What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2026-08-27 compared with 2026-05-22 · 42 added, 62 removed, 583 unchanged (15% of the section changed)

33 unchanged sentences

• the limited ability of third parties to influence corporate matters due to our dual class structure and to seek a merger, tender offer, or proxy contest due to Delaware law and provisions in our organizational documents.

Table of Cont ents

Risks Related to Our Business and Industry

25 unchanged sentences

In addition, certain countries have implemented or may implement legislative and technological actions that either do or can effectively regulate access to the internet, including the ability of internet service providers to limit access to specific websites or content.

Table of Cont ents

Any changes in service levels with our infrastructure providers, or any errors, defects, disruptions, or other performance problems with our applications or the infrastructure on which they run, including internet infrastructure, could adversely affect our reputation and may damage our customers’ or other users’ data or result in lengthy interruptions in our services.

23 unchanged sentences

Pricing pressures and increased competition could result in reduced sales, reduced margins, losses, or a failure to maintain or improve our competitive market position, any of which could adversely affect our business and operating results.

Table of Cont ents

We may lose key employees or be unable to attract, enable, and retain highly skilled employees.

10 unchanged sentences

We must also continue to retain, develop, and motivate existing employees through our compensation practices, company culture, and career development opportunities.

The compensation and incentives we have available to attract, retain, and motivate employees may not meet the expectations of current and prospective employees as the competition for talent intensifies.

For example, our equity awards may become less effective if our stock price decreases or increases at a slower rate than our talent competitors.

The compensation and incentives we provide to attract, retain, and motivate employees may not meet the expectations of current and prospective employees as the competition for talent intensifies, and if our stock price decreases or increases at a slower rate than our talent competitors, our equity awards become less effective.

As a part of our annual refresh grant cycle in May 2026, we awarded additional equity grants to our most critical talent to bolster their commitment to our company and to further incentivize their performance towards our goals.

Further, our current and future office environments and hybrid work policy may not meet the expectations of our employees or prospective employees, and may amplify challenges in recruiting and retention.

9 unchanged sentences

In addition, acquisitions of our partners by our competitors could end our strategic relationship with such acquired partner and result in a decrease in the number of our current and potential customers.

Table of Cont ents

Our partner training and educational programs may not be effective or utilized consistently by partners.

12 unchanged sentences

If we are unable to provide new features, enhancements to user experience, and modifications in a timely and cost-effective manner that achieve market acceptance, align with customer expectations, and that keep pace with rapid technological developments and changing regulatory landscapes, it may negatively impact our customer renewal rates, limit the market for our solutions, or impair our ability to attract new customers and our business and operating results could be adversely affected.

For example, AI is propelling advancements in technology, but if we fail to innovate and keep up with advancements in AI technology, if Workday’s AI-powered solutions, including our current and planned agentic AI solutions, fail to be delivered as planned or at all, fail to operate as expected or to meet customer expectations, if we fail to successfully monetize our AI-powered solutions, or if we do not have sufficient access to development resources and the technologies required to build and improve our applications, our business and reputation may be harmed.

For example, AI is propelling advancements in technology, but rapid deployment of generative and agentic AI technologies can increase operational, legal, and reputational risks.

If we fail to innovate and keep up with advancements in AI technology;

if Workday’s AI-powered solutions, including our current and planned agentic AI solutions, fail to be delivered as planned or at all, fail to operate as expected, or fail to meet customer expectations;

if our AI solutions generate inaccurate, incomplete, or misleading outputs and if our customers rely on or use such outputs to their detriment;

if we fail to successfully monetize our AI-powered solutions;

or if we do not have sufficient access to development resources and the technologies required to build and improve our applications, our business and reputation may be harmed.

If we are not able to realize a return on the investments we have made toward entering new markets and new lines of business, our business and operating results could be adversely affected.

8 unchanged sentences

For example, we offer certain AI and platform capabilities through a subscription-based flexible pricing model and may increase the number of products through which we do so.

We have limited experience with determining optimal pricing under this model and expect a continued need for additional customer education within the sales cycle.

Consequently, we may have lower levels of adoption of our AI solutions than we expect, which could negatively impact our business and operating results.

Our success is dependent on our ability to determine optimal pricing under this model, our ability to educate customers and effectively market and sell our AI solutions, the level of adoption and usage of our AI solutions by our customers, and our costs to deliver these solutions.

Furthermore, customers in these new markets or of the new lines of business may demand more or different features and professional services, which may require us to devote even greater research and development, sales, support, and professional services resources to such customers.

If we fail to generate adequate revenues from these new markets and lines of business, or if we fail to do so within the envisioned timeframe, it could have an adverse effect on our business, financial condition, and operating results.

Table of Cont ents

Our international presence, continued expansion, and sales to customers outside the U.S.

34 unchanged sentences

The pursuit of acquisitions may divert the attention of management, disrupt ongoing business, and cause us to incur various expenses in identifying, investigating, and pursuing suitable acquisitions, whether or not they are consummated.

Table of Cont ents

These impacts may continue through integration activities.

17 unchanged sentences

• difficulty in predicting and controlling the effect of integrating multiple acquisitions concurrently;

• lack of experience in new markets, products, or technologies;

• lack of experience in new geographies, markets, products, or technologies;

• difficulty in integrating operations and assets of an acquired foreign entity with differences in language, culture, or country-specific currency and regulatory risks;

6 unchanged sentences

In addition, if an acquired business fails to meet our expectations, our business, financial condition, and operating results may suffer.

Table of Cont ents

Our business could be adversely affected if our users are not satisfied with the deployment, training, and support services provided by us and our partners.

16 unchanged sentences

Similarly, the rate at which our customers purchase new or enhanced services, including certain of our AI and platform capabilities that we offer through a subscription-based flexible pricing model, depends on a number of factors, including general economic conditions and customer receptiveness to any price changes related to these additional features and services.

Table of Cont ents

The use of new and evolving technologies in our offerings at Workday, including generative and agentic AI capabilities, may result in reputational harm and increased litigation, and adversely affect our operating results.

26 unchanged sentences

Any unfavorable publicity or perception of our brand or our applications, including any unfavorable candidate or end user experience, could negatively impact our ability to attract and retain customers and also make it more difficult to hire and retain employees.

Table of Cont ents

If we are unable to successfully integrate our applications with a variety of third-party technologies, our business and operating results could be adversely affected.

21 unchanged sentences

Fluctuations in our quarterly results and related impacts to any earnings guidance we may issue from time to time, including any modification or withdrawal thereof, may negatively impact the value of our securities.

Table of Cont ents

Catastrophic or climate-related events may disrupt our business.

21 unchanged sentences

damage our reputation and brand;

or result in loss of customer, consumer, and partner confidence in the security of our applications, an increase in our insurance premiums, suspension or loss of authorization under the Federal Risk and Authorization Management Program (“FedRAMP”) or other authorizations, impairment to our business, and other potential liabilities or related fees, expenses, or loss of revenues.

Table of Cont ents

result in loss of customer, consumer, and partner confidence in the security of our applications;

result in an increase in our insurance premiums, suspension or loss of authorization under the Federal Risk and Authorization Management Program (“FedRAMP”) or other authorizations;

impair our competitive position;

and result in other potential liabilities or related fees, expenses, or loss of revenues, any of which could adversely affect our business and operating results.

In the normal course of business, we are and have been the target of malicious cyber-attack attempts and have experienced and may in the future experience other security events, including the compromise of our information systems by computer hackers, employees, contractors, or vendors, as well as those involving attempts to exploit vulnerabilities in third-party technologies or services on which we rely and those involving software bugs, human error, technical malfunctions, or other malfeasance.

The financial and personnel resources we employ to implement and maintain security measures, including our information security risk insurance policy, may not be sufficient to address our security needs.

1 unchanged sentence

Our logging may not be and has not been sufficient to fully investigate the scope of an incident.

Our information systems have been and may in the future be compromised by computer hackers, employees, contractors, or vendors, as well as software bugs, human error, technical malfunctions, or other malfeasance.

Cybersecurity threats and attacks are often targeted at companies such as ours and may take a variety of forms ranging from individuals or groups of security researchers, including those who appear to offer a solution to a vulnerability in exchange for some compensation, and insiders, to sophisticated hacker organizations, including state-sponsored actors who may launch coordinated attacks, or attacks motivated by the type of data that is processed by our customers, including our public sector customers, on our platform.

These threats may be directed not only at us, but also at third parties in our supply chain, including cloud service providers, software vendors, open-source software maintainers, and other service providers or partners whose products or services are integrated with or support our platform and solutions.

In the normal course of business, we are and have been the target of malicious cyber-attack attempts and have experienced other security events, including those involving attempts to exploit vulnerabilities in third-party technologies or services on which we rely.

Cybersecurity threats and attacks are often targeted at companies such as ours and may take a variety of forms ranging from individuals or groups of security researchers, to insiders, to sophisticated hacker organizations, including state-sponsored actors and financially motivated actors.

These threats may be directed at us or at third parties in our supply chain, including cloud service providers, software vendors, open-source software maintainers, and other service providers or partners whose products or services are integrated with or support our platform and solutions.

As our market presence grows and as our ecosystem of partners, integrations, and service providers expands, we face increased risks of cybersecurity attack or other security threats, including supply chain attacks.

Additionally, as AI technologies, including generative AI models, develop rapidly, threat actors are using these technologies to create sophisticated new attack methods that are increasingly automated, targeted, and coordinated and more difficult to defend against.

Threat actors may also target our AI models in ways that we cannot yet anticipate.

Examples of key cybersecurity risks include viruses, worms, ransomware, and other malicious software programs, along with social engineering attacks, fraud, credential theft or abuse, exploitation of software bugs or other defects, targeted attacks against cloud services and other hosted software, and exploitation of unmanaged software or systems, any of which can result in a compromise of our applications or systems and the data we store or process, and can result in disclosure of Workday confidential information and intellectual property, production downtimes, reputational harm, and an increase in costs to the business.

For example, in August 2025, we were targeted as part of a social engineering campaign against many large organizations, resulting in unauthorized access to some of our internal systems including some commonly available business contact information in our third-party customer relationship management platform.

Threat actors may also target our AI models and related infrastructure in ways that we cannot yet anticipate.

Further, remote work and resource access, including our hybrid work model, has and may continue to result in an increased risk of cybersecurity-related events, including phishing and other social engineering attacks, exploitation of any cybersecurity flaws that may exist, an increase in the number cybersecurity threats or attacks, and other security challenges as a result of our employees and our service providers continuing to work remotely from non-corporate managed networks.

As the techniques used to obtain unauthorized access or sabotage systems change frequently, are becoming increasingly sophisticated and complex, and often are not identified until they are launched against a target, and because evidence of unauthorized activity may not have been captured or retained, or may be proactively destroyed by unauthorized actors, we may be unable to anticipate or timely detect these attacks, assess the true impact they may have on our business and operations, or to implement adequate preventative measures.

4 unchanged sentences

In addition, our software development practices have not and may not identify all potential privacy or security issues, and inadvertent disclosures of data have occurred and may occur again.

Additionally, remote work and resource access, including our hybrid work model, has and may continue to result in an increased risk of cybersecurity-related events, including phishing and other social engineering attacks, exploitation of any cybersecurity flaws that may exist, an increase in the number cybersecurity threats or attacks, and other security challenges as a result of our employees and our service providers continuing to work remotely from non-corporate managed networks.

These risks may be further heightened by efforts by malicious actors to obtain or misuse authorized access credentials through deception or impersonation, including by posing as legitimate employees, contractors, or by infiltrating our workforce or service providers through fraudulent recruitment, onboarding, or credential-harvesting activities.

If successful, such attacks could enable threat actors to gain persistent access to our systems, move laterally within our environment, exfiltrate sensitive data, disrupt operations, or facilitate additional cyber-attacks, and may be more difficult to detect or prevent due to the use of seemingly legitimate accounts and remote access tools.

Table of Cont ents

Furthermore, we have acquired or partnered with a number of companies, products, services, and technologies over the years, and incorporated third-party products, services, and technologies into our own products and services.

1 unchanged sentence

In addition, if a high-profile security breach occurs with respect to an industry peer, our customers and potential customers may generally lose trust in the security of financial management, spend management, human capital management, planning, or analytics applications, or in cloud applications for enterprises in general.

Any or all of these issues could negatively affect our ability to attract new customers, cause existing customers to elect to terminate or not renew their subscriptions, result in reputational damage, cause us to pay remediation and indemnity costs and/or issue service credits or refunds to customers for prepaid and unused subscription services, or result in lawsuits, regulatory fines, or other action or liabilities, any of which could adversely affect our business and operating results.

We rely on sophisticated information systems and technology, including those provided by third parties, for the secure collection, processing, transmission, and storage of confidential, proprietary, and personal information, and to support our business operations and the availability of our applications.

3 unchanged sentences

Our customers may authorize third-party technology providers to access their customer data and any unauthorized use of the third-party technology may result in unauthorized access to such data.

The audits we periodically conduct of some of our third-party vendors do not guarantee the security of and may be unable to prevent security events impacting the information technology systems of third parties that are part of our supply chain or that provide valuable services to us, which have resulted and could result in the unauthorized access to data of Workday, our employees, our customers, our third-party partners, or other end users;

acquisition, destruction, alteration, use, tampering, release, unavailability, theft or loss of confidential, proprietary, or personal data of Workday, our employees, our customers, our third-party partners, or other end users;

or the disruption of our operations and our ability to conduct our business or the availability of our applications;

or could otherwise adversely affect our business, financial condition, operating results, or reputation.

The audits we periodically conduct of some of our third-party vendors are unable to prevent security events impacting the information technology systems of third parties we rely on.

Privacy concerns, evolving regulation of cloud computing, cross-border data transfer, and other domestic or foreign laws and regulations, including those that seek to regulate access to data, may reduce the adoption of our applications, result in significant costs and compliance challenges, and adversely affect our business and operating results.

1 unchanged sentence

As the complexity of our products grows, the regulatory focus on privacy intensifies worldwide, and jurisdictions increasingly consider and adopt privacy laws, the risks related to our business’s processing of personal data also grow.

The volume and complexity of these regulatory requirements may continue to increase, including in response to heightened geopolitical tensions and the rapid adoption of AI technologies.

In addition, possible adverse interpretations of existing privacy-related laws and regulations by regulators in jurisdictions where our customers operate, as well as the potential adoption of new privacy-related requirements, could impose significant obligations affecting our business or prevent us from offering certain services in jurisdictions where we operate.

The global data privacy compliance landscape continues to become increasingly complex, fragmented, and financially relevant to business operations.

The global privacy and data protection compliance landscape continues to become increasingly complex, fragmented, and financially relevant to business operations.

As a result, our data processing creates current and prospective risks related to increased regulatory compliance costs, government enforcement actions and/or financial penalties for non-compliance, and reputational harm.

For example, the EU-U.S.

Data Privacy Framework (“DPF”) is in place under which EU data can legally be transferred to the U.S.

Data Privacy Framework (“DPF”) is in place and provides one method under which EU data can legally be transferred to the U.S.

However, it is facing legal challenges.

As legal challenges to the DPF remain unresolved, uncertainty may continue regarding the legal requirements for transferring personal data from Europe, an integral aspect of our business that remains governed by, and subject to, General Data Protection Regulation (“GDPR”) requirements.

Failure to comply with the GDPR data processing requirements by either ourselves or our subprocessors could lead to regulatory enforcement actions, which can result in monetary penalties of up to 4% of worldwide revenue, private lawsuits, reputational damage, and loss of customers.

Gaps in compliance with the GDPR data processing requirements by either ourselves or our subprocessors could lead to regulatory enforcement actions, which can result in monetary penalties of up to 4% of worldwide revenue, private lawsuits, reputational damage, and loss of customers.

Other EU laws, including the EU Data Act, which primarily governs access to and use of non-personal data generated by digital services, have been, and may continue to be implemented, interpreted, and enforced in ways that impose additional rules and restrictions on the deployment, operation, or use of our products and services and may require us to adapt our business practices or contractual arrangements to comply with such requirements.

In addition, potential changes to the laws and regulations that relate to the processing of personal data, including legislative proposals pending in the EU and elsewhere, may change the scope or timing of our compliance obligations.

Other countries such as Russia, China, Vietnam, and India have also passed or are in the process of passing laws imposing new requirements, including requirements related to consent and varying degrees of restrictive data residency or localization.

Table of Cont ents

Regulatory developments in the U.S.

present additional risks.

For example, the California Consumer Privacy Act (“CCPA”) took effect on January 1, 2020, and the California Privacy Rights Act (“CPRA”), which expands upon the CCPA, came into effect on January 1, 2023.

The CCPA and CPRA give California consumers, including employees, certain rights similar to those provided by the GDPR, and also provide for statutory damages or fines on a per violation basis that could be very large depending on the severity of the violation.

In addition, numerous states have enacted, or are considering, comprehensive privacy laws and other laws that touch on the processing of personal data in specific contexts, including in connection with artificial intelligence and automated systems, further contributing to a fragmented and evolving regulatory landscape that has and may continue to create compliance challenges.

Additionally, a final rule issued by the U.S.

4 unchanged sentences

The rule imposes certain diligence, security, audit and record-keeping requirements, and may adversely impact certain of our global business operations, including by restricting or conditioning certain data access or transfers involving subsidiaries, affiliates, and vendors.

Other regulatory developments in the U.S.

present additional risks.

For example, the California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives California consumers, including employees, certain rights similar to those provided by the GDPR, and also provide for statutory damages or fines on a per violation basis that could be very large depending on the regulator's assessed severity of the violation.

Certain of these laws and related regulations, including those governing the use of automated decision-making technologies in employment and other consequential decisions, have recently taken effect or will take effect in the near term, further contributing to a fragmented and evolving regulatory landscape that has and may continue to create compliance challenges.

Furthermore, the U.S.

Congress is considering numerous privacy bills, and the U.S.

Federal Trade Commission continues to bring enforcement actions for unfair or deceptive data protection practices and may undertake its own privacy-related rulemaking.

Congress has considered, and may in the future adopt, federal privacy-related legislation and data regulation, and regulators, including the U.S.

Federal Trade Commission, have brought and continue to bring enforcement actions related to data protection practices and may undertake its own privacy-related rulemaking.

In addition to government activity, privacy advocacy and other industry groups have established or may establish various new, additional, or different self-regulatory standards that customers may require us to adhere to, which may place additional burdens on us.

2 unchanged sentences

AI-enabled or agentic AI features may be targeted, misused, or produce outputs or inferences that implicate personal data in ways that are difficult to anticipate or control, potentially resulting in regulatory scrutiny, litigation, or reputational harm, even in the absence of a data breach.

Taken together, the costs of compliance with and other obligations imposed by data protection laws and regulations have and may continue to require modification of our services and operations, limit use or adoption of our services, slow the pace at which we close sales transactions, or otherwise adversely affect our business.

In addition, data protection laws, regulations and related enforcement activities may lead to significant fines, penalties, or liabilities for noncompliance.

Taken together, the costs of compliance with and other obligations imposed by privacy and data protection laws and regulations have and may continue to require modification of our services and operations, limit use or adoption of our services, slow the pace at which we close sales transactions, or otherwise adversely affect our business.

In addition, privacy and data protection laws, regulations and related enforcement activities may lead to significant fines, penalties, or liabilities for noncompliance.

These requirements may impact how personal data must be stored, accessed, and deleted within the products and services and impose certain limitations on how it may be used or shared.

15 unchanged sentences

Further, these agreements do not prevent our competitors or partners from independently developing technologies that are substantially equivalent or superior to our applications.

Table of Cont ents

We may be required to spend significant resources to monitor and protect our intellectual property rights.

28 unchanged sentences

Many of the risks associated with usage of open source software, particularly in the rapidly evolving field of AI, cannot be eliminated and could negatively affect our business.

Table of Cont ents

Risks Related to Legal and Regulatory Matters

22 unchanged sentences

Changes in government procurement policies, priorities, regulations, or technology initiatives may negatively impact our potential for growth in the government sector.

Table of Cont ents

We have made, and may continue to make, significant investments to support our efforts to sell to government entities, including obtaining various authorizations and certifications.

26 unchanged sentences

We are also subject to tax examinations and it is possible that the final determination of any examinations will have an adverse effect on our operating results or financial position.

Table of Cont ents

Risks Related to Financial Matters

6 unchanged sentences

We have seen and may continue to see instances of increased scrutiny from existing and prospective customers and the lengthening of certain sales cycles.

For example, we have recently experienced lengthening of certain sales cycles, particularly within net new opportunities.

The extended sales cycles are particularly evident in the government, higher education, and healthcare industries which are tied to federal funding.

Longer sales cycles could cause our operating and financial results to suffer in a given period.

9 unchanged sentences

Additionally, in fiscal 2023, we entered into a credit agreement (“2022 Credit Agreement”) which provides for a revolving credit facility in an aggregate principal amount of $1.0 billion.

As of April 30, 2026, we had no outstanding revolving loans under the 2022 Credit Agreement.

As of July 31, 2026, we had no outstanding revolving loans under the 2022 Credit Agreement.

We may incur substantial additional debt in the future, some of which may be secured debt.

8 unchanged sentences

• negatively impact our credit rating, which could limit our ability to obtain additional financing in the future and adversely affect our business.

Table of Cont ents

Our Senior Notes and 2022 Credit Agreement also impose restrictions on us and require us to maintain compliance with specified covenants.

25 unchanged sentences

In addition, because we use Workday’s financial management application, any problems that we experience with financial reporting and compliance could be negatively perceived by prospective or current customers, and negatively impact demand for our applications.

Table of Cont ents

Risks Related to Ownership of Our Class A Common Stock

Our Co-Founders have control over key decision making as a result of their control of a majority of our voting stock.

As of April 30, 2026, our Co-Founder and CEO Emeritus, David Duffield, together with his affiliates, held voting rights with respect to approximately 38 million shares of Class B common stock and 0.1 million shares of Class A common stock.

As of April 30, 2026, our Co-Founder, CEO, and Chair of our Board of Directors, Aneel Bhusri, together with his affiliates, held voting rights with respect to approximately 8 million shares of Class B common stock and 0.4 million shares of Class A common stock.

As of July 31, 2026, our Co-Founder and CEO Emeritus, David Duffield, together with his affiliates, held voting rights with respect to approximately 36 million shares of Class B common stock and 0.1 million shares of Class A common stock.

As of July 31, 2026, our Co-Founder, CEO, and Chair of our Board of Directors, Aneel Bhusri, together with his affiliates, held voting rights with respect to approximately 8 million shares of Class B common stock and 0.5 million shares of Class A common stock.

In addition, Mr.

15 unchanged sentences

Our Class B common stock has 10 votes per share and our Class A common stock, which is the stock that is publicly traded, has one vote per share.

Stockholders who hold shares of Class B common stock, including our executive officers, directors, and other affiliates, together hold a substantial majority of the voting power of our outstanding capital stock as of April 30, 2026.

Because of the ten-to-one voting ratio between our Class B and Class A common stock, the holders of our Class B common stock collectively will continue to control a majority of the combined voting power of our common stock and therefore be able to control all matters submitted to our stockholders for approval until the conversion of all shares of all Class A and Class B shares to a single class of common stock on the date that is the first to occur of (i) October 17, 2032, (ii) such time as the shares of Class B common stock represent less than 9% of the outstanding Class A and Class B common stock, (iii) nine months following the death of both Mr.

14 unchanged sentences

• announcements of technological innovations, new applications or enhancements to services, acquisitions, strategic alliances, or significant agreements by us or by our competitors;

Table of Cont ents

• disruptions in our services due to computer hardware, software, or network problems or any announcements related to security incidents;

27 unchanged sentences

• our Board of Directors is classified into three classes of directors with staggered three-year terms and directors are only able to be removed from office for cause;

Table of Cont ents

• when the outstanding shares of our Class B common stock represent less than a majority of the combined voting power of common stock:

27 unchanged sentences

Accordingly, actions by our stockholders to enforce any duty or liability created by the Exchange Act or the rules and regulations thereunder must be brought in federal court, and our stockholders will not be deemed to have waived our compliance with the federal securities laws and the regulations promulgated thereunder.

Table of Cont ents

Any person or entity purchasing or otherwise acquiring or holding any interest in any of our securities shall be deemed to have notice of and consented to our exclusive forum provisions, including the Federal Forum Provision.

4 unchanged sentences

Consequently, stockholders must rely on sales of their common stock after price appreciation as the only way to realize any future gains on their investment.

Table of Cont ents

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-Q

Item 1A. Risk Factors