Salesforce, Inc.
For the period ended Jan 31, 2026. Filed Mar 2, 2026.
View on SEC.govAbout this filing
A company's yearly report to the SEC, with audited financial statements. It is the fullest account a company gives of its business, its finances and the risks it sees.
FY2026 · Filed Mar 2, 2026
What changed in Risk Factors?
Read the current filingPrevious report: 10-K
Period ended 2025-01-31; filed 2025-03-05.
0001108524-25-000006
Item 1A. Risk FactorsCurrent report: 10-K
Period ended 2026-01-31; filed 2026-03-02.
0001108524-26-000060
Item 1A. Risk FactorsThe baseline is this issuer’s latest earlier reporting period of the same form that was filed before the current report. A previous 10-Q is a different quarter, not a year-over-year comparison. Amendments are excluded.
Compared 284 previous paragraphs and 235 current paragraphs.
115 unchanged; 104 reworded; 14 added; 48 removed; 17 previous and 2 current paragraphs rearranged.
Tables are not compared: 0 previous and 0 current tables excluded. Dates, whitespace, punctuation and numbering changes are ignored; changes to financial figures remain significant.
A changed paragraph is not evidence that risk increased or decreased. An unchanged paragraph does not establish that risk stayed the same.
Added paragraphs (14)
Current report
•Volatility in our stock price and associated litigation.
Current report
•evolving and increasingly sophisticated techniques used to breach or disrupt IT systems and infrastructure, including the use or exploitation of AI technologies by threat actors to accelerate, scale or personalize cyberattacks, which may increase speed and effectiveness and limit our ability to anticipate, detect or mitigate such threats;
Current report
•in the case of foreign acquisitions, challenges with integrating operations across different cultures and languages and addressing the particular economic, currency, political, cybersecurity, regulatory and market risks associated with certain countries;
Current report
•uncertainty regarding changes in trade policies, including trade wars, the threat or imposition of tariffs or other trade restrictions, as well as any retaliatory actions;
Current report
•AI-native companies and emerging startups that leverage generative AI and large language models as the core foundation of their architecture, offering highly specialized, autonomous, or automated solutions that may bypass traditional business process workflows or displace established user interfaces;
Current report
As we develop and deploy AI applications in our products and services, including in customer-facing contexts, the speed, scale and complexity of related data processing may increase. AI applications may be targeted or misused, or may perform in ways that are inaccurate, biased, unreliable or otherwise harmful, or that implicate personal or proprietary data in ways that may be difficult to anticipate, detect or control. Such issues could result in regulatory scrutiny, litigation, contractual disputes, loss of customer trust or reputational harm.
Current report
Inadequate or ineffective AI development, testing, deployment, content labeling, governance, monitoring or oversight, whether by us or others, could result in our AI applications not operating as intended or with reduced functionality, reduced acceptance of our products and services or diminished confidence in the decisions, predictions, analysis or other content that our AI applications produce. Such risks may be heightened as AI applications are integrated into a broader range of our products and services. This could subject us to regulatory scrutiny, competitive harm, legal liability and reputational damage.
Current report
We may rely in part on third-party models, datasets, cloud infrastructure or other technologies in developing or offering certain AI applications. Our reliance on such third parties exposes us to risks relating to performance, availability, security vulnerabilities, intellectual property claims, licensing restrictions, cost increases or changes in terms of service. If a third-party provider modifies, suspends or terminates access to its models, data or infrastructure, or if such technologies fail to perform as expected, our ability to offer, scale or support certain AI applications may be adversely affected, and we may incur additional costs to mitigate such impacts.
Current report
The rapid evolution of AI technologies and related regulatory requirements will require the allocation of significant resources to develop, test, monitor and maintain our products and services in order to comply with applicable laws and regulations and to address concerns relating to accuracy, bias, transparency, explainability, security and data provenance. Uncertainty surrounding new and emerging AI applications, including generative AI content creation and AI agents, may require additional investment in compliance programs, governance frameworks, licensing arrangements, documentation, auditing and risk mitigation processes, which may be complex, costly and could impact our profit margins. Moreover, expansion of our AI capabilities to content generation, including through Agentforce and other generative AI offerings, introduces additional risks and responsibilities.
Current report
AI technologies may produce content that is inaccurate, misleading, biased, offensive or unsafe, and may implicate privacy, security or intellectual property rights, including through the generation of copyrighted or other protected material. If our customers or others rely on such content to their detriment, or if regulators or rights holders assert claims relating to AI-generated content, we may be exposed to litigation, regulatory investigations, enforcement actions, indemnification obligations, monetary penalties or other liabilities, or reputational harm. Developing, testing and deploying AI technologies may also increase the cost profile of our offerings due to the computing costs required. If we are unable to effectively mitigate these risks, or if our mitigation efforts result in excessive costs, our reputation, business, operating results and financial condition may be adversely affected.
Current report
These laws continue to evolve and expand, including through the adoption of new comprehensive data protection regimes such as India’s Digital Personal Data Protection Act 2023, and through the introduction of additional implementing rules and regulations in various jurisdictions. As a result, we and our customers may become subject to additional regulatory burdens. New EU laws, including the DSA, the Data Act and the AI Act, have also been adopted and, depending on how they are implemented, interpreted and enforced, may impose additional rules, restrictions or compliance requirements on the development, deployment or use of our products and services, including AI-enabled features.
Current report
Historically, certain legal frameworks have provided safe harbors to companies that host or transmit content provided by others, including limitations on liability for monetary damages arising from copyright infringement or defamation based on customer-provided content. There is increasing legislative, regulatory and judicial scrutiny of these safe harbors, and ongoing legal efforts to repeal, narrow or limit these protections that were previously available to us. The loss or further erosion of these protections may require us to alter, limit or discontinue certain of our services, or may impose additional contractual terms on customers to mitigate potential liability for customer misconduct.
Current report
Furthermore, the uncertain and evolving regulatory environment and broader trust climate may heighten concerns regarding data privacy, cybersecurity, and artificial intelligence, particularly where advanced analytics or automated functionality is involved, which could cause our customers or their end users to limit the data they provide or their use of our products and services. Even the perception that personal data is not adequately protected or that our products or services do not comply with applicable regulatory requirements could inhibit sales, reduce adoption of our offerings or otherwise adversely affect our business.
Current report
Global tax developments may have a material impact to our business, cash flows, or financial results. For example, heightened interest in multinationals participating in the digital economy led many countries to adopt Pillar Two, a 15% corporate minimum tax proposed by the Organization for Economic Cooperation and Development (“OECD”). In January 2026, the OECD introduced new guidance including a "side-by-side safe harbor" which, if elected, exempts U.S. parented groups from certain provisions of Pillar Two. However, the election does not relieve foreign subsidiaries from certain jurisdiction specific minimum taxes. The guidance will need to be incorporated into local tax legislation to be effective.
Removed paragraphs (48)
Previous report
•Volatility in the market price of our common stock and associated litigation.
Previous report
•evolving techniques used to breach or sabotage IT systems and infrastructure, including as a result of the increased use of AI technologies by bad actors, which are generally not recognized until launched against a target, and could result in our being unable to anticipate or implement adequate measures to prevent such techniques;
Previous report
•challenges entering into new markets in which we have little or no experience or where competitors may have stronger market positions;
Previous report
•currency and regulatory risks associated with foreign countries and potential additional cybersecurity and compliance risks resulting from entry into new markets;
Previous report
•failure to fully assimilate, integrate or retrain acquired employees, which may lead to retention risk with respect to both key acquired employees and our existing key employees or disruption to existing teams or our workplace culture;
Previous report
•difficulties in and financial costs of addressing acquired compensation structures inconsistent with our compensation structure;
Previous report
•regional data privacy laws and other regulatory requirements that apply to outsourced service providers and to the transmission of our customers’ data across international borders;
Previous report
In addition, we have secured the naming rights to facilities controlled by third parties, such as office towers and a transit center, and any negative events or publicity arising in connection with these facilities could adversely impact our brand.
Previous report
In addition, various safe harbors have historically been provided to those who hosted content provided by others, such as safe harbors from monetary damages for copyright infringement arising from copyrighted content provided by customers and others and for defamation and other torts arising from information provided by customers and others. There is an increasing demand for repealing or limiting these safe harbors by either judicial decision or legislation, and we have active legal proceedings that have been impacted by the repeal or limiting of safe harbors that were previously available to us. Loss of these safe harbors may require altering or limiting some of our services or may require additional contractual terms to avoid liabilities for our customers’ misconduct.
Previous report
Furthermore, the uncertain and shifting regulatory environment and trust climate may raise concerns regarding data privacy and cybersecurity, which may cause our customers or our customers’ customers to resist providing the data necessary to allow our customers to use our services effectively. In addition, new products we develop or acquire in connection with changing events may expose us to liability or regulatory risk. Even the perception that the privacy and security of personal information are not satisfactorily protected or do not meet regulatory requirements could inhibit sales of our products or services and could limit adoption of our cloud-based solutions.
Previous report
Global tax developments applicable to multinational businesses may have a material impact to our business, cash flows, or financial results. Such developments, for example, may include certain provisions introduced by certain Organization for Economic Co-operation and Development’s proposals including the implementation of the global minimum tax under the Pillar Two model rules, and the European Commission’s and certain major jurisdictions’ heightened interest in and taxation of companies participating in the digital economy. Furthermore, governments’ responses to macroeconomic factors and tax revenue needs may lead to tax rule changes that could materially and adversely affect our cash flows and financial results.
Previous report
Additionally, some of the important factors that may cause our revenues, operating results and cash flows to fluctuate from quarter to quarter include:
Previous report
•general economic or geopolitical conditions, including the impacts of the war in Ukraine and the regional conflict in the Middle East; financial market conditions; uncertainty regarding the imposition of and changes in trade policies, including trade wars, tariffs or other trade restrictions or the threat of such actions; and increasing costs of operation;
Previous report
•our ability to retain and increase sales to existing customers, attract new customers and satisfy our customers’ requirements, including large enterprise customers;
Previous report
•the size and productivity of our workforce, as well as the cost to recruit and train new employees;
Previous report
•the length of the sales cycle for our services;
Previous report
•new product and service introductions by our competitors;
Previous report
•changes in unearned revenue and remaining performance obligation;
Previous report
•our ability to realize benefits from strategic partnerships, acquisitions or investments;
Previous report
•our ability to execute and realize benefits from restructuring actions and other workforce reductions, or any similar actions taken in the future;
Previous report
•variations in the revenue mix of our services and growth rates of our subscription and support offerings;
Previous report
•the lack of certainty regarding customer usage and associated costs for consumption-based product offerings;
Previous report
•changes in and expenses associated with our pricing policies and terms of contracts;
Previous report
•the cost, timing and management effort required for the introduction of new features to our services;
Previous report
•the costs associated with acquiring and integrating new businesses and technologies;
Previous report
•timing of additional investments in our enterprise cloud computing application and platform services and in our consulting services;
Previous report
•income tax effects resulting from, but not limited to, tax law changes, court decisions on tax matters, global tax developments applicable to multinational corporations, changes in operations or business structures and acquisition activity;
Previous report
•the timing of stock awards to employees and payroll and other withholding tax expenses;
Previous report
•technical difficulties or service interruptions;
Previous report
•changes in interest rates and our mix of investments, which impact the return on our investments in cash and marketable securities;
Previous report
•changes in the fair value of our strategic investments, including changes due to impairments, particularly in periods of significant market fluctuations;
Previous report
•evolving regulations of cloud computing, AI and cross-border data transfer restrictions and similar regulations; and
Previous report
Many of these factors are outside of our control, and the occurrence of one or more of them might negatively and materially impact our operating results. If we fail to meet or exceed operating results expectations or if securities analysts and investors have estimates and forecasts of our future performance that are unrealistic or that we do not meet, the market price of our common stock could decline. In addition, if one or more of the securities analysts who cover us adversely change their recommendations regarding our stock, the market price of our common stock could decline.
Previous report
The trading prices of the securities of technology companies have historically been highly volatile. Accordingly, the market price of our common stock has been and is likely to continue to be subject to wide fluctuations. Factors affecting the market price of our common stock include:
Previous report
•variations in, and limitations of, the various financial and other metrics and modeling used by analysts in their research and reports about our business;
Previous report
•forward-looking guidance to industry and financial analysts related to future operating results, the accuracy of which may be impacted by various factors, many of which are beyond our control;
Previous report
•our ability to meet or exceed forward-looking guidance we have given or to meet or exceed the expectations of investors, analysts or others; our ability to give forward-looking guidance consistent with past practices;
Previous report
•the coverage of our common stock by the financial media;
Showing the first 40 of 48 passages. Open the source sections for the rest.
Reworded paragraphs (104)
Previous wording
•Any breaches in our security measures or those of our third-party data center hosting facilities, cloud computing platform providers or third-party service partners, or the underlying infrastructure of the Internet that cause unauthorized access to a customer’s data, our data or our IT systems, or the blockage or disablement of authorized access to our services.
Current wording
•Any breaches in our security measures or those of our third-party data center providers, cloud computing platform providers, customers, partners, or other third-party vendors, or the underlying Internet infrastructure that cause unauthorized access to, disclosure, alteration, corruption, destruction or loss of customer data, our data or our IT systems, or disruption of authorized access thereto.
Previous wording
•Any interruptions or delays in services from third parties, including data center hosting facilities, cloud computing platform providers and other hardware and software vendors, as well as internet availability, or from our inability to adequately plan for and manage service interruptions or infrastructure capacity requirements.
Current wording
•Any interruptions or delays in services from third parties, including data center hosting facilities, cloud computing platform providers and other hardware and software vendors, as well as Internet infrastructure, or from our inability to adequately plan for and manage service interruptions or infrastructure capacity requirements.
Previous wording
•A more time-consuming and expensive sales cycle, pricing pressure and implementation and configuration challenges as we target more of our sales efforts at larger enterprise customers.
Current wording
•A more time-consuming and expensive sales cycle, pricing pressure and implementation and configuration challenges for sales efforts to larger enterprise customers.
Previous wording
•Any discontinuance by third-party developers and providers in embracing our technology delivery model and enterprise cloud computing services, or customers asking us for warranties for third-party applications, integrations, data and content.
Current wording
•Any discontinuance by third-party developers and vendors in embracing our technology delivery model and enterprise cloud computing services, or customers asking us for warranties for third-party applications, integrations, data and content.
Previous wording
•Social and ethical issues, including the use or capabilities of AI in our offerings.
Current wording
•Social, ethical, and regulatory issues, including the development, deployment, use or capabilities of AI in our offerings.
Previous wording
•The evolving landscape related to ESG matters.
Current wording
•The evolving landscape related to environmental, social and governance matters.
Previous wording
•Privacy concerns and laws as well as evolving regulation of cloud computing, increased restriction of cross-border data transfers and other regulatory developments.
Current wording
•Privacy concerns and laws as well as evolving regulation of cloud computing, AI services, increased restriction of cross-border data transfers and other regulatory developments.
Previous wording
•Provisions in our certificate of incorporation and bylaws and Delaware law that might discourage, delay or prevent a change of control of the Company or changes in our management.
Current wording
•Provisions in our governing documents and Delaware law that might discourage, delay or prevent a change of control of the Company or changes in our management.
Previous wording
•The occurrence of natural disasters and other events beyond our control.
Current wording
•The occurrence of natural disasters and other catastrophic events beyond our control.
Previous wording
If our security measures or those of our third-party data center hosting facilities, cloud computing platform providers or third-party service partners, or the underlying infrastructure of the Internet are breached, and unauthorized access is obtained to a customer’s data, our data or our IT systems, or authorized access is blocked or disabled, our services may be perceived as not being secure, customers may curtail or stop using our services, and we may incur significant reputational harm, legal exposure and liabilities, or a negative financial impact.
Current wording
If our security measures, or those of our third-party data center providers, cloud computing platform providers, customers, partners, other third-party vendors or the underlying Internet infrastructure, are breached or otherwise compromised, resulting in the unauthorized access to, disclosure, alteration, corruption, destruction or loss of customer data, our data or our IT systems, or disruption of authorized access thereto, our services may be perceived as insecure, customers may reduce or terminate their use of our services, and we may incur significant reputational harm, legal liability, regulatory scrutiny or a negative financial impact.
Previous wording
Our services involve the storage and transmission of our customers’ and our customers’ customers’ proprietary and other sensitive data, including financial, health and other personal information. Our services and underlying infrastructure may in the future be materially breached or compromised as a result of the following:
Current wording
Our services involve the storage and transmission of our customers’ and our customers’ customers’ proprietary and other sensitive data, including financial, health and other personal information. Our services and underlying infrastructure have in the past and may in the future be breached or compromised, including, for example, as a result of the following:
Previous wording
•third-party attempts to fraudulently induce our employees, partners or customers to disclose sensitive information to gain access to our customers’ data or IT systems, or our data or our IT systems;
Current wording
•attempts to fraudulently induce our employees, customers, partners, or third-party vendors to disclose sensitive information to gain unauthorized access to our or our customers’ data or IT systems;
Previous wording
•efforts by hackers or sophisticated groups, such as criminal organizations, state-sponsored organizations or nation-states, to launch coordinated cyberattacks on internally built infrastructure or on third-party cloud-computing platform providers, including ransomware, destructive malware and distributed denial-of-service attacks;
Current wording
•efforts by threat actors, including criminal organizations, state-sponsored actors and nation-states, to launch coordinated cyberattacks or supply chain attacks on our infrastructure or that of our third-party vendors, including through ransomware, destructive malware, distributed denial-of-service attacks or exploitation of previously unknown “zero-day” vulnerabilities;
Previous wording
•third-party attempts to abuse our marketing, advertising, messaging or social products and functionalities to impersonate persons or organizations and disseminate information that is false, misleading or malicious;
Current wording
•attempts to misuse our marketing, advertising, messaging or social products and functionalities to impersonate persons or organizations and disseminate information that is false, misleading or malicious;
Previous wording
•vulnerabilities existing within new technologies and infrastructures, including those from acquired companies, or resulting from enhancements and updates to our existing service offerings;
Current wording
•vulnerabilities arising from new technologies and infrastructures, including those from acquisitions, enhancements and updates to our existing products, and the adoption and deployment of AI technologies within our products, services, internal systems, which may introduce novel security, data governance, or operational risks;
Previous wording
•vulnerabilities in the products or components across the broad ecosystem that our services operate in conjunction with and are dependent on;
Current wording
•vulnerabilities in products or components within the broad ecosystem in which our services operate and upon which they depend;
Previous wording
•attacks on, or vulnerabilities in, the many different underlying networks and services that power the Internet that our products depend on, most of which are not under our control or the control of our vendors, partners or customers; and
Current wording
•attacks on, or vulnerabilities in, the underlying networks and services that power the Internet on which our products depend, most of which are not under our control or the control of our third-party vendors, partners or customers; and
Previous wording
•employee or contractor errors or intentional acts that compromise our security systems.
Current wording
•employee or contractor errors, omissions or intentional acts that compromise our security systems.
Previous wording
These risks are mitigated, to the extent possible, by our ability to maintain and improve business and data governance policies and enhance processes and internal security controls, including our ability to escalate and respond to known and potential risks. We can provide no assurances that our security measures, including implemented systems and processes designed to protect our customers’ and our customers’ customers’ proprietary and other sensitive data, will provide absolute security or otherwise be effective or that a material breach will not occur. For example, our ability to mitigate these risks may be impacted by the following:
Current wording
Although we devote significant resources to protecting our data and IT systems, we can provide no assurances that our security measures, including systems and processes designed to protect the confidentiality, integrity and availability of our customers’ and our customers’ customers’ proprietary and sensitive data, will be effective or that a material cybersecurity incident will not occur. Our ability to mitigate these risks may be impacted by the following:
Previous wording
•the increasing complexity of our internal IT systems as we incorporate and secure IT environments from acquired companies and early adoption of new technologies and new ways of sharing data; and
Current wording
•the increasing complexity of our internal IT systems as we integrate acquired businesses and adopt new technologies and data-sharing models; and
Previous wording
•our limited control over our customers or third-party technology providers (including those authorized by customers to access their data), or the processing of data by third-party technology providers, which may not allow us to maintain the integrity or security of such transmissions or processing.
Current wording
•our limited control over our customers, partners, and third-party vendors (including those authorized by customers to access their data), or over the processing of data by such third parties, which may limit our ability to maintain the integrity or security of such transmissions or processing.
Previous wording
In the normal course of business, we are and have been the target of malicious cyberattacks and have experienced other security incidents. Although, to date, such identified security events have not had a material financial impact, there can be no assurance that future cyberattacks will not be material or significant. Additionally, as our market presence grows, we may face increased risks of cyberattacks or security threats, and as AI technologies, including generative AI models, develop rapidly, threat actors are using these technologies to create new sophisticated attack methods that are increasingly automated, targeted and coordinated and more difficult to defend against.
Current wording
In the normal course of business, we and our customers are and have been the target of malicious cyberattacks and other security threats. Although to date we have not identified any security incidents involving our systems that have had a material financial impact on us, there can be no assurance that future incidents will not be material or significant. As our market presence grows, we may face increased risks of cyberattacks and other security threats. Additionally, as AI technologies, including generative and agentic AI, continue to evolve, threat actors are using and exploiting these technologies to enhance the sophistication, scale, speed and effectiveness of security threats that may be more difficult to detect and defend against. Any delay in detecting, containing, or remediating a cybersecurity incident may result in additional harm, and in certain cases the full scope and impact of any such incident may not be immediately apparent.
Previous wording
A security breach or incident could result in unauthorized parties obtaining access to, or the denial of authorized access to, our IT systems or data, or our customers’ systems or data, including intellectual property and proprietary, sensitive or other confidential information. We have contractual and other legal obligations to notify relevant stakeholders of security breaches. For example, SEC rules require disclosure on Form 8-K of the nature, scope and timing of any material cybersecurity incident and the reasonably likely impact of any such incident. A security breach or resulting mandatory disclosure could result in a loss of confidence in the security of our services, damage our reputation, negatively impact our future sales, disrupt our business and lead to increases in insurance premiums and legal, regulatory and financial exposure and liability. Further, there can be no assurance that our insurance coverage will be sufficient to cover the financial, legal, business, or reputational losses that may result from a cybersecurity incident or breach of our IT systems. Finally, the detection, prevention and remediation of known or potential security vulnerabilities, including determining whether a cybersecurity incident is notifiable or reportable, may not be straightforward and may result in additional financial burdens due to additional direct and indirect costs to respond to or alleviate problems caused by the actual or perceived security breach, such as additional infrastructure capacity spending to mitigate any system degradation and the reallocation of resources from development activities.
Current wording
A cybersecurity incident could result in unauthorized access to, or the loss or denial of authorized access to, our IT systems or data, or those of our customers, including intellectual property and other proprietary, sensitive or confidential information. We are subject to contractual, regulatory and other legal obligations to notify relevant stakeholders of certain security incidents. For example, SEC rules require disclosure on Form 8-K of the nature, scope and timing of any material cybersecurity incident and the reasonably likely impact of such incident. Assessing whether an incident is material or reportable may require complex judgment and investigation, and disclosure of an incident may itself adversely affect our reputation, customer relationships and exposure to legal or regulatory proceedings. A security incident or related disclosure could result in loss of confidence in the security of our services, harm our reputation, negatively impact future sales, disrupt our business operations, increase insurance premiums and result in legal, regulatory and financial liability. Additionally, it may take considerable time for us to investigate and evaluate the full impact of cybersecurity attacks, particularly for sophisticated attacks, which may inhibit our ability to provide prompt, full and reliable information about the incident to our customers, regulators and the public. Further, there can be no assurance that our insurance coverage will be sufficient in type or amount to cover the losses arising from a cybersecurity incident. In addition, prevention, detection, investigation and remediation of actual or suspected vulnerabilities or incidents, including determining whether notification or disclosure is required, may not be straightforward, may result in significant direct and indirect costs, including increased infrastructure and security spending and the diversion of resources from development activities.
Previous wording
We have in the past and may in the future find defects in or experience disruptions to our services. Such issues may arise in a variety of circumstances, including due to our customers using our services in unanticipated ways that may cause a disruption in services for other customers attempting to access their data; as a result of employee, contractor or other third-party action or inaction; or due to the complexity of our services, which incorporate a variety of hardware, proprietary software and third-party and open-source software. Across the industry, cloud services frequently contain undetected errors when first introduced or when new versions or enhancements are released. We may also encounter difficulties integrating acquired or licensed technologies into our services and in augmenting the technologies we use to meet quality standards that are consistent with our brand and reputation, which may result in our services containing errors or defects.
Current wording
We have in the past and may in the future identify defects in or experience disruptions to our services. Such issues may arise in a variety of circumstances, including from customers using our services in unanticipated ways that disrupt access for other customers; from employee, contractor or other third-party action or inaction; or from the complexity of our services, which incorporate a variety of hardware, proprietary software and third-party and open-source software. Across the industry, cloud services frequently contain undetected errors when first introduced or when new versions or enhancements are released.
Previous wording
We have experienced and may in the future experience defects in our products that create vulnerabilities that inadvertently permit access to protected customer data. We can provide no assurance that such product defects or other vulnerabilities will not occur in the future, have a material adverse effect on our business or subject us to substantial liability. Vulnerabilities in open source or any proprietary or third-party product can persist even after security patches have been issued if customers have not installed the most recent updates, or if the attackers exploited the vulnerabilities before patching was complete. In some cases, vulnerabilities may not be immediately detected, which may make it difficult to recover critical services and lead to damaged assets.
Current wording
We have experienced and may in the future experience defects in our, our customers’, or third-party vendors’ products and components, which may create vulnerabilities that inadvertently permit unauthorized access to protected customer data. We can provide no assurance that such defects or vulnerabilities will not occur in the future, have a material adverse effect on our business or subject us to substantial liability. Vulnerabilities in open-source, proprietary or third-party products and components can persist even after security patches have been issued if updates are not timely implemented or if threat actors exploit vulnerabilities before remediation is complete. In some cases, vulnerabilities may not be immediately detected, which may make it difficult to recover critical services and lead to damaged assets.
Previous wording
Since our customers use our services for important aspects of their business, errors, defects, disruptions in service or other performance problems have in the past adversely impacted our customers’ businesses and could do so in the future. As a result, customers could elect to not renew our services or delay or withhold payment to us. We could also lose future sales or customers may make warranty or other claims against us, which could result in an increase in our allowance for doubtful accounts, an increase in collection cycles for accounts receivable or the expense and risk of litigation.
Current wording
Since our customers rely on our products and services for important aspects of their operations, errors, defects, service disruptions or other performance issues have in the past adversely impacted our customers and could do so in the future. As a result, customers could elect to not renew their services, delay or withhold payment or make warranty or other claims against us. Such outcomes could reduce future sales, increase in our allowance for doubtful accounts, increase collection cycles and expose us to litigation and related expenses.
Previous wording
Any interruptions or delays in services from third parties, including data center hosting facilities, cloud computing platform providers and other hardware and software vendors, as well as internet availability, or from our inability to adequately plan for and manage service interruptions or infrastructure capacity requirements, could impair the delivery of our services and harm our business.
Current wording
Any interruptions or delays in services from third parties, including data center hosting facilities, cloud computing platform providers and other hardware and software vendors, as well as Internet infrastructure, or from our inability to adequately plan for and manage service interruptions or infrastructure capacity requirements, could impair the delivery of our services and harm our business.
Previous wording
We currently rely on third-party data center hosting facilities and cloud computing platform providers located in the United States and other countries, as well as the many different underlying networks and services that power the Internet, to deliver our products, services and business operations and to operate critical business systems. We also rely on computer hardware purchased or leased from, software licensed from, and cloud computing platforms provided by, third parties in order to offer our services, including database software, hardware and data from a variety of vendors. Any disruption or damage to, or failure of our systems generally, including the systems of third-party providers we rely on, could result in service interruptions and harm our business. We have from time to time experienced service interruptions and such interruptions may occur in the future. As we increase our reliance on these third-party systems, particularly with respect to third-party cloud computing platforms, our exposure to damage from service interruptions or other performance or quality issues may increase. Service interruptions or other performance or quality issues may cause us to issue credits or pay penalties, cause customers to make warranty or other claims against us or to terminate their subscriptions, and adversely affect our attrition rates and our ability to attract new customers, all of which would reduce our revenue. Our business and reputation would also be harmed if our customers and potential customers believe our services are unreliable.
Current wording
We rely on third-party data center hosting facilities and cloud computing platform providers located in the United States and other countries, as well as the many different underlying networks and services that power the Internet, to deliver our products and services and operate critical business systems. We also rely on hardware purchased or leased from, software licensed from, and cloud computing platforms provided by third parties in order to offer our products and services, including database software, hardware and data from multiple vendors. Any disruption, degradation or failure of our systems, or those of the third parties on which we rely, could result in service interruptions and harm our business. We have experienced service interruptions and interruptions may occur in the future. As our reliance on these third-party systems increases, and particularly on third-party cloud computing platforms, our exposure to service interruptions and performance or quality issues may also increase. Service interruptions or other performance or quality issues may cause us to issue credits or pay penalties, cause customers to assert warranty or other claims or terminate their subscriptions, and adversely affect attrition rates and our ability to attract new customers, which could reduce revenue. Our business and reputation would also be harmed if our customers and potential customers perceive our services as unreliable.
Previous wording
For many of our offerings, our production environment and customers’ data are replicated in a separate facility located elsewhere. Certain offerings, including some offerings of companies added through acquisitions, may be served through alternate facilities or arrangements. We do not control the operation of any of these facilities, and they may be vulnerable to damage or interruption from earthquakes, floods, fires, power loss, telecommunications failures and similar events. They may also be subject to break-ins, sabotage, intentional acts of destruction or vandalism or similar misconduct, as well as local administrative actions, changes to legal or permitting requirements and litigation to stop, limit or delay operation. In addition, supply chain disruptions due to geopolitical developments in Europe may lead to power disruptions in regions where our facilities are located. Despite precautions taken at these facilities, such as disaster recovery and business continuity arrangements, the occurrence of any of the foregoing events or risks, or a natural disaster or public health emergency, an act of terrorism, a decision to close the facilities without adequate notice or other unanticipated problems or operational failures at these facilities could result in lengthy service interruptions, and no assurance can be provided that any such interruptions would be remediated without significant cost or in a timely manner or at all.
Current wording
For many of our offerings, our production environment and customer data are replicated at geographically separate facilities. Certain offerings, including those added through acquisitions, may be delivered through alternate facilities or arrangements. We do not control the operation of any of these facilities, and they may be vulnerable to damage or interruption from events outside of our control, such as natural disasters or supply chain disruptions. Despite precautions taken at these facilities, such as disaster recovery and business continuity arrangements, unanticipated events, problems, operational failures or other disruptions could result in prolonged service interruptions, and there can be no assurance that such interruptions would be remediated without significant cost, in a timely manner or at all.
Previous wording
The hardware, software, data and cloud computing platforms that we rely on, including, for example, the large language models leveraged in our AI offerings, may not continue to be available at reasonable prices, on commercially reasonable terms or at all. Any loss of the right to use any of these hardware, software, data or cloud computing platforms could significantly increase our expenses and disrupt or otherwise result in delays in the provisioning of our services until equivalent technology is either developed by us, or, if available, is identified, obtained through purchase or license and integrated into our services, and no assurance can be provided that such equivalent technology would be developed or obtained in a timely manner or at all.
Current wording
The hardware, software, data and cloud computing platforms that we rely on, including, for example, the large language models leveraged in our AI offerings, may not continue to be available at reasonable prices, on commercially reasonable terms or at all. Any loss of the right to use such hardware, software, data or cloud computing platforms could significantly increase our expenses and disrupt or delay the provision of our services until equivalent technology is either developed internally or obtained from third parties and integrated into our systems. There can be no assurance that such replacement technology would be available or implemented in a timely manner or at all.
Previous wording
As we scale our operations, the amount and type of information transferred on our offerings continues to evolve, including as a result of the deployment of AI technologies, and our infrastructure capacity requirements, including network capacity and computing power, may increase as a result. If we do not accurately plan for our infrastructure capacity requirements and we experience significant strains on our data center capacity, our customers could experience performance degradation or service outages that may subject us to financial liabilities, result in customer losses and harm our reputation and business. As we add data centers and capacity and continue to move to cloud computing platform providers, we move or transfer our data and our customers’ data from time to time. Despite precautions taken during this process, any unsuccessful data transfers may impair the delivery of our services, which may damage our business.
Current wording
As we scale our operations, the volume and nature of data processed by our offerings continue to evolve, including as a result of the deployment of AI technologies, and our infrastructure capacity requirements, including network capacity, computing power and energy requirements, may increase as a result. Additionally, increased energy consumption, including as a result of AI adoption, climate-related events, energy market volatility, and power grid disruptions may increase the operational costs related to inputs across our value chain, including for data centers. If we experience significant strains on our data center capacity, whether due to insufficient infrastructure capacity or for other reasons outside of our control, our customers could experience performance degradation or service outages that may subject us to financial liabilities, result in customer losses, subject us to litigation and harm our reputation and business. As we add data centers and capacity and continue to move to cloud computing platform providers, we move or transfer our data and our customers’ data from time to time. Despite precautions taken during this process, any unsuccessful data transfers may impair the delivery of our services, which may damage our business.
Previous wording
As part of our business strategy, we periodically acquire complementary businesses, joint ventures, services and technologies and intellectual property rights. We continue to evaluate such opportunities and expect to make such acquisitions in the future.
Current wording
As part of our business strategy, we periodically acquire complementary businesses, joint ventures, services and technologies and intellectual property rights. We continue to evaluate such opportunities and expect to make such acquisitions and other transactions and arrangements in the future, which may involve numerous risks and could create unforeseen operating difficulties and expenditures, including:
Previous wording
•potential identified or unknown security vulnerabilities in acquired products that expose us to additional security risks or delay our ability to integrate the product into our service offerings, as well as difficulties in increasing or maintaining the security standards for acquired technology;
Current wording
•potential identified or unknown security vulnerabilities in acquired products or technologies that expose us to additional cybersecurity risks, delay integration into our service offerings, or create challenges in increasing or maintaining the security standards of the acquired technologies;
Previous wording
•difficulty of transitioning the acquired technology onto our existing platforms and customer acceptance of multiple platforms on a temporary or permanent basis;
Current wording
•difficulty of transitioning the acquired technology onto our existing platforms;
Previous wording
•challenges converting the acquired company’s revenue recognition policies and forecasting the related revenues, including both consumption- and subscription-based revenues and term software license revenue, as well as appropriate allocation of the customer consideration to the individual deliverables;
Current wording
•challenges converting the acquired company’s revenue recognition policies and forecasting the related revenues, including both consumption- and subscription-based revenues and term software license revenue;
Previous wording
•operational and financial difficulties and strains on resources in integrating acquired operations, technologies, services, platforms and personnel;
Current wording
•operational and financial difficulties and strains on resources in integrating acquired operations, technologies, services, platforms and personnel (including cultural integration and retention of employees);
Previous wording
•regulatory challenges from antitrust or other regulatory authorities that may block, delay or impose conditions (such as divestitures, ownership or operational restrictions or other structural or behavioral remedies) on the completion of transactions or the integration of acquired operations;
Current wording
•regulatory challenges from antitrust or other regulatory authorities that may block, delay or impose conditions on the completion of transactions or the integration of acquired operations;
Previous wording
Any of these risks could harm our business or negatively impact our results of operations. In addition, to facilitate acquisitions, we may seek additional equity or debt financing, which may not be available on terms favorable to us or at all, which may affect our ability to complete subsequent acquisitions, and which may affect the risks of owning our common stock. For example, if we finance acquisitions by issuing equity or convertible or other debt securities or loans, our existing stockholders may be diluted, or we could face constraints related to the terms of, and repayment obligation related to, the incurrence of indebtedness that could affect the market price of our common stock.
Current wording
Any of these risks could harm our business or negatively impact our results of operations. In addition, to facilitate acquisitions, we may seek additional equity or debt financing, which may not be available on terms favorable to us or at all, which may affect our ability to complete subsequent acquisitions, and which may affect the risks of owning our common stock. If we finance acquisitions by issuing equity or convertible or other debt securities or taking out loans, our existing stockholders may be diluted, or we could face constraints related to the terms of, and repayment obligation related to, the incurrence of indebtedness that could affect our stock price. For example, in connection with our acquisition of Informatica, we entered into the Informatica Credit Agreements on an unsecured basis. In November 2025, the Company borrowed the full $6.0 billion available under the Informatica Credit Agreements to finance a portion of the cash consideration for the acquisition, repay existing indebtedness of Informatica and its subsidiaries, and pay related fees, costs, and expenses. For more information, see Note 9 “Debt” to the consolidated financial statements in Item 8 of Part 2.
Previous wording
Our ability to acquire other businesses or technologies, or integrate acquired businesses effectively, may be impaired by trade tensions and increased global scrutiny of foreign investments and acquisitions in the technology sector. For example, several countries, including the United States and countries in Europe and the Asia-Pacific region, are considering or have adopted restrictions of varying kinds on transactions involving foreign investments and acquisitions. Antitrust authorities in a number of countries have also reviewed acquisitions in the technology industry with increased scrutiny. Governments may continue to adopt or tighten restrictions of this nature, some of which may apply to acquisitions or integrations of businesses by us, and such restrictions or government actions could negatively impact our business and financial results.
Current wording
Our ability to acquire other businesses or technologies, or integrate acquired businesses effectively, may be impaired by trade tensions and increased global scrutiny of foreign investments and acquisitions in the technology sector. Governments may continue to adopt or tighten restrictions of this nature, some of which may apply to acquisitions or integrations of businesses by us, and such restrictions or government actions could negatively impact our business and financial results.
Previous wording
We continue to experience significant growth in our customer base, including through acquisitions, which has placed a strain on and in the future may strain our management, administrative, operational and financial infrastructure. We anticipate that significant additional investments, including in human capital software, as well as leveraging agentic AI and other technologies, will be required to scale our operations and increase productivity, to address the needs of our customers, to further develop and enhance our services, to expand into new geographic areas and to scale with our overall growth. These investments will increase our cost base, making it more difficult for us to offset any future revenue shortfalls by reducing expenses in the short term. We may not be able to make these investments as quickly or effectively as necessary to successfully scale our operations.
Current wording
We continue to experience significant growth in our customer base, including through acquisitions, which has placed a strain on our management, administrative, operational and financial infrastructure. We anticipate that significant additional investments, including in human capital software, agentic AI and other technologies, will be required to scale our operations and increase productivity, address the needs of our customers, develop and enhance our services, expand into new geographic areas and support continued growth. These investments will increase our cost base, making it more difficult to offset any future revenue shortfalls by reducing expenses in the short term. We may not be able to make these investments as quickly or effectively as necessary to successfully scale our operations.
Showing the first 40 of 104 pairs. Open the source sections for the rest.
Rearranged current paragraphs (2)
Current report — wording carried from elsewhere
•perceptions of U.S.-based companies in the regions where we operate or plan to operate;
Current report — wording carried from elsewhere
In July 2020, the Court of Justice of the European Union (“CJEU”) invalidated the EU-U.S. Privacy Shield Framework, one of the mechanisms that previously permitted transfers of personal data from the European Economic Area (“EEA”) to the United States. Even though the CJEU decision upheld the use of Standard Contractual Clauses (“SCCs”) as a lawful transfer mechanism, the decision created ongoing uncertainty regarding EU-to-U.S. data transfers. While the EU and U.S. governments have since adopted the EU-U.S. Data Privacy Framework to facilitate such transfers and address the concerns raised by the CJEU, it remains uncertain whether this framework will withstand future legal challenges. As a result, regulators may continue to interpret the CJEU’s decision and the reasoning underlying it as significantly restricting certain cross-border data transfers increasing the cost and complexity of providing our services in certain markets. Certain countries outside of the EEA have enacted or are considering enacting laws that require varying degrees of local data residency or localization. Additionally, recent governmental actions and geopolitical developments have increased the perceived risk that our services, particularly in the EU, could be disrupted, suspended or terminated.
Rearranged previous paragraphs (17)
Previous report — wording carried elsewhere
Acquisitions and other transactions and arrangements involve numerous risks and could create unforeseen operating difficulties and expenditures, including:
Previous report — wording carried elsewhere
In addition, the markets and monetization strategies for certain offerings, including Agentforce and Data Cloud, remain relatively new and uncertain and as a result our expansion into such offerings, and related investments, may present additional risks and challenges. For example, we offer certain products, including Agentforce and Data Cloud, through a consumption-based business model and may increase the number of products through which we do so. We have limited experience with determining optimal pricing for our consumption-based contracts. Additionally, due to customer flexibility in the timing of their consumption, we could have lower levels of customer consumption of our products than we expect which may result in suboptimal pricing for consumption-based contracts.
Previous report — wording carried elsewhere
•regional economic and political conditions, natural disasters, acts of war, terrorism and actual or threatened public health emergencies;
Previous report — wording carried elsewhere
•the seasonality of our sales cycle, as well as timing of contract execution and term software license sales;
Previous report — wording carried elsewhere
•the seasonality of our customers’ businesses, especially our Commerce service offering customers;
Previous report — wording carried elsewhere
•fluctuations in foreign currency exchange rates;
Previous report — wording carried elsewhere
•the amount and timing of operating costs and capital expenditures related to the operations and expansion of our business;
Previous report — wording carried elsewhere
•the timing of commission, bonus and other compensation payments to employees;
Previous report — wording carried elsewhere
•expenses related to our real estate or changes in the nature or extent of our use of existing real estate, including our office leases and our data center capacity and expansion;
Previous report — wording carried elsewhere
•expenses related to significant, unusual or discrete events, which are recorded in the period in which the events occur, including litigation or other dispute-related settlement payments;
Previous report — wording carried elsewhere
•equity or debt issuances, including as consideration in or in conjunction with acquisitions;
Previous report — wording carried elsewhere
•changes to previous guidance or long-range targets, in the estimates of our operating results or in recommendations by securities analysts that elect to follow our common stock;
Previous report — wording carried elsewhere
•announcements or rumors of technological innovations, new services or service enhancements, strategic alliances, mergers or other strategic acquisitions or significant agreements by us or within our industry;
Previous report — wording carried elsewhere
•announcements of customer additions and customer cancellations or delays in customer purchases;
Previous report — wording carried elsewhere
•the economy as a whole, geopolitical conditions, including global trade and health concerns, market conditions in our industry and the industries of our customers, and financial institution instability;
Previous report — wording carried elsewhere
•issuance of equity, debt or other convertible securities;
Previous report — wording carried elsewhere
•changes to our credit ratings; and