The company has rigorous quality control standards and processes intended to prevent, detect and correct errors, malfunctions and other defects in its products and services. If errors, malfunctions, defects or disruptions in service are experienced by customers or in the company's operations there could be negative consequences that could impact customers' business operations and harm the company's business's operating results.

IBM, like other companies, is subject to potential climate-related risks and costs such as those resulting from increased severe weather events, prolonged changes in temperature, new regulations affecting hardware products and data centers, carbon taxes, and increased environmental disclosures requested or required by clients, regulators and others. The company is also subject to various federal, state, local and foreign laws and regulations concerning the discharge of materials into the environment or otherwise related to environmental protection, including the U.S. Superfund law. The company could incur substantial costs, including cleanup costs, fines and civil or criminal sanctions, as well as third-party claims for property damage or personal injury, if it were to violate or become liable under environmental laws and regulations. We do not expect climate change or compliance with environmental laws and regulations focused on climate change to have a disproportionate effect on the company or its financial position, results of operations and competitive position.

IBM has moved into areas, including those that incorporate or utilize hybrid cloud, AI (including generative AI), quantum and other disruptive technologies, in which it can differentiate itself through responsible innovation, by leveraging its investments in R&D and attracting a successful developer ecosystem. If IBM is unable to continue its cutting-edge innovation in a highly competitive and rapidly evolving environment or is unable to commercialize such innovations, expand and scale them with sufficient speed and versatility or is unable to attract a successful developer ecosystem, the company could fail in its ongoing efforts to maintain and increase its market share and its profit margins.

The company's patents and other intellectual property may not prevent competitors from independently developing products and services similar to or duplicative to the company's, nor can there be any assurance that the resources invested by the company to protect its intellectual property will be sufficient or that the company's intellectual property portfolio will adequately deter misappropriation or improper use of the company's technology. In addition, the company may be the target of aggressive and opportunistic enforcement of patents by third parties, including non-practicing entities. Also, there can be no assurances that IBM will be able to obtain from third parties the licenses it needs in the future. The company's ability to protect its intellectual property could also be impacted by a lack of effective legal protections as well as changes to existing laws, legal principles and regulations governing intellectual property, including the ownership and protection of patents. Certain of the company's offerings incorporate or utilize open source and other third-party software licensed with limited or no warranties, indemnification, or other contractual protections for IBM. Further, if open source code that IBM utilizes is no longer maintained, developed or enhanced by the relevant community of independent open source software programmers, most of whom we do not employ, we may be unable to develop new technologies, adequately enhance our existing technologies or meet customer requirements for innovation, quality and price.

There are numerous and evolving risks to cybersecurity and privacy, including risks originating from intentional acts of criminal hackers, hacktivists, nation states and competitors; from intentional and unintentional acts or omissions of customers, contractors, business partners, vendors, employees and other third parties; and from errors in processes or technologies, as well as the risks associated with an increase in the number of customers, contractors, business partners, vendors, employees and other third parties working remotely. Computer hackers and others routinely attack the security of technology products, services, systems and networks using a wide variety of methods, including ransomware or other malicious software and attempts to exploit vulnerabilities in hardware, software, and infrastructure. Attacks also include social engineering and cyber extortion to induce customers, contractors, business partners, vendors, employees and other third parties to disclose information, transfer funds, or unwittingly provide access to systems or data. The company is at risk of security breaches not only of our own products, services, systems and networks, but also those of customers, contractors, business partners, vendors, employees and other third parties, particularly as all parties increasingly digitize their operations. Cyber threats are continually evolving, including with the increased use of AI, making it difficult to defend against such threats and vulnerabilities that can persist undetected over extended periods of time. The company's products, services, systems and networks, including cloud-based systems and systems and technologies that the company maintains on behalf of its customers, are used in critical company, customer or third-party operations, and involve the storage, processing and transmission of sensitive data, including valuable intellectual property, other proprietary or confidential data, regulated data, and personal information of employees, customers and others. These products, services, systems and networks are also used by customers in heavily regulated industries, including those in the financial services, healthcare, critical infrastructure and government sectors. While the company continues to monitor for, identify, investigate, respond to and remediate a wide range of cybersecurity events, there have not been cybersecurity incidents or vulnerabilities that have had a material adverse effect on the company, though there is no assurance that there will not be cybersecurity incidents or vulnerabilities that will have a material adverse effect in the future. The company regularly addresses cybersecurity attacks and vulnerabilities. Cybersecurity attacks or other security incidents, including industry-wide incidents such as MOVEit, have or could result in, for example, one or more of the following: unauthorized access to, disclosure, modification, misuse, loss, or destruction of company, customer, or other third-party data or systems; theft or import or export of sensitive, regulated, or confidential data including personal information and intellectual property, including key innovations in AI, quantum, or other disruptive technologies; the loss of access to critical data or systems through ransomware, crypto mining, destructive attacks or other means; and business delays, service or system disruptions or denials of service. In the event of such actions, the company, its customers and other third parties could be exposed to liability, litigation, and regulatory or other government action, including debarment, as well as the loss of existing or potential customers, damage to brand and reputation, damage to our competitive position, and other financial loss. In addition, the cost and operational consequences of responding to cybersecurity incidents and implementing remediation measures could be significant. In the company's industry, security vulnerabilities are increasingly discovered, publicized and exploited across a broad range of hardware, software or other infrastructure, elevating the risk of attacks and the potential cost of response and remediation for the company and its customers. In addition, the fast-paced, evolving, pervasive, and sophisticated nature of certain cyber threats and vulnerabilities, as well as the scale and complexity of the business and infrastructure, make it possible that certain threats or vulnerabilities will be undetected or unmitigated in time to prevent or minimize the impact of an attack on the company or its customers. Cybersecurity risk to the company and its customers also depends on factors such as the actions, practices and investments of customers, contractors, business partners, vendors, the open source community and other third parties, including, for example, providing and implementing patches to address vulnerabilities. Cybersecurity attacks or other catastrophic events resulting in disruptions to or failures in power, information technology, communication systems or other critical infrastructure could result in interruptions or delays to company, customer, or other third-party operations or services, financial loss, injury or death to persons or property, potential liability, and damage to brand and reputation. Although the company continuously takes significant steps to mitigate cybersecurity risk across a range of functions, such measures can never eliminate the risk entirely or provide absolute security. As a global enterprise, the regulatory environment with regard to cybersecurity, privacy, AI and data protection issues is increasingly complex and will continue to impact the company's business, including through increased risk, increased costs, and expanded or otherwise altered compliance obligations, including with respect to the increased regulatory activity around the security of critical infrastructure, IoT devices, customer industries (e.g., financial services) and various customer and government supply chain security programs. As the reliance on data grows for the company and our clients, the potential impact of regulations on the company's business, risks, and reputation will grow accordingly. The enactment and expansion of cybersecurity, AI, data protection and privacy laws, regulations and standards around the globe will continue to result in increased compliance costs, including due to an increased focus on international data transfer mechanisms and data location; increased cybersecurity requirements and reporting obligations; the lack of harmonization of such laws and regulations; the increase in associated litigation and enforcement activity by governments and private parties; the potential for damages, fines and penalties and debarment; and the potential regulation of new and emerging technologies. Any additional costs and penalties associated with increased compliance, enforcement, and risk reduction could make certain offerings less profitable or increase the difficulty of bringing certain offerings to market or maintaining certain offerings.

IBM has one of the strongest brand names in the world, and its brand and overall reputation could be negatively impacted by many factors, including if the company does not continue to be recognized for its industry leading technology and solutions and as a hybrid cloud and AI leader. IBM's reputation is potentially susceptible to damage by events such as significant disputes with clients, product defects, internal control deficiencies, delivery failures, cybersecurity incidents, government investigations or legal proceedings or actions of current or former clients, directors, employees, competitors, vendors, alliance partners or joint venture partners. If the company's brand image is tarnished by negative perceptions, its ability to attract and retain customers, talent and ecosystem partners could be impacted.

If overall demand for IBM's products and solutions decreases, whether due to general economic conditions, or a shift in client buying patterns, the company's revenue and profit could be impacted.

The company is a globally integrated entity, operating in over 175 countries worldwide and deriving about sixty percent of its revenues from sales outside the United States. Changes in the laws or policies of the countries in which the company operates, or inadequate development or enforcement of such laws or policies, could affect the company's business and the company's overall results of operations. Further, the company may be impacted directly or indirectly by the development and enforcement of laws and regulations in the U.S. and globally that are specifically targeted at the technology industry. The company's results of operations also could be affected by economic and political changes in those countries and by macroeconomic changes, including recessions, inflation, currency fluctuations between the U.S. dollar and non-U.S. currencies and adverse changes in trade relationships amongst those countries. Further, as the company expands its customer base and the scope of its offerings, both within the U.S. and globally, it may be impacted by additional regulatory or other risks, including, compliance with U.S. and foreign data privacy requirements, AI regulations, data localization requirements, labor relations laws, enforcement of IP protection laws, laws relating to anti-corruption, anti-competition regulations, and import, export and trade restrictions. Further, international trade disputes could create uncertainty. Tariffs and international trade sanctions resulting from these disputes could affect the company's ability to move goods and services across borders, or could impose added costs to those activities. Measures taken to date by the company to mitigate these impacts could be made less effective should trade sanctions or tariffs change. In addition, any widespread outbreak of an illness, pandemic or other local or global health issue, natural disasters, climate change impacts, or uncertain political climates, international hostilities, or any terrorist activities, could adversely affect customer demand, the company's operations and supply chain, and its ability to source and deliver products and services to its customers.

As a company with a substantial employee population and with clients in more than 175 countries, IBM is or may become involved as a party and/or may be subject to a variety of claims, demands, suits, investigations, tax matters and other proceedings that arise from time to time in the ordinary course of its business. The risks associated with such legal proceedings are described in more detail in note R, "Commitments & Contingencies," in IBM's 2023 Annual Report to Stockholders. The company believes it has adopted appropriate risk management and compliance programs. Legal and compliance risks, however, will continue to exist and additional legal proceedings and other contingencies, the outcome of which cannot be predicted with certainty, may arise from time to time.

The company's customers include numerous governmental entities within and outside the U.S., including the U.S. Federal Government and state and local entities. Some of the company's agreements with these customers may be subject to periodic funding approval. Funding reductions or delays could adversely impact public sector demand for our products and services. Also, some agreements may contain provisions allowing the customer to terminate without cause and providing for higher liability limits for certain losses. In addition, the company could be suspended or debarred as a governmental contractor and could incur civil and criminal fines and penalties, which could negatively impact the company's results of operations, financial results and reputation.