Arqit Quantum (ARQQ) Risk Factors

Arqit's success depends in part on its ability to provide effective data security protection in connection with its platforms and services, and Arqit relies on information technology networks and systems to securely store, transmit, index, and otherwise process electronic information. Because its platforms and services are used by its customers to encrypt large data sets that often contain proprietary, confidential, and/or sensitive information (including in some instances personal or identifying information and personal health information), its software is perceived as an attractive target for attacks by computer hackers or others seeking unauthorized access, and its software faces threats of unintended exposure, exfiltration, alteration, deletion, or loss of data. Additionally, because many of Arqit's customers use its platforms to store, transmit, and otherwise process proprietary, confidential, or sensitive information, and complete mission critical tasks, they have a lower risk tolerance for security vulnerabilities in its platforms and services than for vulnerabilities in other, less critical, software products and services. Arqit, and the third-party vendors upon which Arqit relies, have experienced, and may in the future experience, cybersecurity threats, including threats or attempts to disrupt its information technology infrastructure and unauthorized attempts to gain access to sensitive or confidential information. Its and its third-party vendors' technology systems may be damaged or compromised by malicious events, such as cyberattacks (including computer viruses, malicious and destructive code, phishing attacks, and denial of service attacks), physical or electronic security breaches, natural disasters, fire, power loss, telecommunications failures, personnel misconduct, and human error. Such attacks or security breaches may be perpetrated by internal bad actors, such as employees or contractors, or by third parties (including traditional computer hackers, persons involved with organized crime, or foreign state or foreign state-supported actors). Cybersecurity threats can employ a wide variety of methods and techniques, which may include the use of social engineering techniques, are constantly evolving, and have become increasingly complex and sophisticated; all of which increase the difficulty of detecting and successfully defending against them. Furthermore, because the techniques used to obtain unauthorized access or sabotage systems change frequently and generally are not identified until after they are launched against a target, Arqit and its third-party vendors may be unable to anticipate these techniques or implement adequate preventative measures. Although prior cyberattacks directed at Arqit have not had a material impact on its financial results, and Arqit is continuing to bolster its threat detection and mitigation processes and procedures, Arqit cannot guarantee that future cyberattacks, if successful, will not have a material impact on its business or financial results. While Arqit has security measures in place to protect its information and its customers' information and to prevent data loss and other security breaches, there can be no assurance that Arqit will be able to anticipate or prevent security breaches or unauthorized access of its information technology systems or the information technology systems of the third-party vendors upon which Arqit relies. Despite its implementation of network security measures and internal information security policies, data stored on personnel computer systems is also vulnerable to similar security breaches, unauthorized tampering or human error. Many governments have enacted laws requiring companies to provide notice of data security incidents involving certain types of data, including personal data. In addition, most of Arqit's customers contractually require Arqit to notify them of data security breaches. If an actual or perceived breach of security measures, unauthorized access to its system or the systems of the third-party vendors that Arqit rely upon, or any other cybersecurity threat occurs, Arqit may face direct or indirect liability, costs, or damages, contract termination, its reputation in the industry and with current and potential customers may be compromised, its ability to attract new customers could be negatively affected, and its business, financial condition, and results of operations could be materially and adversely affected. Further, unauthorized access to Arqit's or its third-party vendors' information technology systems or data or other security breaches could result in the loss of information; significant remediation costs; litigation, disputes, regulatory action, or investigations that could result in damages, material fines, and penalties; indemnity obligations; interruptions in the operation of its business, including its ability to provide new product features, new platforms, or services to its customers; damage to its operation technology networks and information technology systems; and other liabilities. Moreover, its remediation efforts may not be successful. Any or all of these issues, or the perception that any of them have occurred, could negatively affect Arqit's ability to attract new customers, cause existing customers to terminate or not renew their agreements, hinder Arqit's ability to obtain and maintain required or desirable cybersecurity certifications, and result in reputational damage, any of which could materially adversely affect its results of operations, financial condition, and future prospects. There can be no assurance that any limitations of liability provisions in Arqit's license arrangements with customers or in its agreements with vendors, partners, or others would be enforceable, applicable, or adequate or would otherwise protect it from any such liabilities or damages with respect to any particular claim. Arqit maintains cybersecurity insurance and other types of insurance, subject to applicable deductibles and policy limits, but its insurance may not be sufficient to cover all costs associated with a potential data security incident. Arqit also cannot be sure that its existing general liability insurance coverage and coverage for cyber liability or errors or omissions will continue to be available on acceptable terms or will be available in sufficient amounts to cover one or more large claims or that the insurer will not deny coverage as to any future claim. The successful assertion of one or more large claims against Arqit that exceed available insurance coverage, or the occurrence of changes in its insurance policies, including premium increases or the imposition of large deductible or co-insurance requirements, could result in its business, financial condition and results of operations being materially adversely affected.

Arqit's products are highly technical and complex and require high standards to implement and may experience defects, errors or reliability issues at various stages of development and commercial implementation. Arqit may be unable to timely correct problems that have arisen or correct such problems to its customers' satisfaction. Additionally, undetected errors, defects or security vulnerabilities could result in litigation against Arqit, negative publicity and other consequences. Some errors or defects in its products may only be discovered after they have been tested, commercialized and deployed by customers. If that is the case, Arqit may incur significant additional development costs with respect to its products. These problems may also result in claims, including class actions, against Arqit by its customers or others. Its reputation or brand may be damaged as a result of these problems, customers may be reluctant to buy its products, and Arqit's business, financial condition and results of operations could be materially adversely affected.

Competition for highly-skilled personnel is often intense and Arqit may incur significant costs to attract and retain highly-skilled personnel. Arqit may not be successful in attracting, integrating, or retaining qualified personnel to fulfill its current or future needs. As its business grows, Arqit will need to recruit a large number of skilled employees in different jurisdictions in which it operates and expects to expand into in the future. Experienced and highly skilled employees are in high demand, competition for these employees can be intense and Arqit's ability to hire, attract and retain them depends on its ability to provide competitive compensation. Arqit will also need to expend significant time and expense to train the employees that it hires and it may struggle to retain employees, and its competitors may actively seek to hire skilled personnel away from it. If Arqit fails to attract new personnel or to retain and motivate its current personnel, its business and future growth prospects could be adversely affected.

As a publicly traded company, Arqit has incurred and expects to continue to incur significant legal, accounting and other expenses that it was not required to incur in the recent past, particularly after it is no longer an "emerging growth company" as defined under the JOBS Act. In addition, new and changing laws, regulations and standards relating to corporate governance and public disclosure, including the Dodd Frank Wall Street Reform and Consumer Protection Act and the rules and regulations promulgated and to be promulgated thereunder, as well as under the Sarbanes-Oxley Act, the JOBS Act, and the rules and regulations of the SEC and national securities exchanges have created uncertainty for public companies and increased the costs and the time that Arqit's board of directors and management must devote to complying with these rules and regulations. Arqit's management expects these rules and regulations to increase its legal and financial compliance costs and lead to a diversion of management time and attention from revenues generating activities. Furthermore, the need to establish the corporate infrastructure demanded of a public company may divert management's attention from its focus on Arqit's business strategy, which could prevent Arqit from improving its business, results of operations and financial condition. Arqit has made, and will continue to make, changes to its internal controls and procedures for financial reporting and accounting systems to meet its reporting obligations as a publicly traded company. However, the measures it takes may not be sufficient to satisfy Arqit's obligations as a publicly traded company. For as long as Arqit remains an "emerging growth company" as defined in the JOBS Act, it may take advantage of certain exemptions from various reporting requirements that are applicable to other public companies that are not "emerging growth companies." Arqit may remain an "emerging growth company" until September 2, 2026 (the fifth anniversary of the closing of the Business Combination) or until such earlier time that it has more than $1.235 billion in annual revenues, has more than $700 million in market value of Arqit's ordinary shares held by non-affiliates, or issues more than $1.00 billion of non-convertible debt over a three-year period. Further, there is no guarantee that the exemptions available to Arqit under the JOBS Act will result in significant savings. To the extent Arqit's management chooses not to use exemptions from various reporting requirements under the JOBS Act, Arqit will incur additional compliance costs, which may impact earnings.

Arqit is a foreign private issuer, as such term is defined in Rule 405 under the Securities Act, however, under Rule 405, the determination of foreign private issuer status is made annually on the last business day of an issuer's most recently completed second fiscal quarter and, accordingly, the next determination will be made with respect to Arqit on March 31, 2025. As a foreign private issuer, Arqit is not subject to all of the disclosure requirements applicable to public companies organized within the United States. For example, Arqit is exempt from certain rules under the Exchange Act, that regulate disclosure obligations and procedural requirements related to the solicitation of proxies, consents or authorizations applicable to a security registered under the Exchange Act, including the U.S. proxy rules under Section 14 of the Exchange Act (including the requirement applicable to emerging growth companies to disclose the compensation of its Chief Executive Officer and the other two most highly compensated executive officers on an individual, rather than an aggregate, basis). In addition, Arqit's officers and directors are exempt from the reporting and "short-swing" profit recovery provisions of Section 16 of the Exchange Act and related rules with respect to their purchases and sales of its securities. Moreover, while Arqit's management expects to submit interim consolidated financial data to the SEC under cover of the SEC's Form 6-K, it will not be required to file periodic reports and financial statements with the SEC as frequently or as promptly as U.S. public companies and will not be required to file quarterly reports on Form 10-Q or current reports on Form 8-K under the Exchange Act. Furthermore, Arqit ordinary shares are not listed on any market in the Cayman Islands and Arqit does not currently intend to list its ordinary shares on any market in the Cayman Islands, Arqit's home country. As a result, Arqit is not subject to the reporting and other requirements of companies listed in the Cayman Islands. Accordingly, there may be less publicly available information concerning Arqit's business than there would be if Arqit were a public company organized in the United States.

The majority of Arqit's directors and executive officers reside outside of the U.S., and most of its assets and most of the assets of these persons are located outside of the U.S. Therefore, a judgment obtained against Arqit, or any of these persons, including a judgment based on the civil liability provisions of the U.S. federal securities laws, may not be collectible in the U.S. and may not be enforced by courts in other jurisdictions. It may also be difficult for its shareholders to effect service of process on these persons in the U.S. or to assert U.S. securities law claims in original actions instituted in the U.K. or elsewhere. U.K. courts may refuse to hear a claim based on an alleged violation of U.S. securities laws reasoning that U.K. is not the most appropriate forum in which to bring such a claim. In addition, even if a U.K. court agrees to hear a claim, it may determine that U.K. law, instead of U.S. law, is applicable to the claim. As a result of potential difficulties associated with enforcing a judgment against Arqit, its shareholders may not be able to collect any damages awarded by either a U.S. or foreign court.

If Arqit were a PFIC for any taxable year (or portion thereof) that is included in the holding period of a U.S. Holder (as defined in the section entitled "Certain Material United States Federal Income Tax Considerations") of Arqit's ordinary shares or warrants, the U.S. Holder may be subject to adverse U.S. federal income tax consequences and may be subject to additional reporting requirements. As of the date hereof, Arqit has not made a determination as to its PFIC status for its most recent taxable year or its current taxable year, and it may be possible that Arqit is a PFIC for either such years. Arqit's possible status as a PFIC is determined on an annual basis based on the composition of its assets, income, activities and market capitalization (which, depending on Arqit's stock price, may fluctuate significantly) in the relevant taxable year and therefore may be subject to change. Accordingly, there can be no assurance that Arqit is not a PFIC for any taxable year. If Arqit is a PFIC during such U.S. Holder's holding period for the ordinary shares or warrants, unless the U.S. Holder makes certain elections, Arqit will continue to be treated as a PFIC with respect to such U.S. Holder, even if it ceases to be a PFIC in future taxable years. U.S. Holders are urged to consult their own tax advisors regarding the possible application of the PFIC rules to holders of Arqit securities. For a more detailed explanation of the tax consequences of PFIC classification to U.S. Holders, see "Certain Material United States Federal Income Tax Considerations - Passive Foreign Investment Company Rules."

Arqit's current and potential future operations and sales are subject to laws and regulations addressing privacy and the collection, use, storage, disclosure, transfer and protection of a variety of types of data. The primary data privacy laws applicable to Arqit include U.K. General Data Protection Regulation and the U.K. Data Protection Act of 2018. These regimes may, among other things, impose data security requirements, disclosure requirements, and restrictions on data collection, uses, and sharing that may impact its operations and the development of its business. Arqit's products collect, store and process certain information and its products may evolve to collect additional information. Therefore, the full impact of these privacy regimes on its business is rapidly evolving across jurisdictions and remains uncertain at this time. Arqit may also be affected by cyber-attacks and other means of gaining unauthorized access to its products, systems, and data. For instance, cyber criminals or insiders may target it or third parties with which Arqit has business relationships to obtain data, or in a manner that disrupts its operations or compromises its products or the systems into which its products are integrated. Arqit continually assesses the evolving privacy and data security regimes and implements measures that Arqit believes are appropriate in response. Since these data security regimes are evolving, uncertain and complex, especially for a global business like Arqit's, it may need to update or enhance its compliance measures as its products, markets and customer demands further develop, and these updates or enhancements may require implementation costs. In addition, Arqit may not be able to monitor and react to all developments in a timely manner and the compliance measures that Arqit adopts may prove ineffective. Any failure, or perceived failure, to comply with current and future regulatory or customer-driven privacy, data protection, and information security requirements, or to prevent or mitigate security breaches, cyber-attacks, or improper access to, use of, or disclosure of data, or any security issues or cyber-attacks affecting Arqit, could result in significant liability, costs (including the costs of mitigation and recovery), and a material loss of revenue resulting from the adverse impact on Arqit's reputation and brand, loss of proprietary information and data, disruption to its business and relationships, and diminished ability to retain or attract customers and business partners. Such events may result in governmental enforcement actions and prosecutions, private litigation, fines and penalties or adverse publicity, and could cause customers and business partners to lose trust in Arqit, and its business, financial condition and results of operations could be materially adversely affected.

While Arqit has invested substantial resources in technological development, and believes that its product is a unique innovation, continuing technological changes in quantum technology and changes in the markets for its products could adversely affect adoption of its products, either generally or for particular applications. Arqit's future success will depend upon its ability to develop and introduce a variety of new capabilities and innovations to its product offerings, as well as to introduce a variety of new product offerings, to address the changing needs of the markets in which Arqit offers its products. Delays in delivering new products that meet customer requirements could damage its relationships with customers and lead them to seek alternative sources of supply. Delays in introducing products and innovations, the failure to choose correctly among technical alternatives or the failure to offer innovative products or configurations at competitive prices may cause existing and potential customers to purchase its competitors' products or turn to alternative technology. If Arqit is unable to devote adequate resources to develop products or cannot otherwise successfully develop products or system configurations that meet customer requirements on a timely basis or that remain competitive with technological alternatives, its products could lose market share, its revenue could decline, and Arqit's business, financial condition and results of operations could be materially adversely affected.

The market adoption of Arqit's product is relatively new, rapidly evolving, and not fully proven. Accordingly, it is difficult to predict customer adoption and renewals and demand for its products and services, the entry of competitive products, the success of existing competitive products, or the future growth rate, expansion, longevity, and the size of the market for its products. The expansion of and its ability to penetrate these new and evolving markets depends on a number of factors, including: the cost, performance, and perceived value associated with its products, and the extent to which its products improve security and are easy to use for its customers. If Arqit experiences security incidents or disruptions in delivery or service, the market for its products may be negatively affected. If its products do not continue to achieve market acceptance, or there is a reduction in demand caused by decreased customer acceptance, technological challenges, weakening economic conditions, privacy, data protection and data security concerns, governmental regulation, competing technologies and products, or decreases in information technology spending or otherwise, the market for its products may not continue to develop or may develop more slowly than Arqit expects, which could adversely affect its business, financial condition, and results of operations.