales, use, indirect, or other tax laws, statutes, rules, regulations, or ordinances on multinational corporations have recently been enacted or are currently being considered by the U.S.

and other countries where we do business.

Contemplated legislative initiatives include, but are not limited to, changes to transfer pricing policies and definitional changes to permanent establishment that could be applied solely or disproportionately to services provided over the internet.

These contemplated tax initiatives, if finalized and adopted by countries, may ultimately impact our effective tax rate and could adversely affect our sales activity resulting in a negative impact on our operating results and cash flows.

3 unchanged sentences

If our customers must pay additional fines or penalties, it could adversely affect demand for our services.

Significant judgment is often required in the determination of our worldwide provision for (benefit from) income taxes.

Significant judgment is often required in the determination of our worldwide provision for income taxes.

Our effective tax rate could be impacted by changes in the valuation of deferred tax assets and liabilities and our ability to utilize them.

16 unchanged sentences

Prolonged decreases in our customers’ headcounts can materially impact our business and operating results in any given period.

We have a history of cumulative losses, and we may not sustain profitability on a GAAP basis in the future.

Until recently, we had incurred significant net losses on a GAAP basis since our inception in 2005 and our quarterly operating results may fluctuate in the future.

We expect our operating expenses to increase in the future due to substantial investments we have made and continue to make to acquire new customers and develop our applications, anticipated increases in sales and marketing expenses, product development expenses, operations costs, and general and administrative costs.

If our revenue growth does not meet estimates, we may not be able to adjust our spending quickly enough to avoid an adverse impact on our financial results, and therefore we may incur losses on a GAAP basis in the future.

Furthermore, to the extent we are successful in increasing our customer base, we may incur net losses in the acquisition period because some costs associated with acquiring customers are incurred up front, while subscription services revenues are generally recognized ratably over the terms of the agreements, which are typically three years or longer.

You should not consider any prior period GAAP-profitability and growth in revenues as indicative of our future performance.

We cannot ensure that we will continue to achieve or sustain GAAP profitability in the future.

Our current and future indebtedness may adversely affect our financial condition and operating results.

In April 2022, we issued $3.0 billion aggregate principal amount of senior notes, consisting of $1.0 billion aggregate principal amount of 3.500% notes due April 1, 2027 (“2027 Notes”), $750 million aggregate principal amount of 3.700% notes due April 1, 2029 (“2029 Notes”), and $1.25 billion aggregate principal amount of 3.800% notes due April 1, 2032 (“2032 Notes,” and together with the 2027 Notes and the 2029 Notes, “Senior Notes”).

In fiscal 2023, we issued $3.0 billion aggregate principal amount of senior notes, consisting of $1.0 billion aggregate principal amount of 3.500% notes due April 1, 2027 (“2027 Notes”), $750 million aggregate principal amount of 3.700% notes due April 1, 2029 (“2029 Notes”), and $1.25 billion aggregate principal amount of 3.800% notes due April 1, 2032 (“2032 Notes,” and together with the 2027 Notes and the 2029 Notes, “Senior Notes”).

Additionally, in April 2022, we entered into a credit agreement (“2022 Credit Agreement”) which provides for a revolving credit facility in an aggregate principal amount of $1.0 billion.

40 unchanged sentences

As of January 31, 2026, our Co-Founder and CEO Emeritus David Duffield, together with his affiliates, held voting rights with respect to approximately 39 million shares of Class B common stock and 0.1 million shares of Class A common stock.

As of January 31, 2025, our Co-Founder and Executive Chair, Aneel Bhusri, together with his affiliates, held voting rights with respect to approximately 8 million shares of Class B common stock and 0.4 million shares of Class A common stock.

As of January 31, 2026, our Co-Founder, CEO, and Chair of our Board of Directors, Aneel Bhusri, together with his affiliates, held voting rights with respect to approximately 8 million shares of Class B common stock and 0.4 million shares of Class A common stock.

In addition, Mr.

30 unchanged sentences

• changes in investor and analyst valuation models for our Class A common stock;

• the economy as a whole, political and regulatory uncertainty, and market conditions in our industry and the industries of our customers;

• announcements of technological innovations, new applications or enhancements to services, acquisitions, strategic alliances, or significant agreements by us or by our competitors;

2 unchanged sentences

• recruitment or departure of key personnel;

• the economy as a whole, political and regulatory uncertainty, and market conditions in our industry and the industries of our customers;

• trading activity by directors, executive officers, and significant stockholders, or the perception in the market that the holders of a large number of shares intend to sell their shares;

• actions instituted by activist shareholders or others, and our response to such actions;

• any future issuances of our securities;

7 unchanged sentences

We may not realize the anticipated long-term stockholder value of our share repurchase programs.

In February 2024, our Board of Directors authorized a program under which we were authorized to repurchase up to $500 million of our outstanding shares of Class A common stock.

In the third quarter of fiscal 2025, we had completed the repurchase authorization under this program.

In August 2024, our Board of Directors authorized the repurchase of up to $1.0 billion of our outstanding shares of Class A common stock (“August 2024 Share Repurchase Program”).

We have share repurchase programs under which we are authorized to repurchase shares of our Class A common stock.

Such repurchases may be made through open market transactions, including through the use of trading plans intended to qualify under Rule 10b5-1, through privately negotiated transactions, or by other means, in each case in accordance with applicable securities laws and other restrictions.

The August 2024 Share Repurchase Program has no expiration date, may be suspended or discontinued at any time, and does not obligate us to acquire any amount of Class A common stock.

The share repurchase programs do not have an expiration date, may be suspended or discontinued at any time, and do not obligate us to acquire any amount of our Class A common stock.

Any failure to repurchase stock after we have announced our intention to do so may negatively impact our reputation and investor confidence in us and may negatively impact our stock price.

14 unchanged sentences

◦ vacancies on our Board of Directors will be able to be filled only by our Board of Directors and not by stockholders;

• only our chair of the board, chief executive officer, co-presidents, or a majority of our Board of Directors are authorized to call a special meeting of stockholders;

• only our chair of the board, lead independent director of the board, chief executive officer, presidents, or a majority of our Board of Directors are authorized to call a special meeting of stockholders;

• certain litigation against us can only be brought in Delaware;

28 unchanged sentences

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1A. Risk Factors