Factset Research (FDS) Risk Analysis

We may receive notice from others claiming that we have infringed upon their intellectual property rights. Responding to these claims may require us to enter into royalty and licensing agreements on unfavorable terms, incur litigation costs, enter into settlements, stop selling or redesign affected products, or pay damages and satisfy indemnification commitments with our clients or suppliers under contractual provisions of various license arrangements. Additionally, third parties may copy, infringe or otherwise profit from the unauthorized use of our intellectual property rights, requiring us to litigate to protect our rights. Certain countries may not offer adequate protection of proprietary rights. If we are required to defend ourselves or assert our rights or take such actions mentioned, our operating margins may decline as a result. We have incurred, and expect to continue to incur, expenditures to acquire the use of technology and intellectual property rights as part of our strategy to manage this risk.

Many of our products, as well as our internal systems and processes, involve the collection, retrieval, processing, storage and transmission of our own, as well as supplier and client, proprietary information and sensitive or confidential data through a variety of media channels. We rely on, and continuously invest in, internal processes, controls, policies, procedures and employee training programs designed to protect confidential data received in the ordinary course of business, including information from client portfolios and strategies. However, these measures do not guarantee security, and improper access to or release of confidential information may still occur-whether due to employee error or malfeasance, system error, inadvertent release, failure to properly purge or protect data, or through cyber-attacks. Our size, scale and role in the financial markets increases our risk for cyber-attacks and our exposure to other cyber-security risks. We use third-party service providers for certain critical functions. We and our third-party service providers are subject to the risks of system failures, security breaches and cyber-attacks, such as those sponsored by nation-states, terrorist organizations, or global corporations seeking to illicitly obtain technology or other intellectual property, including through the use of generative AI, agentic AI, phishing scams, hacking, viruses, denial of service attacks, tampering, intrusions, physical break-ins, ransomware and malware, employee errors or malfeasance. Cyber-security risks also may be derived from fraud or malice on the part of our employees or third-party service providers, or may result from human error, software bugs, server malfunctions, software or hardware failures or other technological failures. Our and our vendors' use of mobile and cloud technologies may increase our risk for such threats. Our protective systems and procedures and those of third parties to which we are connected, such as cloud computing providers, may not be effective against these threats. In addition, failure by our clients or third-party service providers to notify us of system failures or security breaches in a timely manner could lead to unauthorized access to our systems and data, resulting in adverse effects on our business, operating results or financial condition. We also make acquisitions periodically. While significant effort is placed on addressing information technology security issues with respect to the companies we acquire, we may inherit such risks when these acquisitions are integrated into our infrastructure. Although we conduct due diligence during acquisition processes, acquired businesses may not have invested as heavily in security measures and technology, and this may introduce additional security risk. While we have dedicated resources responsible for maintaining appropriate levels of cybersecurity, and implemented systems and processes intended to help identify cyberattacks and protect and remediate our network infrastructure, we may not be able to anticipate, prevent or detect all such attacks. As these threats continually evolve, we are required to devote additional resources and investment to modify or enhance our systems and processes, including patch and vulnerability management, which we may not be able to do in a timely or complete manner, or without adversely impacting our business, financial condition or results of operations. We make a range of commitments to our clients regarding our security practices, processes and security posture. If we do not adequately implement and enforce these security practices to the satisfaction of our clients, we could be in violation of our commitments to our clients. Cyberattacks, security breaches or third-party reports of perceived security vulnerability to our systems, even if no breach has occurred, also could damage our brand and reputation, result in litigation, regulatory actions, loss of client confidence and increased legal liability. While we maintain insurance coverage that is intended to address certain aspects of cybersecurity and data protection risks, such coverage may not include, or may not be sufficient to cover, all or the majority of the costs, losses or types of claims.

We use, and are expanding our use of, machine learning and AI technologies in our products and processes. If we fail to keep pace with rapidly evolving AI technological developments, or fail to launch products that are competitive, our competitive position and business results may be negatively impacted. If our competitors or other third parties incorporate AI technologies, such as emerging generative and agentic AI, into their products and processes more quickly or more successfully than us, this could impair our ability to compete effectively. Our use of AI technologies, including generative and agentic AI, requires resources to develop, test and maintain such products, which is costly. Despite our investments in, and commitment of resources to, the development of AI products and technologies, we may not be successful in generating revenues from these efforts. In addition, third parties may be able to use AI to create technology that could reduce demand for our products and services. The introduction of AI technologies, particularly generative and agentic AI, into new or existing offerings may result in new or expanded risks and liabilities, due to enhanced governmental or regulatory scrutiny, litigation, compliance issues, ethical concerns, confidentiality, data privacy or security risks, as well as other factors that could adversely affect our business, reputation, and financial results. For example, AI technologies can lead to unintended consequences and errors, including generating content that appears correct but is factually inaccurate, misleading or otherwise flawed, or that results in unintended biases and discriminatory outcomes, which could harm our reputation and expose us to liability. If the content, analyses, or recommendations that AI applications assist in producing are, or are alleged to be, deficient, inaccurate, unreliable, misleading, biased, discriminatory or otherwise flawed, any of which may not be easily detectable, our business and reputation may be adversely affected. Use of AI technologies, and the evolving legal, regulatory and compliance framework for AI, could impact our ability to protect our data and intellectual property, as well as vendor and client information, and could expose us to intellectual property or other claims by third parties. Use of AI technologies may also increase risks related to cyberattacks or other security incidents or result in a failure to protect confidential information. Because AI technology is highly complex and rapidly developing, it is not possible to predict all of the legal, operational or technological risks that may arise relating to our use of AI. These risks include the possibility of enhanced governmental or regulatory scrutiny, litigation or other legal liability, compliance issues, ethical concerns, negative client perceptions, confidentiality or security risks, as well as other factors. Any of these issues could materially adversely affect our business, financial condition or results of operations. AI technologies used in our products and processes may use or incorporate data from third-party sources, including information they input into the AI tools, which may expose us to risks associated with data rights and protection.