Small print.
Wide open.

Table of Contents

customer  misconfiguration  or  misuse,  or  by  inadequate  access  controls  or  other  security  practices  by  our 
customers. Such incidents, even if caused by customer misconfigurations or misuse, or by a customer’s lack of 
adequate  security  controls,  may  impact  our  reputation  or  the  reputation  of  our  models,  platform,  and 
applications, and may subject us to liability exposure, disruption of commercial relationships, or other damage. 

Cyberattacks,  including  cyberattacks  directed  at  our  networks,  our  customers’  networks,  or  the  networks  of 
third  parties  with  which  we  have  relationships,  have  been,  and  may  in  the  future  continue  to  be,  amplified 
through  the  use  of  AI,  including  our  models,  platform,  and  applications.  Such  capabilities  may  be  used  to 
automate  or  scale  attacks,  impersonate  employees  or  members  of  senior  management,  or  otherwise  gain 
unauthorized access to our systems or those of our customers, partners, or vendors.

Failures  in  our  internal  systems  or  controls,  security  breaches,  failures  to  comply  with  our  privacy  or  data 
protection commitments, or other incidents, whether resulting from malicious activity, human error, or system 
limitations,  could  adversely  affect  our  reputation,  brand,  and  business  and  impair  our  ability  to  attract  and 
retain customers. Our offices and the data centers that host our infrastructure, many of which are operated by 
third  parties,  are  also  exposed  to  physical  threats  as  well  as  failures  by  the  operators  of  those  facilities.  A 
physical intrusion could damage equipment, interrupt our services, or provide a path to our systems and data, 
including our model weights, that bypasses our network defenses.

Although  we  have  dedicated  significant  resources  designed  to  identify  and  address  these  security  risks,  we 
cannot guarantee that our security measures will be effective or that our recovery protocols, backup, and other 
systems will be sufficient. Even where we detect an incident, our response may prove inadequate, including if 
we  misjudge  its  severity,  respond  too  slowly,  or  fail  to  fully  remediate  the  underlying  cause.  In  addition, 
incidents that appear minor when they occur may later prove significant when considered together with other 
incidents or with information learned afterward, and a series of related incidents, none of which is material on 
its own, could prove material in the aggregate. We continue to devote significant resources to protect against 
security breaches and other incidents, and we may need to devote significant resources in the future to mitigate 
and address problems caused by breaches and other incidents, which may divert resources from the growth and 
expansion of our business. 

Any actual or perceived security breach or other incident experienced by us or third parties with whom we do 
business, particularly our CSPs, could damage our reputation and brand, cause our business to suffer, require 
us to expend significant capital and other resources, cause us to incur increasing costs, including costs to deploy 
additional  personnel  and  protection  technologies,  train  employees,  and  engage  third-party  experts  and 
consultants, expose us to litigation or regulatory action, cause us to violate applicable privacy, data protection, 
security, and other laws and regulations, subject us to adverse publicity and a loss of confidence in our security 
measures, and cause us to incur significant fines, penalties, and other liability exposure, which could adversely 
affect our business, financial condition, and results of operations. We have taken steps to limit our liability for 
certain incidents, for example through warranty disclaimers and limitations of liability in our terms of service, 
but those contractual protections may not be upheld, or may not apply to certain claims, or may otherwise be 
insufficient to limit our liability exposure under applicable law.

In  the  EU,  we  face  increasingly  stringent  regulatory  reporting  obligations  for  cybersecurity  and  AI-related 
incidents. Under the GDPR, we must notify the competent regulators about incidents that involve personal data 
and  are  likely  to  result  in  a  risk  to  the  rights  and  freedoms  of  individuals.  Similarly,  the  EU  Network  and 
Information  Security  Directive  2022/2555  (“NIS2”)  requires  us  to  notify  the  competent  authorities  of  any 
significant  cybersecurity  incident  through  a  staged  process.  In  addition,  the  EU  AI  Act  requires  providers  of 
general-purpose AI models with systemic risk to keep track of, document, and report serious incidents without 
undue delay to the AI Office and competent authorities. Going forward, providers and deployers of high-risk AI 
systems,  as  defined  under  the  EU  AI  Act,  will  also  have  to  report  serious  incidents  or  malfunctions  without 
undue delay in certain circumstances.

In the United States, companies are increasingly subject to analogous incident reporting obligations, including 
under federal and state data breach notification laws, such as the New York Stop Hacks and Improve Electronic 
Data  Security  (SHIELD)  Act.  In  addition,  certain  U.S.  states  have  adopted  incident  reporting  laws  specific  to 
frontier model providers, such as the New York Responsible AI Safety and Education Act (RAISE Act) and the 
California Transparency in Frontier Artificial Intelligence Act. These frameworks create heightened compliance 
and liability exposure in case of delayed, incomplete, or inaccurate incident disclosures.

90