Rigetti Computing (RGTI) Risk Factors

In the ordinary course of our business, we and the third parties upon which we rely, collect, receive, store, process, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, and share (collectively, process), proprietary, confidential, and sensitive data, including personal data, intellectual property, controlled unclassified information and trade secrets (collectively, sensitive information). Cyber-attacks, malicious internet-based activity, online and offline fraud, denial-of-service attacks, ransomware attacks, business email compromises, computer malware, viruses, and social engineering (including through deep fakes, which may be increasingly more difficult to identify as fake, and phishing attacks) and other similar activities threaten the confidentiality, integrity, and availability of our sensitive information and information technology systems, and those of the third parties upon which we rely. Such threats are prevalent in the technology industry and our customers' industries and continue to rise, are increasingly difficult to detect, and come from a variety of sources, including traditional computer "hackers," threat actors, "hacktivists," organized criminal threat actors, personnel (such as through theft or misuse), sophisticated nation states, and nation-state-supported actors. The techniques may be used to sabotage or to obtain unauthorized access to our platform, systems, networks, or physical facilities where our quantum computers are stored, and we may be unable to implement adequate preventative measures or stop security breaches while they are occurring. U.S. law enforcement agencies have indicated to us that quantum computing technology is of particular interest to certain malicious cyber threat actors. In addition, our cybersecurity risk could be increased as a result of the ongoing military conflict between Russia and Ukraine and the related sanctions imposed against Russia. Some actors now engage and are expected to continue to engage in cyber-attacks, including without limitation nation-state actors for geopolitical reasons and in conjunction with military conflicts and defense activities. During times of war and other major conflicts, we, the third parties upon which we rely, may be vulnerable to a heightened risk of these attacks, including retaliatory cyber-attacks, that could materially disrupt our systems and operations, supply chain, and ability to produce, sell and distribute our goods and services. We and the third parties upon which we rely are subject to a variety of evolving threats, including but not limited to social-engineering attacks (including through deep fakes, which may be increasingly more difficult to identify as fake, and phishing attacks), malicious code (such as viruses and worms), malware (including as a result of advanced persistent threat intrusions), denial-of-service attacks (such as credential stuffing), credential harvesting, personnel misconduct or error, ransomware attacks, supply-chain attacks, software bugs, server malfunctions, software or hardware failures, loss of data or other information technology assets, adware, telecommunications failures, earthquakes, fires, floods, and other similar threats. In particular, severe ransomware attacks are becoming increasingly prevalent and can lead to significant interruptions in our operations, loss of sensitive data and income, reputational harm, and diversion of funds. Extortion payments may alleviate the negative impact of a ransomware attack, but we may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting such payments. Remote work has become more common and has increased risks to our information technology systems and data, as more of our employees utilize network connections, computers and devices outside our premises or network, including working at home, while in transit and in public locations. In addition, future or past business transactions (such as acquisitions or integrations) could expose us to additional cybersecurity risks and vulnerabilities, as our systems could be negatively affected by vulnerabilities present in acquired or integrated entities' systems and technologies. Furthermore, we may discover security issues that were not found during due diligence of such acquired or integrated entities, and it may be difficult to integrate companies into our information technology environment and security program. We rely on third-party service providers and technologies to operate critical business systems to process sensitive information in a variety of contexts. Our platform is built to be accessed through third-party public cloud providers such as AWS. These providers may also experience breaches and attacks to their products which may impact our systems. Data security breaches may also result from non-technical means, such as actions by an employee with access to our systems. Our ability to monitor these third parties' information security practices is limited, and these third parties may not have adequate information security measures in place. If our third-party service providers experience a security incident or other interruption, we could experience adverse consequences. While we may be entitled to damages if our third-party service providers fail to satisfy their privacy or security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such award. We may expend significant resources or modify our business activities to try to protect against security incidents. Certain data privacy and security obligations may require us to implement and maintain specific security measures or industry-standard or reasonable security measures to protect our information technology systems and sensitive information. While we and our third-party cloud providers have implemented security measures designed to protect against security breaches, can be of no assurance that these measures will be effective and these measures could fail or may be insufficient, resulting in the unauthorized disclosure, modification, misuse, destruction, or loss of sensitive or confidential information. We take steps designed to detect, mitigate, and remediate vulnerabilities, in our information systems (such as our hardware and/or software, including that of third parties upon which we rely),  but we may not be able to detect and remediate all vulnerabilities on a timely basis because the threats and techniques used to exploit the vulnerability change frequently and are often sophisticated in nature. Therefore, such vulnerabilities could be exploited but may not be detected until after a security incident has occurred. Any unremediated vulnerabilities pose material risks to our business. Further, we may experience delays in developing and deploying remedial measures designed to address any such identified vulnerabilities. Any of the previously identified or similar threats could cause a security incident or other interruption that could result in unauthorized, unlawful, or accidental acquisition, modification, destruction, loss, alteration, encryption, disclosure of, or access to our sensitive information or our information technology systems, or those of the third parties upon whom we rely. A security incident or other interruption could disrupt our ability (and that of third parties upon whom we rely) to provide our platform, products , and services. Certain data privacy and security obligations may require us to implement and maintain specific security measures or industry-standard or reasonable security measures to protect our information technology systems and sensitive information. In addition, applicable data privacy and security obligations may require us to notify relevant stakeholders, including affected individuals, customers, regulators, and investors of security incidents. Such disclosures are costly, and the disclosure or the failure to comply with such requirements could lead to adverse consequences. Actual or perceived breaches of our security measures or the accidental loss, inadvertent disclosure or unapproved dissemination of proprietary information or sensitive or confidential data about the Company, our partners, our customers or third parties could expose us and the parties affected to a risk of loss or misuse of this information, resulting in litigation and potential liability, paying damages, regulatory inquiries or actions, damage to our brand and reputation or other harm to our business. Our efforts to prevent and overcome these challenges could increase our expenses and may not be successful. If we fail to detect or remediate a security breach in a timely manner, or a breach otherwise affects our customers, or if we suffer a cyber-attack that impacts our ability to operate our platform, we may experience adverse consequences, such as government enforcement actions (for example, investigations, fines, penalties, audits, and inspections); additional reporting requirements and/or oversight; restrictions on processing sensitive information (including personal data); litigation (including class claims); indemnification obligations; negative publicity; material damage to our reputation; monetary fund diversions; diversions of management attention; interruptions in our operations (including availability of data); financial loss; and other similar harms. Security incidents and attendant consequences may cause customers to stop using our services, deter new customers from using our services, and negatively impact our ability to grow and operate our business. Our contracts may not contain limitations of liability, and even where they do, there can be no assurance that limitations of liability in our contracts are sufficient to protect us from liabilities, damages, or claims related to our data privacy and security obligations. We cannot be sure that our insurance coverage will be adequate or sufficient to protect us from or to mitigate liabilities arising out of our privacy and security practices, that such coverage will continue to be available on commercially reasonable terms or at all, or that such coverage will pay future claims. In addition to experiencing a security incident, third parties may gather, collect, or infer sensitive information about us from public sources, data brokers, or other means that reveals competitively sensitive details about our organization and could be used to undermine our competitive advantage or market position.

There are limited suppliers to sources of materials which may be necessary for the production of our technology. We are currently reliant on a single or small number of suppliers for certain resources. While we are currently looking to engage additional suppliers, there is no guarantee we will be able to establish or maintain relationships with such additional suppliers on terms satisfactory to us. Reliance on any single supplier increases the risks associated with being unable to obtain the necessary components because the supplier may have manufacturing constraints, can be subject to unanticipated shutdowns and/or may be affected by natural disasters and other catastrophic events. Some of these factors may be completely out of our and our suppliers' control. Failure to acquire sufficient quantities of the necessary components in a timely or cost-effective manner could materially harm our business.

We currently maintain offices and have sales personnel in the United States, the United Kingdom, Australia and Canada. In the years ended December 31, 2023 and December 31, 2022, our non-U.S. revenue was approximately 7.6% and 15.0% of our total revenue, respectively. Depending on customer opportunities and our ability to access quantum engineering talent, we may continue to expand our international operations, which may include opening offices in new jurisdictions. Any additional international expansion efforts that we are undertaking and may undertake may not be successful. In addition, conducting international operations subjects us to new risks, some of which we have not generally faced in the United States or other countries where we currently operate. These risks include, among other things: - unexpected costs and errors in the localization of our platform and solutions, including translation into foreign languages and adaptation for local culture, practices and regulatory requirements;- lack of familiarity and burdens of complying with foreign laws, legal standards, privacy and cybersecurity standards, regulatory requirements, foreign export control rules, tariffs and other barriers, and the risk of penalties to our customers and individual members of management or employees if our practices are deemed to not be in compliance;- practical difficulties of enforcing intellectual property rights in countries with varying laws and standards and reduced or varied protection for intellectual property rights in some countries;- an evolving legal framework and additional legal or regulatory requirements for data privacy and cybersecurity, which may necessitate the establishment of systems to maintain data in local markets, requiring us to invest in additional data centers and network infrastructure, and the implementation of additional employee data privacy documentation (including locally-compliant data privacy notice and policies), all of which may involve substantial expense and may cause us to need to divert resources from other aspects of our business, all of which may adversely affect our business;- unexpected changes in regulatory requirements, taxes, trade laws, tariffs, export quotas, custom duties or other trade restrictions;- difficulties in managing systems integrators and technology partners;- differing technology standards;- different pricing environments, longer sales cycles, longer accounts receivable payment cycles and difficulties in collecting accounts receivable;- increased financial accounting and reporting burdens and complexities;- difficulties in managing and staffing international operations including the proper classification of independent contractors and other contingent workers, differing employer/employee relationships and local employment laws;- increased costs involved with recruiting and retaining an expanded employee population outside the United States through cash and equity-based incentive programs and unexpected legal costs and regulatory restrictions in issuing our shares to employees outside the United States;- global political and regulatory changes that may lead to restrictions on immigration and travel for our employees;- fluctuations in exchange rates that may decrease the value of foreign-based revenue;- potentially adverse tax consequences, including the complexities of foreign value added tax (or other tax) systems, restrictions on the repatriation of earnings, and transfer pricing requirements; and - permanent establishment risks and complexities in connection with international payroll, tax and social security requirements for international employees. Additionally, operating in international markets also requires significant management attention and financial resources. We cannot be certain that the investment and additional resources required in establishing operations in other countries will produce desired levels of revenue or profitability. Compliance with laws and regulations applicable to our global operations also substantially increases the cost of doing business in foreign jurisdictions. We have limited experience in marketing, selling and supporting our platform outside of the United States. Our limited experience in operating our business internationally increases the risk that any potential future expansion efforts that we may undertake will not be successful. If we invest substantial time and resources to expand our international operations and are unable to do so successfully and in a timely manner, our business, financial condition, revenues, results of operations or cash flows will suffer. We may be unable to keep current with changes in government requirements as they change from time to time. Failure to comply with these regulations could harm our business. In many countries, it is common for others to engage in business practices that are prohibited by our internal policies and procedures or other regulations applicable to us. Although we have implemented policies and procedures designed to ensure compliance with these laws and policies, there can be no assurance that all of our employees, contractors, partners and agents will comply with these laws and policies. Violations of laws or key control policies by our employees, contractors, partners or agents could result in delays in revenue recognition, financial reporting misstatements, enforcement actions, reputational harm, disgorgement of profits, fines, civil and criminal penalties, damages, injunctions, other collateral consequences or the prohibition of the importation or exportation of our solutions and could harm our business, financial condition, revenues, results of operations or cash flows.

Our facilities or operations could be adversely affected by power outages as well as events outside of our control, such as natural disasters and other calamities. We cannot assure you that any backup systems will be adequate to protect us from the effects of fire, floods, typhoons, earthquakes, power loss resulting from such natural disasters, telecommunications failures, break-ins, war, riots, terrorist attacks or similar events. Any of the foregoing events may give rise to interruptions, breakdowns, system failures, technology platform failures or internet failures, which could cause delays in development and fabrication, the loss or corruption of data or malfunctions of software or hardware as well as adversely affect our ability to provide services. A significant power outage may disrupt our operations and could have a material adverse impact on our business, financial condition, results of operations and cash flows.