Workday (WDAY) Risk Factor Changes

•only our chair of the board, lead independent director of the board, chief executive officer, presidents, or a majority of our Board of Directors are authorized to call a special meeting of stockholders;

We have share repurchase programs under which we are authorized to repurchase shares of our Class A common stock.

We operate and are subject to taxes in the U.S.

We may be subject to additional audits and investigations relating to our government contracts, and any violations could result in various civil and criminal penalties and administrative sanctions, including terminati…

We have made, and may continue to make, significant investments to support our efforts to sell to government entities, including obtaining various authorizations and certifications.

Laws and regulations provide public sector customers with various rights, many of which are not typically found in commercial contracts.

Our applications include software covered by open source licenses, which may include, by way of example, the GNU General Public License and the Apache License.

Our applications utilize open source software, including open source AI models and platforms, and our strategy of investing in and acquiring such technologies introduces new and heightened risks.

Taken together, the costs of compliance with and other obligations imposed by data protection laws and regulations have and may continue to require modification of our services and operations, limit use or adoption of…

Legal requirements related to collecting, storing, handling, retaining, and transferring (collectively, “processing”) personal data are rapidly evolving at both the national and international level in ways that requir…

Privacy concerns, evolving regulation of cloud computing, cross-border data transfer, and other domestic or foreign laws and regulations, including those that seek to regulate access to data, may reduce the adoption o…

Cybersecurity threats and attacks are often targeted at companies such as ours and may take a variety of forms ranging from individuals or groups of security researchers, including those who appear to offer a solution…

The positions we take on corporate responsibility and sustainability-related matters, human capital management initiatives, and ethical issues from time to time may impact our brand, reputation, or ability to attract…

Our disclosures related to corporate responsibility and sustainability-related matters expose us to risks that could adversely affect our reputation and performance.

Our corporate headquarters are located in Pleasanton, California, and we host our applications in data centers operated by third parties located in the U.S., Europe, Canada, and the Asia-Pacific region.

Any failure of our applications to operate effectively with future network platforms and other third-party technologies, or changes in such technologies that degrade the functionality of our products or give preferent…

If we fail to successfully promote and maintain positive awareness of our brand, or we fail to expand positive awareness of our newer solutions or products, we may fail to attract or retain customers necessary to real…

We believe that developing and maintaining widespread positive awareness of our brand is critical to our growth and that the importance of maintaining positive brand awareness will increase as competition in our marke…

We are increasingly building and integrating AI into the Workday product suite, including generative and agentic AI, and we are increasingly using AI products and technologies in the course of running our business at…

The use of new and evolving technologies in our offerings at Workday, including generative and agentic AI capabilities, may result in reputational harm and increased litigation, and adversely affect our operating resu…

Our customers have no obligation to renew their subscriptions for our applications after the expiration of either the initial or renewed subscription period and it is difficult to predict attrition rates given our var…

Implementation of our applications may be technically complicated because they are designed to enable complex and varied business processes across large organizations, integrate data from a broad and complex range of…

In addition, a significant portion of the purchase price of companies we acquire has been and may in the future be allocated to acquired goodwill and other intangible assets, which must be assessed for impairment at l…

•known and unknown liabilities or risks associated with the acquired businesses, including those arising from existing contractual obligations or litigation matters;

•a failure to maintain the information systems of an acquired business, including difficulties in increasing or maintaining the security standards for acquired technology, which could increase the risk of a security b…

•inability or difficulty integrating the intellectual property, technology infrastructure, and operations of the acquired business, including difficulty in addressing potential identified or unknown security risks or…

These impacts may continue through integration activities.

•increased compliance costs related to government regulatory reviews or audits, including those related to international cybersecurity and sustainability requirements;

•compliance challenges related to the complexity of multiple, conflicting, and changing governmental laws and regulations, including employment, tax, privacy, intellectual property, financial services, AI, and data pr…

•restrictive governmental actions focused on cross-border trade, such as import and export restrictions, duties, quotas, potential or imposed tariffs, trade disputes, and barriers or sanctions, as well as any retaliat…

•potentially weaker protection for intellectual property and other legal rights than in the U.S.

•difficulties in leveraging executive presence, maintaining company culture globally, and conforming with local cultural contexts and customs;

Our international presence, continued expansion, and sales to customers outside the U.S.

We continue to seek opportunities to enter into new markets and/or new lines of business, some of which we may have very limited or no experience in.

Our partner training and educational programs may not be effective or utilized consistently by partners.

We must also continue to retain, develop, and motivate existing employees through our compensation practices, company culture, and career development opportunities.

Our success and future growth depend largely upon the continued services of our executive officers, other members of senior management, and other key employees.

Furthermore, our current or potential competitors may be acquired by, or merge with, third parties with greater available resources and the ability to initiate or withstand substantial price competition.

Our primary competitors are Oracle and SAP, well-established providers of financial management and HCM applications, which have long-standing relationships with customers and partners.

Any changes in service levels with our infrastructure providers, or any errors, defects, disruptions, or other performance problems with our applications or the infrastructure on which they run, including internet inf…

We have experienced, and may in the future experience, defects, system disruptions, outages, and other performance problems, including the failure of our applications to perform properly.

We have experienced significant growth in the number of users, transactions, and data that our operations infrastructure supports.

•exposure to risks inherent to international expansion and sales to customers outside the U.S.

•our ability to realize a return on our current development efforts or offer new features, such as those involving AI, enhancements, and modifications to our products and services, and our ability to realize a return…

•our ability to compete effectively in the intensely competitive markets in which we participate, including against non-specialist AI-native solutions;

Investing in our securities involves a high degree of risk.

Until recently, we had incurred significant net losses on a GAAP basis since our inception in 2005 and our quarterly operating results may fluctuate in the future.

We have a history of cumulative losses, and we may not sustain profitability on a GAAP basis in the future.

Following the EU’s passage of the General Data Protection Regulation (“GDPR”), which became effective in May 2018, the global data privacy compliance landscape has grown increasingly complex, fragmented, and financial…

Additionally, remote work and resource access, including our hybrid work model, has and may continue to result in an increased risk of cybersecurity-related events such as phishing attacks, exploitation of any cyberse…

If our ESG practices do not align with or meet evolving investor or other stakeholder expectations and standards, then our reputation, our ability to attract or retain employees, and our attractiveness as an investmen…

Standards for tracking and reporting ESG matters continue to evolve.

•the ability to renew existing or execute on new virtual power purchase agreements.

•the availability and cost of high-quality verified emissions reductions and renewable energy credits; and

•our ability to recruit, develop, and retain diverse talent in our global labor markets;

•the ability of suppliers to meet our sustainability and other ESG standards;

•the evolving regulatory requirements affecting ESG standards or disclosures;

•the availability and cost of low- or non-carbon-based energy sources;

Our ability to achieve any ESG objective is subject to numerous risks, many of which are outside of our control.

In addition, a significant portion of the purchase price of companies we acquire may be allocated to acquired goodwill and other intangible assets, which must be assessed for impairment at least annually.

Our future success also depends, in part, on our ability to sell additional products to our current customers, and the success rate of such endeavors is difficult to predict, especially with regard to any new lines of…

•laws, customs, and business practices favoring local competitors;

•the need to adhere to local laws and regulations, including those related to data localization, privacy, and anti-corruption;

In February 2025, we announced the Fiscal 2026 Restructuring Plan, which is intended to prioritize our investments and advance our growth and is currently expected to result in the reduction of approximately 8% of our…

•new and evolving technologies such as AI;

•actions instituted by activist shareholders or others, and our response to such actions;

Our contracts with federal, state, local, and foreign government entities are subject to various procurement regulations and other requirements relating to their formation, award, administration, and performance, whic…

Beyond licensing compliance, our use of and investment in open source AI models and platforms create distinct and significant risks.

In addition, as AI technologies are increasingly used across the industry, including in connection with data analytics, automation, customer service, and decision-support features, the speed, scale, and complexity of…

Furthermore, the U.S.

Additionally, a final rule issued by the U.S.

Regulatory developments in the U.S.

Over the past five years, the global data privacy compliance landscape has grown increasingly complex, fragmented, and financially relevant to business operations.

Additionally, remote work and resource access, including our hybrid work model, has and may continue to result in an increased risk of cybersecurity-related events, including phishing and other social engineering atta…

Standards and requirements for tracking and reporting corporate responsibility and sustainability-related matters continue to evolve.

Our future success also depends, in part, on our ability to sell additional products to our current customers, and the success rate of such endeavors is difficult to predict, especially with regard to any new lines of…

•the impact on stockholder dilution and our operating results from the additional stock-based compensation issued in connection with the acquisition;

•laws, contracting approaches, customs, and business practices favoring local vendors over U.S.-based companies, which may be increased by geopolitical tensions;

•increased travel, real estate, infrastructure, and legal and regulatory compliance costs associated with international operations;

•the need to adhere to local laws and regulations, including those related to data localization, privacy, and anti-corruption, which may make it more difficult to penetrate certain international market segments with h…

•the technical, legal, and regulatory environment in connection with our use of new and evolving technologies in our offerings, such as AI;