Small print.
Wide open.

Table of Contents

As  an  AI  technology  company,  we  are  subject  to  rapidly  evolving  and  increasingly  complex  laws,  regulations, 
and  governmental  review  across  multiple  jurisdictions.  New  laws,  rules,  regulations,  and  changes  to  existing 
laws and regulations are continuously being adopted, implemented, and interpreted as governments worldwide 
develop frameworks to address AI development, deployment, and safety. The primary areas of regulation that 
affect  our  business  include  AI-related  regulations,  data  privacy  and  security,  export  controls  and  trade 
regulations, and other matters such as intellectual property, employment and labor, competition and antitrust, 
consumer protection, and tax.

The following discussion addresses the most significant regulatory areas affecting our business.

AI-Related Regulation

Various  governments  and  regulatory  authorities  in  the  United  States  and  other  countries  have  proposed, 
enacted,  or  are  considering  legislation,  regulations,  and  guidance  relating  to  AI  model  development  and 
deployment,  data  usage,  privacy,  data  protection,  transparency,  safety,  consumer  protection,  content 
generation,  intellectual  property,  cybersecurity,  export  controls,  and  competition.  For  example,  in  the  United 
States,  AI  regulation  is  developing  at  both  federal  and  state  levels.  The  National  Institute  of  Standards  and 
Technology  has  developed  the  AI  Risk  Management  Framework,  which  is  currently  voluntary  but  could 
potentially  inform  or  shape  future  mandatory  requirements.  The  FTC  and  many  state  attorneys  general  are 
interpreting federal and state consumer protection and privacy and security laws to impose standards for the 
online collection, use, dissemination, other processing, and security of data. Various states have enacted or are 
considering  enacting  AI-related  legislation.  For  example,  on  September  24,  2026,  state  attorneys  general  in 
New York and New Jersey, together with a coalition of other state and territorial attorneys general, sent a letter 
to  U.S.  Senate  and  House  of  Representatives  leadership  to  urge  Congress  to  establish  comprehensive  federal 
legislation  and  safety  protocols  for  frontier  AI.  In  the  EU,  the  EU  AI  Act  establishes  a  risk-based  framework 
categorizing  AI  systems  by  potential  risk  level.  General-purpose  AI  models  face  obligations  including 
transparency  requirements,  technical  documentation,  EU  copyright  compliance,  and  publication  of  training 
data summaries, and those with systemic risk face additional obligations, including model evaluation, systemic 
risk  mitigation,  serious  incident  reporting,  and  cybersecurity  protection.  High-risk  systems  must  meet 
requirements for risk management, data governance, documentation, transparency, human oversight, accuracy, 
robustness,  and  cybersecurity.  Any  actual  or  perceived  non-compliance  could  result 
in  regulatory 
investigations,  enforcement  actions  and  other  actions,  significant  fines,  litigation,  reputational  harm,  loss  of 
customer  trust,  and  interruptions  in  the  availability  or  performance  of  our  products  or  services;  require 
unfavorable changes to existing products or services; and delay the introduction of future products or services, 
which could have an adverse effect on our business.

We have called for regulation and oversight of frontier AI development, including standards primarily relevant 
to  the  use  of  AI  to  accelerate  AI  development,  so  that  safety,  alignment,  and  security  practices  advance  in 
proportion  with  capabilities.  We  have  also  proposed  working  with  the  U.S.  government  and  other  frontier  AI 
developers to establish safety and evaluation standards. Certain of the approaches we support, if adopted, could 
increase  our  compliance  burdens,  limit  our  product  development  or  deployment  flexibility,  affect  how  and 
when we develop or release new models, or otherwise slow our growth.

Data Privacy and Security

We collect, store, transfer, and otherwise process various types of data, including personal information, and are 
subject to numerous federal, state, local, and foreign laws and regulations addressing privacy, data protection, 
security, data localization, and the collection, use, transfer, and other processing of data. In the United States, 
these  include  comprehensive  state  privacy  laws  such  as  the  California  Consumer  Privacy  Act,  which  imposes 
obligations  on  us  to,  among  other  things,  provide  specific  privacy  disclosures,  afford  privacy  rights  such  as 
abilities  to  opt  out  of  certain  processing,  selling,  or  sharing  of  personal  information,  and  expand  consumer 
rights to personal information. On the federal level, the FTC and many state attorneys general are interpreting 
federal  and  state  consumer  protection  and  privacy  and  security  laws  to  impose  standards  for  the  online 
collection,  use,  dissemination,  other  processing,  and  security  of  data,  some  of  which  may  be  inconsistent. 
Outside  of  the  United  States,  numerous  foreign  jurisdictions,  including  the  EU,  United  Kingdom,  and  other 
jurisdictions  in  which  we  operate  our  business,  have  enacted  similar  laws  and  regulations  that  affect  our 
business.  For  example,  the  EU  General  Data  Protection  Regulation  and  the  United  Kingdom  General  Data 
Protection  Regulation  impose  stringent  requirements  upon  the  processing  of  personal  data.  The  EU’s  Digital 

238