Cyngn (CYN) Risk Factors

We rely on our executive officers and key employees in the areas of business strategy, research and development, marketing, sales, services, and general and administrative functions. From time to time, there may be changes in our executive management team or key employees resulting from the hiring or departure of executives or key employees, which could disrupt our business. We do not maintain key-man insurance for any member of our senior management team or any other employee. None of the employment agreements and offer letters with our executive officers or other key personnel require them to continue to work for us for any specified period and, therefore, they could terminate their employment with us at any time. The loss of one or more of our executive officers or key employees could have a serious adverse effect on our business. To execute our growth plan, we must attract and retain highly qualified personnel. Competition for these personnel is intense in the technology industry, especially for engineers with high levels of experience in artificial intelligence and designing and developing autonomous driving related algorithms. Furthermore, it can be difficult to recruit personnel from other geographies to relocate to our California location. We may also need to recruit highly qualified technical engineers internationally and therefore subject us to the compliance of relevant immigration laws and regulations. We have, from time to time, experienced, and we expect to continue to experience, difficulty in hiring and retaining employees with appropriate qualifications. Many of the companies with which we compete for experienced personnel have greater resources than we have and can offer more attractive compensation packages for new employees. If we hire employees from competitors or other companies, their former employers may attempt to assert that these employees or our company have breached their legal obligations, resulting in a diversion of our time and resources and potentially in litigation. In addition, job candidates and existing employees often consider the value of the share incentive awards they receive in connection with their employment. If the perceived value of our share awards declines, it may adversely affect our ability to recruit and retain highly skilled employees. If we fail to attract new personnel on a timely basis or fail to retain and motivate our current personnel, we may not be able to commercialize and then expand our solutions and services in a timely manner and our business and future growth prospects could be adversely affected.

In operating our business and providing services and solutions to clients, we collect, use, store, transmit, and otherwise process employee, partner, and customer data, including personal data, in and across multiple jurisdictions. We use the electronic systems within the autonomous industrial vehicles that log information about each industrial vehicle's use in order to aid us in vehicle diagnostics, repair, and maintenance, as well as to help us collect data regarding operators' use patterns and preference in order to help us customize and optimize the driving and operating experiences. The integrated autonomous industrial vehicles leveraging our software products and tools may also collect personal information of drivers, operators and passengers, such as a voice command of a person, in order to aid the manual operation of our industrial vehicles. When our autonomy enabled industrial vehicles are in operation, the camera, LiDAR, and other sensing components of the vehicles will collect site and route view, mapping data, landscape images, and other LiDAR information, which may include personal information such as license plate numbers of other vehicles, facial features of pedestrians, appearance of individuals, GPS data, geolocation data, in order train the data analytics and artificial intelligence technology equipped in our industrial vehicles for the purpose of identifying different objects, and predicting potential issues that may arise during the operation of our integrated industrial vehicles. We plan to utilize systems and applications that are spread over the globe, requiring us to regularly move data across national borders. As a result, we are subject to a variety of laws and regulations in the United States, and other foreign jurisdictions as well as contractual obligations, regarding data privacy, protection, and security. Some of these laws and regulations require obtaining data subjects' consent to the collection and use of their data, honoring data subjects' request to delete their data or limit the processing of their data, providing notifications in the event of a data breach, and setting up the proper legal mechanisms for cross-border data transfers. Some customers may refuse to provide consent to our collection and use of their personal information, or may restrict our use of such personal information, and in some cases it is not feasible to obtain consent from data subjects in the general public whose personal information may be captured by our autonomous industrial vehicles, all of which may hinder our ability to train our data analytics and artificial intelligence technology, and may harm the competitiveness of our technology. In many cases, these laws and regulations apply not only to the collection and processing of personal information from third parties with whom we do not have any contractual relationship, but also to the sharing or transfer of information between or among us, our subsidiaries and other third parties with which we have commercial relationships, such as our service providers, partners, and customers. The regulatory framework for data privacy, protection, and security worldwide is continuously evolving and developing and, as a result, interpretation and implementation standards and enforcement practices are likely to remain uncertain for the foreseeable future. In particular, some of these laws and regulations may require us to store certain categories of data collected from individuals residing in a jurisdiction only on servers physically located in such jurisdiction, and may further require us to conduct security assessments and/or adopt other cross-border data transfer mechanisms in order to transfer such data outside of such jurisdiction. With the continuously evolving and rapidly changing privacy regulatory regime, our ability to freely transfer data among our affiliates and with our partners in different jurisdictions may be impeded, or we may need to incur significant costs in order to comply with such requirements. In addition, the number of high-profile data breaches at major companies continues to accelerate, which will likely lead to even greater regulatory scrutiny. The scope and interpretation of the laws and regulations that are or may be applicable to us are often uncertain and may be conflicting, particularly with respect to foreign laws. For example, the E.U. General Data Protection Regulation (the "GDPR"), which became effective in May 2018, greatly increased the European Commission's jurisdictional reach of its laws and added a broad array of requirements for handling personal data with respect to EU data subjects. EU member states are tasked under the GDPR to enact, and have enacted, certain implementing legislation that adds to and/or further interprets the GDPR requirements and potentially extends our obligations and potential liability for failing to meet such obligations. The GDPR, together with national legislation, regulations and guidelines of the EU member states and the United Kingdom governing the processing of personal data, impose strict obligations and restrictions on the ability to collect, use, retain, protect, disclose, transfer, and otherwise process personal data with respect to EU and UK data subjects. In particular, the GDPR includes obligations and restrictions concerning the consent and rights of individuals to whom the personal data relates, the transfer of personal data out of the European Economic Area or the United Kingdom, security breach notifications and the security and confidentiality of personal data. Among other stringent requirements, the GDPR restricts transfers of data outside of the EU to third countries deemed to lack adequate privacy protections (such as the U.S.), unless an appropriate safeguard specified by the GDPR is implemented. A July 16, 2020 decision of the Court of Justice of the European Union invalidated a key mechanism for lawful data transfer to the U.S. and called into question the viability of its primary alternative. As such, the ability of companies to lawfully transfer personal data from the EU to the U.S. is presently uncertain. Other countries have enacted or are considering enacting similar cross-border data transfer rules or data localization requirements. These developments could limit our ability to launch our products in the EU and other foreign markets. The GDPR authorizes fines for certain violations of up to 4% of global annual revenue or €20 million, whichever is greater. Such fines are in addition to any civil litigation claims by data subjects. Much remains unknown with respect to how to interpret and implement the GDPR and guidance on implementation and compliance practices is often updated or otherwise revised. Given the breadth and depth of changes in data protection obligations, including classification of data and our commitment to a range of administrative, technical and physical controls to protect data and enable data transfers outside of the EU and the United Kingdom, our compliance with the GDPR's requirements will continue to require time, resources and review of the technology and systems we use to satisfy the GDPR's requirements, including as EU member states enact their legislation. Further, while the United Kingdom enacted the Data Protection Act 2018 in May 2018 that supplements the GDPR, and has publicly announced that it will continue to regulate the protection of personal data in the same way post-Brexit, Brexit has created uncertainty with regard to the future of regulation of data protection in the United Kingdom. The U.S. federal government and various states and governmental agencies also have adopted or are considering adopting various laws, regulations, and standards regarding the collection, use, retention, security, disclosure, transfer, and other processing of sensitive and personal information. In addition, many states in which we operate have laws that protect the privacy and security of sensitive and personal information. Certain state laws may be more stringent or broader in scope, or offer greater individual rights, with respect to sensitive and personal information than federal, international, or other state laws, and such laws may differ from each other, which may complicate compliance efforts. State laws are changing rapidly and there is discussion in Congress of a new federal data protection and privacy law to which we would become subject if it is enacted. All of these evolving compliance and operational requirements impose significant costs that are likely to increase over time, may require us to modify our data processing practices and policies, and may divert resources from other initiatives and projects. Furthermore, non-compliance with data privacy laws and regulations, or a major breach of our network security and systems, could have serious negative consequences for our businesses and future prospects, including possible fines, penalties, and damages, reduced customer demand for our products, and harm to our reputation and brand, all of which may have a material and adverse impact on our business, financial condition, and operating results. We make public statements about our use and disclosure of personal information through our privacy policy, information provided on our website and press statements. Also, we enter into contracts with third parties (such as our partners and clients) that contain provisions regarding the collection, sharing, and processing of personal information. Although we endeavor to comply with our public statements and documentation as well as our contractual and other privacy-related obligations, we may at times fail to do so or be alleged to have failed to do so. The publication of our privacy policy and other statements that provide promises and assurances about data privacy and security can subject us to potential government or legal action if they are found to be deceptive, unfair or misrepresentative of our actual practices. In addition, from time to time, concerns may be expressed about whether our products and services compromise the privacy of clients and others. Any concerns about our data privacy and security practices (even if unfounded), or any failure, real or perceived, by us to comply with our posted privacy policies, contractual obligations, or any legal or regulatory requirements, standards, certifications, or orders, or other privacy or consumer protection-related laws and regulations applicable to us, could cause our clients to reduce their use of our autonomous industrial vehicles and could affect our financial condition, operating results, and our reputation, and may result in governmental or regulatory investigations, enforcement actions, regulatory fines, criminal compliance orders, litigations, breach of contract claims, or public statements against us by government regulatory authorities, our partners and/or clients, data subjects, consumer advocacy groups, or others, all of which could be costly and have an adverse effect on our business. Furthermore, enforcement actions and investigations by regulatory authorities related to data security incidents and privacy violations continue to increase. Non-compliance could result in proceedings against us by data protection authorities, governmental entities or others, including class action privacy litigation in certain jurisdictions, which would subject us to significant fines, penalties, judgments, and negative publicity, and may otherwise affect our financial condition, operating results, and our reputation. Given the complexity of operationalizing the GDPR and other data privacy and security laws and regulations to which we are subject, the maturity level of proposed compliance frameworks and the relative lack of guidance in the interpretation of the numerous requirements of the GDPR and other data privacy and security laws and regulations to which we are subject, we may not be able to respond quickly or effectively to regulatory, legislative, and other developments, and these changes may in turn impair our ability to offer our existing or planned products and services and/or increase our cost of doing business. In addition, if our practices are not consistent or viewed as not consistent with legal and regulatory requirements, including changes in laws, regulations, and standards or new interpretations or applications of existing laws, regulations and standards, we may become subject to audits, inquiries, whistleblower complaints, adverse media coverage, investigations, loss of export privileges, or severe criminal or civil sanctions, all of which may affect our financial condition, operating results, and our reputation. Unauthorized access or disclosure of personal or other sensitive or confidential data of Company (including data about third parties which the Company possesses), whether through systems failure, employee negligence, fraud, or misappropriation, by the Company, our service providers or other parties with whom we do business (if they fail to meet the standards we impose, or if their systems on which our data is stored experience any data breaches or security incidents) could also subject us to significant litigation, monetary damages, regulatory enforcement actions, fines, and criminal prosecution in one or more jurisdictions.

The market for autonomous industrial vehicles and industrial automation solutions is highly competitive. Many companies are seeking to develop autonomous driving and delivery solutions. Competition in these markets is based primarily on technology, innovation, quality, safety, reputation, and price. Our future success will depend on our ability to further develop and protect our technology in a timely manner and to stay ahead of existing and new competitors. Our competitors in this market are working towards commercializing autonomous driving technology and may have substantial financial, marketing, research and development, and other resources. In addition, we also face competition from traditional industrial vehicle and solution companies. Traditional vehicle and solution providers operating with human drivers are still the predominant operators in the market. Because of the long history of such traditional companies serving our potential customers and industries, there may be many constituencies in the market that would resist a shift towards autonomous industrial vehicles, which could include lobbying and marketing campaigns, particularly because our technology will displace machine operators and drivers. In addition, the market leaders in our target industries, such as Industrial Material Handling, may start, or have already started, pursuing large scale deployment of autonomous industrial vehicle technology on their own. These companies may have more operational and financial resources than we do. We cannot guarantee that we will be able to effectively compete with them. We may also face competition from component suppliers and other technology and industrial solution companies if they decide to expand vertically and develop their own autonomous industrial vehicles, some of whom have significantly greater resources than we do. We do not know how close these competitors are to commercializing autonomous driving systems. Many established and new market participants have entered or have announced plans to enter the autonomous industrial vehicle market. Most of these participants have significantly greater financial, manufacturing, marketing, and other resources than we do and may be able to devote greater resources to the design, development, manufacturing, distribution, promotion, sale, and support of their products. If existing competitors or new entrants commercialize earlier than expected, our competitive advantage could be adversely affected.

Users may be less likely to purchase or use our technology and the industrial vehicles it is deployed on if they are not convinced that our business will succeed or that our service and support and other operations will continue in the long term. Similarly, suppliers and other third parties will be less likely to invest time and resources in developing business relationships with us if they are not convinced that our business will succeed. Accordingly, in order to build and maintain our business, we must maintain confidence among users, suppliers, securities and industry analysts, and other parties in our long-term financial viability and business prospects. Maintaining such confidence may be particularly complicated by certain factors including those that are largely outside of our control, such as our limited operating history at scale, user unfamiliarity with our solutions, any delays in scaling manufacturing, delivery, and service operations to meet demand, competition and uncertainty regarding the future of autonomous vehicles, and our performance compared with market expectations.

Our technology is used for autonomous driving, which presents the risk of significant injury, including fatalities. We may be subject to claims if one of our or a customer's industrial vehicles is involved in an accident and persons are injured or purport to be injured or if property is damaged. Any insurance that we carry may not be sufficient or it may not apply to all situations. If we experience such an event or multiple events, our insurance premiums could increase significantly or insurance may not be available to us at all. Further, if insurance is not available on commercially reasonable terms, or at all, we might need to self-insure. In addition, lawmakers or governmental agencies could pass laws or adopt regulations that limit the use of autonomous driving or industrial automation technology or increase liability associated with its use. Any of these events could adversely affect our brand, relationships with users, operating results, or financial condition.

Our business is vulnerable to damage or interruption from pandemics and epidemics, or outbreak of an infectious disease, such as COVID-19 and subsequent variants, natural disasters, terrorist attacks, political unrest, acts of war (such as the ongoing conflicts between Russia and Ukraine, and Israel and Palestine). The recent inflation in the United States, foreign and domestic government sanctions imposed on Russia as a result of its invasion of Ukraine, and the conflicts in Israel and Palestine has caused or may continue to result in extreme volatility and disruptions in the capital and credit markets, which may adversely affect investor's confidence and, in turn may affect our ability to raise additional capital. The occurrence of an epidemic or a pandemic, such as the COVID-19 pandemic, has had and may continue to have an adverse effect on our operating results. The extent to which epidemics and pandemics impact our financial condition or results of operations will depend on many factors outside of our control and whether there is a material impact on the businesses or productivity of our customers, employees, suppliers and other partners. Other considerations related to the ongoing conflicts between Russia and Ukraine, and Israel and Palestine that may affect the Company include possible cyberattacks and potential disruptions in the banking systems and capital market, as well as supply chain and increased costs and expenditures on domestic and internationally-sourced materials and services. As an example, we engage third-party software development engineers who reside in Russia. Due to the ongoing conflict, we may experience an interruption in the services provided by these parties. We are also vulnerable to natural disasters and other calamities. Although we have servers that are hosted in an offsite location, our backup system does not capture data on a real-time basis, and we may be unable to recover certain data in the event of a server failure. We cannot assure you that any backup systems will be adequate to protect us from the effects of fire, floods, typhoons, earthquakes, power loss, telecommunications failures, break-ins, war, riots, terrorist attacks or similar events. Any of the foregoing events may give rise to interruptions, breakdowns, system failures, technology platform failures or internet failures, which could cause the loss or corruption of data or malfunctions of software or hardware as well as adversely affect our ability to provide services.