Qualtrics International (XM) Risk Analysis

As a public company, we will continue to incur greater legal, accounting, and other expenses than we incurred as a private company. We are subject to the reporting requirements of the Exchange Act, the Sarbanes-Oxley Act, the Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010, or the Dodd-Frank Act, and the rules and regulations of Nasdaq. These requirements have increased and will continue to increase our legal, accounting, and financial compliance costs and have made, and will continue to make, some activities more time-consuming and costly. For example, we expect these rules and regulations to make it more expensive for us to obtain director and officer liability insurance, and we may be required to accept reduced policy limits and coverage or incur substantially higher costs to maintain the same or similar coverage. As a result, it may be more difficult for us to attract and retain qualified individuals to serve on our board of directors or as our executive officers. We will continue to incur significant expenses and devote substantial management effort toward ensuring compliance with the auditor attestation requirements of Section 404 of the Sarbanes-Oxley Act. In that regard, we will need to continue to hire additional accounting and financial staff with appropriate public company experience and technical accounting knowledge.

Third parties may seek to hold us responsible for SAP's liabilities. Likewise, our relationship with SAP, as a much larger company and our majority shareholder, may make us more of a target for litigation than we otherwise would be on our own. Under our master transaction agreement with SAP, we agreed to indemnify SAP for claims and losses relating to liabilities related to our business and not related to SAP's business, and SAP will indemnify us for claims and losses relating to liabilities related to SAP's business and not related to our business. However, if those liabilities are significant and we are ultimately held liable for them, we cannot assure you that we will be able to recover the full amount of our losses from SAP.

We collect sales and similar value-added taxes as part of our customer agreements in a number of jurisdictions in which we have determined that we are subject to tax. Sales and use, value-added, and similar tax laws and rates vary greatly by jurisdiction. One or more states or countries may seek to impose additional sales, use, or other tax collection obligations on us, including for past sales by us. Furthermore, in June 2018, the Supreme Court held in South Dakota v. Wayfair, Inc. that states could impose sales tax collection obligations on out-of-state retailers even if those retailers lack any physical presence within the states imposing the sales taxes. Under Wayfair, a person requires only a "substantial nexus" with the taxing state before the state may subject the person to sales tax collection obligations therein. An increasing number of states (both before and after the publication of Wayfair) have considered or adopted laws that attempt to impose sales tax collection obligations on out-of-state retailers. The Supreme Court's Wayfair decision has removed a significant impediment to the enactment and enforcement of these laws, and it is possible that states may seek to tax out-of-state retailers on sales that occurred in prior tax years. A successful assertion by a state, country, or other jurisdiction that we should have been or should be collecting additional sales, use, or other taxes on our XM Platform could, among other things, result in substantial tax liabilities for past sales, create significant administrative burdens for us, discourage customers from purchasing our XM Platform, or otherwise harm our business, results of operations, and financial condition.

As a global software and service provider, we are required to comply with local laws of various countries and jurisdictions. The regulatory frameworks governing the collection, processing, storage, and use of business information, particularly information that includes personal data, are rapidly and continuously evolving across multiple jurisdictions, which may introduce conflicts between compliance obligations or other uncertainties. Any failure or perceived failure to comply with applicable privacy, security, or data protection laws, regulations and/or contractual obligations may adversely affect our business. Such evolving regulations and new laws globally regarding data protection and privacy or other standards are increasingly aimed at the use of personal information, such as for marketing purposes and the tracking of individuals' online activities. We may have additional burdens imposed on us due to increasing compliance standards that could restrict the use and adoption of our products and services and make it more challenging and complex to meet customer expectations. Many foreign countries and governmental bodies, including the European Economic Area, or EEA, where we conduct business, have laws and regulations concerning the collection and use of personal data. These laws and regulations are often more wide-ranging and more restrictive than those in the United States. Laws and regulations in these jurisdictions apply broadly to the collection, use, storage, disclosure, and security of data that identifies or may be used to identify or locate an individual, such as names, email addresses and Internet Protocol addresses. For instance, the General Data Protection Regulation, or GDPR, regulates the collection and use of personal data of data subjects in the EEA. Further, following Brexit, we must also ensure we comply with the GDPR as it is transposed into the laws of the United Kingdom by virtue of United Kingdom's European Union (Withdrawal) Act 2018 (the UK GDPR). Unless otherwise specified, references to the GDPR shall also include the UK GDPR. The GDPR applies extraterritorially and imposes several stringent requirements for controllers and processors of personal data, including, for example, higher standards for obtaining consent from individuals to process their personal data, more robust disclosures to individuals and a strengthened individual data rights regime, shortened timelines for data breach notifications, limitations on retention of information, increased requirements pertaining to special categories of personal data and pseudonymized (i.e., key-coded) data and additional obligations when we contract third-party processors in connection with the processing of the personal data. The GDPR provides that EU member states may make their own further laws and regulations limiting the (i) processing of personal data, including special categories of special data (e.g., racial or ethnic origin, political opinions, religious or philosophical beliefs); and (ii) profiling and automated individual decision-making of individual; which could limit our ability to use and share personal data or other data and could cause our costs to increase, and harm our business and financial condition. Noncompliance with the GDPR can trigger steep fines of up to €20 million (i.e., £17.5 million under the UK GDPR) or 4% of global annual revenue, whichever is higher. In addition to such fines, we could be subject to litigation and/or adverse publicity, which could have a material adverse effect on our reputation and business. Note, separate European laws and regulations (and EEA member states' implementations thereof) govern the protection of consumers and of electronic communications. Further, European data protection laws also prohibit the transfer of personal data from the UK, EEA, and Switzerland to other countries, including the United States, unless adequate protections are provided for personal data in such recipient countries. With regard to transfers of personal data from our European employees and customers to the United States, we historically relied on our adherence to the United States Department of Commerce's Safe Harbor Privacy Principles and compliance with the EU-U.S. and Swiss-U.S. Safe Harbor Frameworks as agreed to and set forth by the United States Department of Commerce, the EU, and Switzerland. Following the invalidation of the EU-U.S. Safe Harbor Framework by the Court of Justice of the European Union, or CJEU, in October 2015, we implemented certain measures in order to certify our adherence to the EU-U.S, UK-US, Swiss-U.S. Privacy Shield Frameworks. In addition, we have relied on standard contractual clauses approved by the European Commission for this purpose. In July 2020, the EU-U.S. Privacy Shield Framework was also invalidated by the CJEU. Since the invalidation of the EU-U.S. Privacy Shield Framework, we have sought to implement other measures to permit transfers of personal data from the UK, EEA and Switzerland to the United States, including continuing to rely on the standard contractual clauses approved by the European Commission for this purpose. On June 4, 2021, the European Commission published new versions of the Standard Contractual Clauses, or New SCCs, which, among other things, seek to address the issues identified by the CJEU invalidating Privacy Shield. On June 18, 2021, the European Data Protection Board, or EDPB, issued its final guidance that imposes significant new diligence requirements on transferring data outside the EEA, including under an approved transfer mechanism. This guidance requires an "essential equivalency" assessment of the laws of the destination country transferred. If the "essentially equivalent" level of protection standard outlined by the CJEU's decision is not satisfied in the destination country, the exporting entity must then assess if supplementary technical, organizational and/or contractual measures can be put in place that, in combination with the chosen transfer mechanism, would address the deficiency in the laws and ensure that essentially equivalent protection can be given to the data. Complying with this guidance will be expensive and time consuming and may ultimately prevent us from transferring personal data outside the EEA, which would cause significant business disruption. At present, there are few, if any, viable alternatives to the SCCs. The UK is not subject to the European Commission's New SCCs; however, it has published its own transfer mechanism, the International Data Transfer Agreement or International Data Transfer Addendum, which enables transfers from the UK. Further, the standard contractual clauses could also be subject to challenges, and could ultimately be invalidated by the European courts. Relatedly, the Swiss data protection authority determined the Swiss-U.S. Privacy Shield framework was no longer a valid mechanism for Swiss-U.S. data transfers and also raised questions about the validity of the standard contractual clauses as a mechanism for transferring personal data from Switzerland. In addition to the present uncertainty as to valid means to assure adequate safeguards of EEA and Swiss personal data transferred to the United States, we expect to be impacted by future changes in law as a result of a further reviews of transfer mechanisms by European regulators, as well as challenges to these mechanisms in the European courts. There are also questions of whether and by what mechanisms personal data may be transferred from the EEA and Switzerland to the United Kingdom, post-Brexit. In June 2021, the European Commission issued an adequacy decision under the GDPR which allows transfers of personal data from the EEA to the United Kingdom to continue without restriction for a period of four years. But if the adequacy decision is not renewed, such transfers of personal data will require a valid transfer mechanism and companies making such transfers may be required to implement new processes and put new agreements in place to continue making such transfers. If we cannot implement a valid compliance mechanism for cross-border personal data transfers, we may face increased exposure to regulatory actions, substantial fines, and injunctions against processing or transferring personal data from Europe. Further, additional changes in EU and UK data protection law may be on the horizon. The UK has announced plans to reform the country's data protection legal framework in its Data Protection and Digital Information Bill. While these plans are currently on hold, if they do manifest, they will likely cause additional complications and carry additional compliance burdens. Also, at the European level, the EU's Digital Services Act, or DSA, was formally approved by EU law makers in October 2022; however, the majority of the DSA's provisions will not be applicable until February 2024. The DSA will - inter alia - impose new obligations on providers of intermediary services and hosting services (a subset of the former). Such obligations include establishing points of contact to facilitate direct communication with supervisory authorities and the recipients of services, and implementation of mechanisms to allow third parties to notify the presence of allegedly illegal content. Failure to comply with applicable foreign privacy or data security-related laws, rules could result in material fines and other penalties imposed by regulators, affect our compliance with client contracts and have an adverse effect on our business, financial condition, and results of operations. Our activities could also result in litigation (including class-related claims), mandatory disclosures of breaches to affected individuals, customers, and data protection supervisory authorities, as well as investigations and administrative measures by data protection supervisory authorities, such as the instruction to alter or stop non-compliant data processing activities, including the instruction to stop using non-compliant subcontractors.

A key element of our strategy is to invest significantly in our research and development efforts to develop new solutions and rapidly introduce new technologies, features and functionality of our existing solutions. For the years ended December 31, 2022, 2021, and 2020, our research and development expenses were 29%, 30%, and 28% of our revenue, respectively. If we do not spend our research and development budget efficiently or effectively on compelling innovation and technologies, our business may be harmed and we may not realize the expected benefits of our strategy. Moreover, research and development projects can be technically challenging and expensive. The nature of these research and development cycles may cause us to experience delays between the time we incur expenses associated with research and development and the time we are able to offer compelling solutions and generate revenue, if any, from such investment. Additionally, anticipated customer demand for a solution or solutions we are developing could decrease after the development cycle has commenced, and we would nonetheless be unable to avoid substantial costs associated with the development of any such solution or solutions. If we expend a significant amount of resources on research and development and our efforts do not lead to the successful introduction or improvement of solutions that are competitive in our current or future markets, it would harm our business and results of operations.

Our agreements with customers, suppliers, partners and other third parties may include indemnification or other provisions under which we agree to indemnify or otherwise be liable to them for losses suffered or incurred as a result of claims of intellectual property infringement, damages caused by us to property or persons, data and security breaches, and other liabilities relating to or arising from our software, services, acts or omissions. The term of these contractual provisions often survives termination or expiration of the applicable agreement. Large indemnity payments or damage claims from contractual breach could harm our business, results of operations and financial condition. Although in some cases we contractually limit our liability with respect to such obligations, we do not always do so, and in the future we may still incur substantial liability related to them. In some cases, we agree to limit the liability of our partners and suppliers to us with respect to such indemnification obligations, and this may cause us to incur substantial liability for which we have limited recourse from such suppliers and partners. Any dispute with a customer with respect to such obligations could have adverse effects on our relationship with that customer and other current and prospective customers, reduce demand for our solutions, and harm our business, results of operations, and financial condition.

The software technology underlying our XM Platform is inherently complex and may contain material defects or errors, particularly when first introduced or when new features or capabilities are released. We have from time to time found defects or errors in our XM Platform, and new defects or errors in our existing XM Platform or new software may be detected in the future by us or our users. There can be no assurance that our existing XM Platform and new software will not contain defects. Any real or perceived errors, failures, vulnerabilities, or bugs in our XM Platform could result in negative publicity or lead to data security, access, retention, or other performance issues, all of which could harm our business. The costs incurred in correcting such defects or errors may be substantial and could harm our results of operations and financial condition. Moreover, the harm to our reputation and legal liability related to such defects or errors may be substantial and could harm our business, results of operations, and financial condition. We also utilize hardware purchased or leased, and software and services licensed, from third parties to host and provide security over our XM Platform. Our customers may also seek to integrate our XM Platform with other software systems developed by third parties. Any defect in, or unavailability of, our or third-party software, services or hardware, or problems with integrating our XM Platform with third-party software that causes interruptions to the availability of our XM Platform, loss of data, or performance issues could, among other things: - cause a reduction in revenue or delay in market acceptance of our XM Platform;- require us to issue refunds to our users or expose us to claims for damages;- cause us to lose existing users and make it more difficult to attract new users;- divert our development resources or require us to make extensive changes to our XM Platform, which would increase our expenses;- increase our technical support costs; and - harm our reputation and brand.

Our existing and potential relationships with partners, suppliers, and customers may be affected by our relationship with SAP. We partner with, purchase from, and sell to a number of companies that compete with SAP. SAP's majority ownership in us might affect our ability to develop and maintain relationships with these companies, including because SAP may require us to limit our relationships with them or not work with them at all. Likewise, these companies may be less willing or unwilling to develop and maintain relationships with us, and may favor our competitors or may view us as competitors, because of our relationship with SAP. SAP competes with certain of our significant channel, technology, and other marketing partners as well as certain of our customers and suppliers. Pursuant to our amended and restated certificate of incorporation and certain agreements that we have entered into with SAP, SAP may have the ability to impact our relationship with these companies, which could have a material adverse effect on our results of operations or our ability to pursue opportunities which may otherwise be available to us.

As the market for our solutions matures, or as competitors introduce new solutions that compete with ours, we may be unable to attract new customers at the same price or based on the same pricing models as we have used historically. We provide our software on a subscription basis priced on the number of solutions and level of functionality required by customers and the number of users and level of interactions through our software, and therefore, pricing decisions may also impact the mix of adoption among our subscription plans and negatively impact our overall revenue. Further, pricing pressures and increased competition generally could result in reduced sales, reduced margins, losses, or the failure of our products to achieve or maintain more widespread market acceptance, any of which could harm our business, results of operations, and financial condition. In the future we may be required to reduce our prices or develop new pricing models, which could adversely affect our revenue, gross margin, profitability, financial position, and cash flow.

As a global company, we are influenced by multiple external factors that are difficult to predict and beyond our influence and control. Any of these factors could have a significant adverse effect on the global economy as well as on our business. We are subject to risks and associated consequences in the following areas, among others: - General economic, political, social, environmental, public health, and market developments, and general unrest;- Prolonged deterioration of global economic conditions or budgetary constraints of national governments;- Diplomatic confrontations, frictions, trade or tariff conflicts, with potential global implications as indicated by a prolonged and widespread economic slowdown;- Financial market volatility episodes, global economic crises and chronic fiscal imbalances, slowing economic conditions, or disruptions in emerging markets;- Higher credit barriers for customers, reducing their ability to finance software purchases;- Increased number of foreclosures and bankruptcies among customers, business partners, and key suppliers;- The ongoing conflict between Russia and Ukraine, including impacts of government sanctions and other trade controls;- Terrorist attacks or other acts of violence, civil unrest, global pandemics such as COVID-19, or natural disasters, impacting our business; and - Regional conflicts, which may affect data centers as critical infrastructure assets. Any of these events could limit our ability to reach our targets, as they could have a material adverse effect on our operating results and financial position.

Natural disasters or other catastrophic events may cause damage or disruption to our operations, international commerce, and the global economy, and thus could harm our business. In the event of a major earthquake, hurricane, fire, cyberattack, war, terrorist attack, disease, such as the COVID-19 pandemic, power loss, telecommunications failure, or other catastrophic events, we may be unable to continue our operations, in part or in whole, and may endure reputational harm, delays in developing our XM Platform and solutions, breaches of data security and loss of critical data, all of which could harm our business, results of operations and financial condition. Additionally, we rely on our network and third-party infrastructure and applications, internal technology systems, and our websites for our development, marketing, operational support, hosted services, and sales activities. If these systems were to fail or be negatively impacted as a result of a natural disaster or other event, our ability to deliver solutions to our customers would be impaired. As we grow our business, the need for business continuity planning and disaster recovery plans will grow in significance. If we are unable to develop adequate plans to ensure that our business functions continue to operate during and after a disaster, and successfully execute on those plans in the event of a disaster or emergency, our business and reputation would be harmed.

Our results of operations and cash flows are subject to fluctuations due to changes in foreign currency exchange rates, particularly changes in the Euro, British Pound sterling, and Australian Dollar. We have not instituted a hedging program. We expect our international operations to continue to grow in the near term, and we regularly monitor our foreign currency exposure to determine when we should begin a hedging program. Today, our international contracts are denominated in either U.S. dollars or local currency, while our international operating expenses are often denominated in local currencies. Additionally, as we expand our international operations, a larger portion of our operating expenses will be denominated in local currencies. Therefore, fluctuations in the value of the U.S. dollar and foreign currencies may affect our results of operations when translated into U.S. dollars.

So long as SAP beneficially owns shares of our common stock representing at least a majority of the votes entitled to be cast by the holders of outstanding voting stock, SAP can effectively control and direct our board of directors and our company generally. Further, the interests of SAP and our other stockholders may diverge. Under these circumstances, persons who might otherwise accept our invitation to join our board of directors or become our employees may decline.