CRM

•Any discontinuance by third-party developers and providers vendors in embracing our technology delivery model and enterprise cloud computing services, or customers asking us for warranties for third-party applications, integrations, data and content.

Our services involve the storage and transmission of our customers’ and our customers’ customers’ proprietary and other sensitive data, including financial, health and other personal information. Our services and underlying infrastructure have in the past and may in the future be materially breached or compromised compromised, including, for example, as a result of the following:

•efforts by hackers or sophisticated groups, such as criminal organizations, state-sponsored organizations or nation-states, to launch coordinated cyberattacks or supply chain attacks on internally built our infrastructure or on that of our third-party cloud-computing platform providers, vendors, including through the use of ransomware, destructive malware and distributed denial-of-service attacks;

•our limited control over our customers or third-party technology providers vendors (including those authorized by customers to access their data), or the processing of data by third-party technology providers, vendors, which may not allow us to maintain the integrity or security of such transmissions or processing.

As part of our business strategy, we periodically acquire complementary businesses, joint ventures, services and technologies and intellectual property rights. We continue to evaluate such opportunities and expect to make such acquisitions in the future, such as the pending acquisition of Informatica announced in May 2025. future.

If we finance acquisitions by issuing equity or convertible or other debt securities or taking out loans, our existing stockholders may be diluted, or we could face constraints related to the terms of, and repayment obligation related to, the incurrence of indebtedness that could affect the market price of our common stock. For example, in connection with our acquisition of Informatica, we entered into the Informatica Credit Agreements on an unsecured basis. In November 2025, the Company borrowed the full $6.0 billion available under the Informatica Credit Agreements to finance a portion of the cash consideration for the acquisition, repay existing indebtedness of Informatica and its subsidiaries, and pay related fees, costs, and expenses. For more information, see Note 8 “Debt” to the consolidated financial statements in Item I of Part 1.

In addition, the markets and monetization strategies for certain offerings, including Agentforce and Data Cloud, remain relatively new and uncertain and as a result our expansion into such offerings, and related investments, may present additional risks and challenges. For example, we offer certain products, including Agentforce and Data Cloud, through a consumption-based business model and may increase the number of products through which we do so. Additionally, due to customer flexibility in the timing of their consumption, we could We have limited experience with determining optimal pricing for our consumption-based contracts and may have lower levels of customer consumption of our products than we expect which may result in suboptimal pricing for consumption-based contracts.

Our success depends on the willingness of a growing community of third-party developers and technology providers vendors to build applications and provide integrations, data and content that are complementary to our services. Without the continued development of these applications and provision of such integrations, data and content, both current and potential customers may not find our services sufficiently attractive, which could impact future sales. In addition, for those customers who authorize a third-party technology partner to access their data, we do not provide any warranty related to the functionality, security or integrity of the data access, transmission or processing. Despite contract provisions to protect us, customers may look to us to support and provide warranties for the third-party applications, integrations, data and content, even though not developed or sold by us, which may expose us to potential claims, liabilities and obligations, all of which could harm our reputation and our business.

Policies we adopt or choose not to adopt on social and ethical issues, especially regarding the use of our products, may be unpopular with some of our employees or with our customers or potential customers, and have in the past impacted and may in the future impact our ability to attract or retain employees and customers. Our decisions about whether to conduct business with potential customers, or whether to continue or expand business with existing customers, may also impact our ability to attract or retain employees and customers, and could result in negative publicity or reputational harm. Further, actions taken by our customers and employees, including through the use or misuse of our products or new technologies for illegal activities or improper information sharing, may result in reputational harm or possible liability, particularly in light of regulatory requirements like the EU’s Digital Services Act (“DSA”) from the EU. and AI Act. For example, we have been subject to allegations in legal proceedings that we should be liable for the use of certain of our products by third parties. Although we believe that we have a strong defense against these allegations, legal proceedings can be lengthy, expensive and disruptive to our operations and the outcome of any claims or litigation, regardless of the merits, is inherently uncertain. Regardless of outcome, these types of claims could cause reputational harm to our brand or result in liability.

Further, in some cases, industry-specific, regionally-specific or product-specific laws, regulations or interpretive positions may impact our ability, as well as the ability of our customers, partners and data providers, to collect, augment, analyze, use, transfer and share personal and other information that is integral to certain services we provide. The interpretation of many of these statutes, regulations and rulings is evolving in the courts and administrative agencies and an inability to comply may have an adverse impact on our business and results. This impact may be particularly acute in countries that have passed or are considering passing legislation that requires data to remain localized “in country,” as this may impose financial costs on companies required to store data in jurisdictions not of their choosing and to use nonstandard operational processes that add complexity and are difficult and costly to integrate with global processes. This is also true with respect to the global proliferation of laws regulating the financial services industry, including its use of cloud services. In Europe, the Digital Operational Resilience Act (“DORA”), which aims to ensure the resilience of the EU financial sectors, including through mandatory risk management, incident reporting, resilience testing and third-party outsourcing restrictions, went into effect in January 2025. The UK is advancing has implemented similar legislation and other countries may follow.

We are subject to income taxes in the United States and various other jurisdictions. Significant judgment is often required in the determination of our worldwide provision for income taxes. Our effective tax rate could be impacted by changes in our earnings and losses in countries with differing statutory tax rates, changes in operations, changes in non-deductible expenses, changes in the tax effects of stock-based compensation expense, changes in the valuation of deferred tax assets and liabilities and our ability to utilize them, the applicability of withholding taxes, effects from acquisitions and changes in accounting principles and tax laws. Any changes, ambiguity or uncertainty in taxing jurisdictions’ administrative interpretations, decisions, policies and positions could also materially impact our income tax liabilities. For example, as a result of the recently enacted One Big Beautiful Bill Act (the “OBBBA”), OBBBA, we expect to could be subject to Corporate Alternative Minimum Tax (“CAMT”). While certain changes brought forth by the OBBBA, notably, the immediate deduction of domestic research and development expenditures favorably impact our cash flows from operating activities, our tax provision may be adversely impacted to the extent additional clarification or interpretive guidance related to the OBBBA is released, or if there are changes to our valuation allowance assessment related to CAMT credits. CAMT.

As of July October 31, 2025, we had a substantial level of outstanding debt, including our Senior Notes. We are also party to the Revolving Loan Credit Agreement, which provides for our $5.0 billion Credit Facility. Facility, as well as the Informatica Credit Agreements. Although there were no outstanding borrowings under the Credit Facility as of July October 31, 2025, we may use the proceeds of future borrowings under the Credit Facility for general corporate purposes. There were no outstanding borrowings under the Informatica Credit Agreements as of October 31, 2025. In November 2025, we borrowed the full $6.0 billion available under the Informatica Credit Agreements to finance a portion of the cash consideration for our acquisition of Informatica, repay existing indebtedness of Informatica and its subsidiaries, and pay related fees, costs, and expenses.

•disruptions in our service due to computer hardware, software, network network, data center, or data center third-party LLM provider problems;