Clarivate (CLVT) Risk Analysis

Our reputation and ability to attract, retain, and serve our customers is dependent upon the reliable performance and security of our computer systems and those of third parties that we utilize in our operations to collect, store, use, and otherwise process public records, IP, and proprietary, confidential, and sensitive data, including personal data. Most of our products and services are delivered electronically, and our customers rely on our ability to process and deliver substantial quantities of information and other services on computer-based networks. Some elements of these systems are provided by third-party providers, including critical data inputs or software received from third-party suppliers and data systems stored on cloud-based computing infrastructure. We expend significant resources to develop and secure our computer systems, IP, and proprietary, confidential, or sensitive data, but they may be subject to damage or interruption from weather conditions (including climate change), natural disasters, infrastructure or network failures (including failures at third-party data centers, by third-party cloud-computing providers, or of aging technology assets), terrorist attacks, power loss, internet and telecommunications failures, the loss or failure of systems over which we have no control, and cybersecurity risks such as cyberattacks, ransomware attacks, social engineering (including phishing attacks), computer viruses, denial of service attacks, physical or electronic break-ins, and similar disruptions from foreign governments, state-sponsored entities, hackers, organized cybercriminals, cyber terrorists, and individual threat actors (including malicious insiders), any of which may see their effectiveness further enhanced in the future by the use of AI. We may also face additional strain on our systems and networks due to aging or end-of-life technology that we have not yet updated or replaced. Further, many of our employees work remotely, which magnifies the importance of the integrity of our remote access security measures and may expose us to additional cybersecurity risks. We have implemented certain systems and processes designed to thwart such threat actors and otherwise protect our computer systems and proprietary, confidential, or sensitive data; however, the systems and processes we have adopted may not be effective, and, similar to many other global multinational companies, we have experienced and may continue to experience cyber-threats, cyberattacks and other attempts to breach the security of our systems or gain unauthorized access to our proprietary, confidential, or sensitive data. Any fraudulent, malicious, or accidental breach of our computer systems or data security protections (including due to malicious insiders or inadvertent employee errors) could result in unintentional disclosure of, or unauthorized access to, customer, vendor, employee, or our own proprietary, confidential, or sensitive data or other protected information, which could result in additional costs to enhance security or to respond to such incidents, lost sales, violations of privacy or other laws, notifications to individuals, penalties, or litigation. Any failure of our computer systems, disruption to our operations, or unauthorized access to any of our computer systems or those of third parties upon whom we rely or with whom we partner, including our cloud computing and other service providers, vendors, contractors, and consultants, could result in, among other things, significant expense to repair, replace, or remediate such systems, equipment, or facilities, a loss of customers, legal or regulatory claims, and proceedings or fines and adversely affect our business and results of operations. Additionally, while we generally perform cybersecurity due diligence on our key vendors, service providers, contractors, and consultants, if any of these third parties fail to adopt or adhere to adequate cybersecurity practices, or in the event of a breach, incident, disruption, or other compromise of their networks, computer systems, or applications, our or our customers' proprietary, confidential, or sensitive data, may be improperly lost, destroyed, modified, accessed, used, disclosed, or otherwise processed, which could subject us to claims, demands, proceedings, and liabilities. We do not have control over the operations of the facilities of third-party cloud computing service or other key vendors, service providers, contactors, and consultants that we use. This, coupled with the fact that we cannot easily switch our computing operations and other computer systems to other service providers, means that any disruption of or interference with our use of our current third-party cloud computing service, or the services provided by our other vendors, service providers, contractors, and consultants could disrupt our operations, and our business could be adversely impacted. Although we may have contractual protections with our third-party vendors, service providers, contractors, and consultants, any actual or perceived security breach, incident, or disruption could harm our reputation and brand, expose us to potential liability, or require us to expend significant resources on cybersecurity in responding to any such actual or perceived compromise, breach, incident, or disruption and negatively impact our business. Any contractual protections we may have from our third-party vendors, service providers, contractors, and consultants may not be sufficient to adequately protect us from any such liabilities and losses, and we may be unable to enforce any such contractual protections.

The markets for our products and services are highly competitive and are subject to rapid technological changes and evolving customer demands and needs. We compete on the basis of various factors, including the quality of content embedded in our databases, customers' perception of our products relative to the value that they deliver, user experience, and the quality of our overall offerings. Many of our principal competitors are established companies that have substantial financial resources, recognized brands, technological expertise, and market experience, and these competitors sometimes have more established positions in certain product lines and geographies than we do. We also compete with smaller and sometimes newer companies, some of which are specialized with a narrower focus than our company, and with other internet services companies and search providers. New and emerging technologies, including AI, can also have the impact of allowing start-up companies to enter the market more quickly than they would have been able to in the past. In addition, some of our competitors combine competing products with complementary products as packaged solutions, which could pre-empt use of our products or solutions and some of our customers may decide to independently develop certain products and services. If we fail to compete effectively, our financial condition and results of operations could be adversely affected.

Our ability to attract and retain customers is affected by external perceptions of our brand and reputation. Failure to protect the reputation of our brands may adversely impact our credibility as a trusted source of content and may have a negative impact on our business. In addition, in some jurisdictions, we engage sales agents in connection with the sale of certain of our products and services. Poor representation of our products and services by agents, or entities acting without our permission, could have an adverse effect on our brands, reputation, and business.

Our ability to execute our business strategy and achieve future success depends on the continued service and efforts of our employees, including our experts in research and analysis, as well as colleagues in sales, marketing, product development, critical operational roles, and management, including our executive officers. We rely on our key personnel to execute our existing business operations and identify and pursue new growth opportunities. We have made recent changes in senior management, including our CEO, and could have further changes in the future, which could be disruptive to our management and operations and impede our ability to fully implement our business plan and growth strategy. Our failure to develop an adequate succession plan for one or more of our executive officers or other key personnel could deplete our institutional knowledge base and erode our competitive advantage during a transition. We must also maintain our ability to attract, motivate, and retain highly qualified employees in our respective segments in order to support our customers and achieve business results. Our ability to attract and retain employees may be negatively impacted by employees' reactions to our policies related to working remotely and returning to office, particularly in the United States. The loss of the services of key personnel, leadership transition, or an inability to recruit effective replacements or to otherwise attract, motivate, or retain highly qualified personnel could have a material adverse effect on our business, financial condition, and operating results.

Substantially all our products and services are developed using data, information, or services obtained from third-party providers and public sources or are made available to our customers or are integrated for our customers' use through information and technology solutions provided by third-party service providers. We have commercial relationships with third-party providers whose capabilities complement our own and, in some cases, these providers are also our competitors. The priorities and objectives of these providers, particularly those that are our competitors, may differ from ours, which may make us vulnerable to unpredicted price increases and unfavorable licensing terms. Agreements with such third-party providers periodically come up for renewal or renegotiation, and there is a risk that such negotiations may result in different rights and restrictions which could impact our customers' use of the content. From time to time, we may also receive notices from third parties claiming infringement by our products and services of third-party patent and other IP rights and as the number of products and services in our markets increases and the functionality of these products and services further overlaps with third-party products and services, we may become increasingly subject to claims by a third party that our products and services infringe on such party's IP rights. Moreover, providers that are not currently our competitors may become competitors or be acquired by or merge with a competitor in the future, any of which could reduce our access to the information and technology solutions provided by those companies. Any of the foregoing risks may be exacerbated by our use of AI, or that of our competitors or third-party service providers. If we do not maintain or obtain the expected benefits from our relationships with third-party providers or if a substantial number of our third-party providers or any key service providers were to withdraw their services, we may be less competitive, our ability to offer products and services to our customers may be negatively affected, and our results of operations could be adversely impacted.

In the ordinary course of business, we collect, store, use, and transmit certain types of information that are subject to different laws and regulations. In particular, data security and data protection laws and regulations often vary significantly by jurisdiction. For example, in the U.S., there are numerous federal, state, and local privacy, data protection, and cybersecurity laws, rules, and regulations governing the collection, storage, transmission, use, and other processing of personal data and Congress has considered, and continues to consider, many proposals for additional comprehensive national data privacy and cybersecurity legislation. At the state level, we are subject to laws, rules, and regulations, such as the California Consumer Privacy Act (as amended by the California Privacy Rights Act (collectively, "CCPA")), which imposes requirements, including disclosure requirements, access rights, opt out rights, and the right to request deletion of personal information, on covered companies that process California consumers' personal information and provides for civil penalties for violations as well as a private right of action for certain data breaches. A number of other states have enacted, or are in the process of enacting or considering, similar comprehensive state-level privacy, data protection, and cybersecurity laws, rules, and regulations, creating the potential for a patchwork of overlapping but different state laws. In addition, all 50 states have laws that require the provision of notification for security breaches of personal information to affected individuals, state officers, or others. Possible consequences for non-compliance with these various state laws include enforcement actions in response to rules and regulations promulgated under the authority of federal agencies and state attorneys general and legislatures and consumer protection agencies. Outside of the United States, an increasing number of laws, rules, regulations, and industry standards apply to privacy, data protection, and cybersecurity, such as the EU's General Data Protection Regulation ("GDPR") and the UK's Data Protection Act 2018 as supplemented by the GDPR as implemented into UK law (collectively, "UK GDPR"), both of which impose similar, stringent data protection requirements. The GDPR and UK GDPR are wide-ranging in scope and impose numerous additional requirements on companies that process personal data, including imposing special requirements in respect of the processing of personal data, requiring that consent of individuals to whom the personal data relates is obtained in certain circumstances, requiring additional disclosures to individuals regarding data processing activities, requiring that safeguards are implemented to protect the security and confidentiality of personal data, creating mandatory data breach notification requirements in certain circumstances, and requiring that certain measures (including contractual requirements) are put in place when engaging third-party processors. The GDPR and UK GDPR also provide individuals with various rights in respect of their personal data, including rights of access, erasure, portability, rectification, restriction, and objection. Failure to comply with the GDPR and the UK GDPR can result in significant fines and other liability. While the UK GDPR currently imposes substantially the same obligations as the GDPR, the UK GDPR will not automatically incorporate changes to the GDPR going forward, which creates a risk of divergent parallel regimes and related uncertainty, along with the potential for increased compliance costs and risks for affected businesses. Legal developments in the European Economic Area ("EEA") and the UK, including rulings from the Court of Justice of the European Union, have also created complexity and uncertainty regarding processing and transfers of personal data from the EEA and the UK to the United States and other countries outside the EEA and the UK that have not been determined by the relevant data protection authorities to provide an adequate level of protection for privacy rights. Data security and data protection laws and regulations are continuously evolving and there are currently a number of legal challenges to the validity of EU mechanisms for adequate data transfers such as the EU-US Data Privacy Framework and the European Commission's Standard Contractual Clauses. Although we have implemented policies and procedures that are designed to ensure compliance with applicable privacy and data security laws, rules and regulations, the efficacy and longevity of these policies and procedures remains uncertain, and if our privacy or data security measures fail to comply with applicable current or future laws and regulations, including, without limitation, the EU ePrivacy Regulation, GDPR, UK GDPR and CCPA as well as those of other countries such as India's Digital Personal Data Protection Act 2023 and China's Cybersecurity, Data Security and Personal Information Protection laws, we will likely be required to modify our data collection or processing practices and policies in an effort to comply with such laws and regulations, and we could be subject to increased costs, fines, litigation, regulatory investigations, and enforcement notices requiring us to change the way we use personal data or our marketing practices or other liabilities such as compensation claims by individuals affected by a personal data breach, as well as negative publicity and a potential loss of business. Additionally, we may be bound by contractual requirements applicable to our collection, storage, transmission, use, and other processing of proprietary, confidential, and sensitive data, including personal data, and may be bound or asserted to be bound by, or voluntarily comply with, self-regulatory or other industry standards relating to these matters.