Open Text (OTEX) Risk Factors

The development of information management software products is a costly, complex and time-consuming process, and the investment in information management software product development often involves a long wait until a return is achieved on such an investment. We are making, and will continue to make, significant investments in software research and development and related product and service opportunities. Investments in new technology and processes are inherently speculative. Commercial success depends on many factors, including the degree of innovation of the software products and services developed through our research and development efforts, sufficient support from our strategic partners and effective distribution and marketing. Accelerated software product introductions and short product life cycles require high levels of expenditures for research and development and the potential introduction of government regulation, including that related to the use of AI, may increase the costs of research and development as well as compliance with such regulation. These expenditures may adversely affect our operating results if they are not offset by corresponding revenue increases. We believe that we must continue to dedicate a significant amount of resources to our research and development efforts in order to maintain our competitive position. However, significant revenues from new software product and service investments may not be achieved for a number of years, if at all. Moreover, new software products and services may not be profitable, and even if they are profitable, operating margins for new software products and services may not be as high as the margins we have experienced for our current or historical software products and services.

We currently depend upon a limited number of third-party software products. If such software products were not available, we might experience delays or increased costs in the development of our own software products. For a limited number of our product modules, we rely on software products that we license from third parties, including software that is integrated with internally developed software and which is used in our products to perform key functions. These third-party software licenses may not continue to be available to us on commercially reasonable terms and the related software may not continue to be appropriately supported, maintained or enhanced by the licensors. The loss by us of the license to use, or the inability by licensors to support, maintain or enhance any such software, could result in increased costs, lost revenues or delays until equivalent software is internally developed or licensed from another third party and integrated with our software. Such increased costs, lost revenues or delays could adversely affect our business. For example, with our acquisition of Zix, we extended our partnership with Microsoft by becoming one of their authorized Cloud Solutions Providers in North America. If our key partners were to terminate our relationship, make an adverse change in their reseller program, change their product offerings or experience a major cyber-attack or similar event, it could reduce our revenues and adversely affect our business.

The use of the Internet as a vehicle for electronic data interchange (EDI) and related services continues to raise numerous issues, including those relating to reliability, data security, data integrity and rapidly evolving standards. New competitors, including media, software vendors and telecommunications companies, offer products and services that utilize the Internet in competition with our products and services, which may be less expensive or process transactions and data faster and more efficiently. Internet-based commerce is subject to increasing regulation by Canadian, U.S. federal and state and foreign governments, including in the areas of data privacy and breaches and taxation. Laws and regulations relating to the solicitation, collection, processing or use of personal or consumer information could affect our customers' ability to use and share data, potentially reducing demand for Internet-based solutions and restricting our ability to store, process, analyze and share data through the Internet. Although we believe that the Internet will continue to provide opportunities to expand the use of our products and services, we cannot guarantee that our efforts to capitalize on these opportunities will be successful or that increased usage of the Internet for business integration products and services, increased competition or heightened regulation will not adversely affect our business, results of operations and financial condition.

We intend to pursue our strategy of being a market leading consolidator for cloud-based information management solutions. We intend to grow the capabilities of our information management software offerings through our proprietary research and the development of new software product and service offerings, as well as through acquisitions. It is important to our success that we continue to enhance our software products and services in response to customer demand and to seek to set the standard for information management capabilities. The primary market for our software products and services is rapidly evolving, and the level of acceptance of products and services that have been released recently, or that are planned for future release to the marketplace, is not certain. If the markets for our software products and services fail to develop, develop more slowly than expected or become subject to increased competition, our business may suffer. As a result, we may be unable to: (i) successfully market our current products and services; (ii) develop new software products and services and enhancements to current software products and services; (iii) complete customer implementations on a timely basis; or (iv) complete software products and services currently under development. In addition, increased competition and transitioning from perpetual license sales to subscription-based business model could put significant pricing pressures on our products, which could negatively impact our margins and profitability. If our software products and services are not accepted by our customers or by other businesses in the marketplace, our business, operating results and financial condition will be materially adversely affected.

With the acquisitions of Carbonite and Zix, we have expanded our presence in the SMB market as well as the consumer market. Expanding in this market may require substantial resources and increased marketing efforts, different to what we are accustomed to historically. If we are unable to market and sell our solutions to the SMB market and consumers with competitive pricing and in a cost-effective manner, it may harm our ability to grow our revenues and adversely affect our anticipated future growth and operating results. In addition, SMBs frequently have limited budgets and are more likely to be significantly affected by economic downturns than larger, more established companies. As such, SMBs may choose to spend funds on items other than our solutions, particularly during difficult economic times, which may hurt our projected revenues, business financial condition and results of operations.

Geopolitical instability, political unrest, war and other global conflicts may result in adverse effects on macroeconomic conditions, including volatility in financial markets, adverse changes in trade policies, inflation, higher interest rates, direct and indirect supply chain disruptions, increased cybersecurity threats and fluctuations in foreign currency. These events may also impact our decision or limit our ability to conduct business in certain areas or with certain entities. For example, sanctions and export controls have been imposed by the United States, Canada and other countries in connection with Russia's military actions in Ukraine, including restrictions on selling or exporting goods, services or technology to certain regions, and travel bans and asset freezes impacting political, military, business and financial organizations and individuals in or connected with Russia. To support certain of our cloud customers headquartered in the United States or allied countries that rely on our network to manage their global business (including their business in Russia), we have nonetheless allowed these customers to continue to use our services to the extent that it can be done in strict compliance with all applicable sanctions and export controls. However, as the situation continues and the regulatory environment further evolves, we may adjust our business practices as required by applicable rules and regulations. Our compliance with sanctions and export controls could impact the fulfillment of certain contracts with customers and partners doing business in these affected areas and future revenue streams from impacted parties and certain countries. While the Russia-Ukraine and Israel-Hamas conflicts have not had and are not expected to have a material adverse effect on our overall business, results of operations or financial condition, it is not possible to predict the broader consequences of this conflict or other conflicts, which could include sanctions, embargoes, regional instability, changes to regional trade ecosystems, geopolitical shifts and adverse effects on the global economy, on our business and operations as well as those of our customers, partners and third party service providers.

We incur operating expenses based upon anticipated revenue trends. Since a high percentage of these expenses are relatively fixed, a delay in recognizing revenues from transactions related to these expenses (such a delay may be due to the factors described herein or it may be due to other factors) could cause significant variations in operating results from quarter to quarter and could materially reduce operating income. If these expenses are not subsequently matched by revenues, our business, financial condition, or results of operations could be materially and adversely affected.

Significant judgment is required in determining our provision for income taxes. Various internal and external factors may have favorable or unfavorable effects on our future provision for income taxes, income taxes receivable and our effective income tax rate. These factors include, but are not limited to, changes in tax laws, regulations and/or rates, results of audits by tax authorities, changing interpretations of existing tax laws or regulations, changes in estimates of prior years' items, the impact of transactions we complete, future levels of research and development spending, changes in the valuation of our deferred tax assets and liabilities, transfer pricing adjustments, changes in the overall mix of income among the different jurisdictions in which we operate and changes in overall levels of income before taxes. For instance, the provision for income taxes from the Tax Cuts and Jobs Act of 2017, which required capitalization and amortization of research and development costs starting in Fiscal 2023, has increased cash taxes. Furthermore, new accounting pronouncements or new interpretations of existing accounting pronouncements, and/or any internal restructuring initiatives we may implement from time to time to streamline our operations, can have a material impact on our effective income tax rate. Tax examinations are often complex as tax authorities may disagree with the treatment of items reported by us and our transfer pricing methodology based upon our limited risk distributor model, the result of which could have a material adverse effect on our financial condition and results of operations. Although we believe our estimates are reasonable, the ultimate outcome with respect to the taxes we owe may differ from the amounts recorded in our financial statements, and this difference may materially affect our financial position and financial results in the period or periods for which such determination is made. The United Kingdom (UK) tax authorities have challenged certain historic tax filing positions of Micro Focus. Based on Micro Focus' assessment of the value of the underlying tax benefit under dispute, and as supported by external professional advice, it believed that it had no liability in respect of these matters and therefore no tax charge was recorded in current or previous periods. Although the Company, after closing of the Micro Focus Acquisition, believes that assessment is reasonable, no assurance can be made regarding the ultimate outcome of these matters. The Company is also subject to income taxes in numerous jurisdictions and significant judgment has been applied in determining its worldwide provision for income taxes, including historical Micro Focus matters related to the EU State Aid and UK tax authority challenge in respect of prior periods. The provision for income taxes may be impacted by various internal and external factors that could have favorable or unfavorable effects, including changes in estimates of prior years' items, the impact of transactions completed, the structuring of activities undertaken, the application of complex transfer pricing rules, changes in the valuation of deferred tax assets and liabilities, changes in overall mix and levels of income before taxes, changes in tax laws, regulations and/or rates and changing interpretations of existing tax laws or regulations. Numerous countries have agreed to a statement in support of the Organization for Economic Co-Operation and Development model rules that propose a global minimum tax rate of 15% for companies with revenue above €750 million, calculated on a country-by-country basis, and E.U. member states have agreed to implement the global minimum tax. Certain countries have enacted or are expected to enact legislation, with widespread implementation of a global minimum tax expected by 2025. We are unable to predict when and how such rules in various jurisdictions will be enacted into law; however, it is possible that the implementation of relevant legislation could impact our liability for taxes. Further, due to Micro Focus' complex acquisitive history, we could become subject to additional tax audits in jurisdictions in which we have not historically been subject to examination. As a result, our worldwide provision for income taxes and any ultimate tax liability may differ from the amounts initially recorded and such differences could have an adverse effect on the combined company's financial condition and results of operations. For further details on certain tax matters relating to the Company see Note 14 "Guarantees and Contingencies" and Note 15 "Income Taxes" to the Consolidated Financial Statements included in this Annual Report on Form 10-K.

Our business depends on the processing of personal data, including data transfer between our affiliated entities, to and from our business partners and customers, and with third-party service providers. The laws and regulations relating to personal data are constantly evolving, as federal, state and foreign governments continue to adopt new measures addressing data privacy and processing (including collection, storage, transfer, disposal and use) of personal data. Moreover, the interpretation and application of many existing or recently enacted privacy and data protection laws and regulations in the EU, UK, the U.S. and elsewhere are uncertain and fluid, and it is possible that such laws and regulations may be interpreted or applied in a manner that is inconsistent with our existing data management practices or the features of our products and services. Any such new laws or regulations, any changes to existing laws and regulations and any such interpretation or application may affect demand for our products and services, impact our ability to effectively transfer data across borders in support of our business operations or increase the cost of providing our products and services. Additionally, any actual or perceived breach of such laws or regulations may subject us to claims and may lead to administrative, civil or criminal liability, as well as reputational harm to our Company and our employees. We could also be required to fundamentally change our business activities and practices, or modify our products and services, which could have an adverse effect on our business. In the U.S., various laws and regulations apply to the collection, processing, transfer, disposal, unauthorized disclosure and security of personal data. For example, data protection laws passed by all states within the U.S. require notification to users when there is a security breach for personal data. Additionally, the Federal Trade Commission (FTC) and many state attorneys general are interpreting federal and state consumer protection laws as imposing standards for the online collection, use, transfer and security of data. The U.S. Congress and state legislatures, along with federal regulatory authorities, have recently increased their attention to matters concerning personal data, and this has and may continue to result in new legislation which could increase the cost of compliance. For example, the California Consumer Privacy Act of 2018 came into effect on January 1, 2020 and was subsequently amended by the California Privacy Rights Act, which took effect January 1, 2023 (the foregoing, collectively, the CCPA). The CCPA requires companies that process information of California residents to make new disclosures to consumers about their data collection, use and sharing practices, allows consumers to access and request deletion of their data and opt out of certain data sharing with third parties and provides a new private right of action for data breaches. Violations of the CCPA are enforced by the California Attorney General with sizeable civil penalties, particularly for violations that impact large numbers of consumers. The CCPA also establishes a regulatory agency dedicated to enforcing the requirements of the CCPA. Comprehensive privacy laws in Colorado, Connecticut, Utah and Virginia also came into effect in 2023 and comprehensive privacy laws in Oregon and Texas came into effect July 1, 2024. Montana's comprehensive privacy law comes into effect later this year. Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Nebraska, New Hampshire, New Jersey, Rhode Island, and Tennessee have similarly enacted broad laws relating to privacy, data protection and information security that will come into effect in the next few years, further complicating our privacy compliance obligations through the introduction of increasingly disparate requirements across the various U.S. jurisdictions in which we operate. In addition to government regulation, privacy advocacy and industry groups may propose new and different self-regulatory standards that either legally or contractually apply to us or our clients. Some of our operations are subject to the EU's General Data Protection Regulation (the EU GDPR), which took effect from May 25, 2018, the General Data Protection Regulation as it forms part of retained EU law in the UK by virtue of the European Union (Withdrawal) Act 2018 and as amended by the Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019 (SI 2019/419) (the UK GDPR, and together with the EU GDPR, the GDPR), and the UK Data Protection Act 2018. The GDPR imposes a number of obligations for subject companies, and we will need to continue dedicating financial resources and management time to GDPR compliance. The GDPR enhances the obligations placed on companies that control or process personal data including, for example, expanded disclosures about how personal data is to be used, mechanisms for obtaining consent from data subjects, controls for data subjects with respect to their personal data (including by enabling them to exercise rights to erasure and data portability), limitations on retention of personal data and mandatory data breach notifications. Additionally, the GDPR places companies under obligations relating to data transfers and the security of the personal data they process. The GDPR provides that supervisory authorities in the EU and the UK may impose administrative fines for certain infringements of the GDPR of up to EUR 20,000,000 under the EU GDPR (or GBP 17,500,000 under the UK GDPR), or 4% of an undertaking's total, worldwide, annual turnover of the preceding financial year, whichever is higher. Individuals who have suffered damage as a result of a subject company's non-compliance with the GDPR also have the right to seek compensation from such company. Given the breadth of the GDPR, compliance with its requirements is likely to continue to require significant expenditure of resources on an ongoing basis, and there can be no assurance that the measures we have taken for the purposes of compliance will be successful in preventing violation of the GDPR. Given the potential fines, liabilities and damage to our reputation in the event of an actual or perceived violation of the GDPR, such a violation may have a material adverse effect on our business and operations. In addition, the GDPR restricts transfers of personal data outside of the European Economic Area (EEA) and the UK to third countries deemed to lack adequate privacy protections unless an appropriate safeguard is implemented. In light of the July 2020 decision of the Court of Justice of the European Union in Data Protection Commissioner vs Facebook Ireland Limited and Maximillian Schrems (C-311/118) (Schrems II) invalidating the EU-U.S. Privacy Shield Framework and the Irish Data Protection Authority's May 2023 decision to impose a fine of €1.2 billion on Meta Platforms, Inc. (Meta) regarding Meta's transfers of personal data to the U.S., there is potential uncertainty with respect to the legality of certain transfers of personal data from the European Economic Area (EEA) and the UK to so-called "third countries" outside the EEA, including the U.S. and Canada. In addition to the increased legal risk in the event of any such transfers, additional costs might also need to be incurred in order to implement necessary safeguards to comply with GDPR. While the Court of Justice of the EU upheld the adequacy of the old standard contractual clauses (SCCs), a standard form of contract approved by the European Commission as an adequate personal data transfer mechanism, it made clear that reliance on them alone may not necessarily be sufficient in all circumstances. In June 2021, the European Commission issued new SCCs that must be now used for relevant new data transfers. The UK's Information Commissioner's Office also released two new agreements governing international data transfers out of the UK: the International Data Transfer Agreement (IDTA) and the Data Transfer Addendum (Addendum). All contracts signed after September 21, 2022 must use either the IDTA or the Addendum in conjunction with the new SCCs. Additionally, on March 25, 2022, the U.S. and European Commission announced that they had agreed in principle to a new "Trans-Atlantic Data Privacy Framework" (the TDPF to enable trans-Atlantic data flows and address the concerns raised in the Schrems II decision. To implement the commitments of the U.S. under the TDPF, in October 2022, President Biden signed an Executive Order on Enhancing Safeguards for the United States Signals Intelligence Activities (the Executive Order). This subsequently prompted the European Commission to adopt an adequacy decision based on the Executive Order on July 10, 2023, having determined that the TDPF ensures that the protection of personal information transferred from the EU to the certified organizations within the U.S. will be essentially equivalent to the protection offered in the EU. However, there remains a degree of legal uncertainty, as critics and privacy advocacy groups have already commenced challenges to the validity of such decision before the Court of Justice of the EU. Outside of the U.S., the EU and the UK, many jurisdictions have adopted or are adopting new data privacy laws that may impose further onerous compliance requirements, such as data localization, which prohibits companies from storing and/or processing outside the jurisdiction data relating to resident individuals. The proliferation of such laws within the jurisdictions in which we operate may result in conflicting and contradictory requirements, particularly in relation to evolving technologies such as cloud computing and AI. Any failure to successfully navigate the changing regulatory landscape could result in legal liability or impairment to our reputation in the marketplace, which could have a material adverse effect on our business, results of operations and financial condition. Privacy-related claims or lawsuits initiated by governmental bodies, customers or other third parties, whether meritorious or not, could be time consuming, result in costly regulatory proceedings, litigation, penalties, fines, or other potential liabilities,or require us to change our business practices, sometimes in expensive ways. Unfavorable publicity regarding our privacy practices could damage our reputation, harm our ability to keep existing customers or attract new customers or otherwise adversely affect our business, assets, revenue and brands.

Our success as a combined business with any prior or future acquired businesses will depend, in part, upon our ability to retain key employees, especially during the integration phase of the businesses. It is possible that the integration process could result in current and prospective employees of ours and the acquired business to experience uncertainty about their future roles with us, which could have an adverse effect on our ability to retain or recruit key managers and other employees. If, despite our retention and recruiting efforts, key employees depart, the loss of their services and their experience and knowledge regarding our business or an acquired business could have an adverse effect on our future operating results and the successful ongoing operation of our businesses.