{ "ticker": "JCI", "company": "Johnson Controls International plc", "filing_type": "10-K", "year_current": "2026", "year_prior": "2025", "summary": { "added": 0, "removed": 2, "modified": 31, "unchanged": 4, "total_current": 35, "total_prior": 37 }, "source": "SEC EDGAR", "url": "https://riskdiff.com/jci/2026-vs-2025/", "markdown_url": "https://riskdiff.com/jci/2026-vs-2025/index.md", "json_url": "https://riskdiff.com/jci/2026-vs-2025/index.json", "access": "public_preview", "source_filings": [ { "label": "2026 10-K filing on SEC EDGAR", "url": "https://www.sec.gov/Archives/edgar/data/833444/000083344426000108/0000833444-26-000108-index.htm" }, { "label": "2025 10-K filing on SEC EDGAR", "url": "https://www.sec.gov/Archives/edgar/data/833444/000083344425000097/0000833444-25-000097-index.htm" } ], "generated": "2026-11-14", "ai_summary": null, "disclosure_overview": { "executive_summary": "31 matched sections have text edits; 4 have identical text after formatting cleanup. 0 current and 2 earlier sections lack a one-to-one match.", "direction": "undetermined", "top_themes": [], "method": "deterministic", "coverage": { "added": 0, "removed": 2, "modified": 31, "unchanged": 4, "total_current": 35, "total_prior": 37, "sections_with_related_passages": 0 } }, "comparison_method": "Text equality after formatting cleanup; ADDED/REMOVED mean no one-to-one section match, not new/disappeared business exposure.", "ai_brief": null, "risks": [ { "status": "MODIFIED", "current_title": "Cybersecurity incidents, evolving cyber threats and cybersecurity requirements affecting our IT systems, digital products and services could disrupt business operations, result in the loss of critical and confidential information, and materially and adversely affect our reputation and results of operations.", "prior_title": "Cybersecurity incidents impacting our IT systems and digital products could disrupt business operations, result in the loss of critical and confidential information, and materially and adversely affect our reputation and results of operations.", "severity": { "deterministic": 5, "ai_bump": 0, "total": 5, "tier": "medium", "signal_hits": [ "ai", "cyber" ] }, "relationship_status": "matched", "current_source": { "heading": "Cybersecurity incidents, evolving cyber threats and cybersecurity requirements affecting our IT systems, digital products and services could disrupt business operations, result in the loss of critical and confidential information, and materially and adversely affect our reputation and results of operations.", "passage_url": "https://www.sec.gov/Archives/edgar/data/833444/000083344426000108/jci-20260930.htm#:~:text=Cybersecurity%20incidents%2C%20evolving%20cyber%20threats%20and%20cybersecurity%20requirements%20affecting%20our%20IT%20systems%2C%20digital%20products%20and%20services%20could%20disrupt%20business%20operations%2C%20result%20in%20the%20loss%20of%20critical%20and%20confidential%20information%2C%20and%20materially%20and%20adversely%20affect%20our%20reputation%20and%20results%20of%20operations.", "document_url": "https://www.sec.gov/Archives/edgar/data/833444/000083344426000108/jci-20260930.htm", "printed_page": "13", "source_sha256": "4bfd45aaa61723d469e057cee09bbe5ccee745626bf798221cb038920c39ecc8", "source_fragment_sha256": "6ea0aabab0c02b7685eedca99bf106c7246609efca86162c05c7a3ba854078f2" }, "prior_source": {}, "related_prior_sections": [], "related_current_sections": [], "context_prior_sections": [], "similarity_score": 0.769, "confidence": "high", "key_changes": [ "Removed sentence: \"We rely upon the capacity, reliability and security of our IT and data security infrastructure and our ability to expand and continually update this infrastructure in response to the changing needs of our business.\"", "Removed sentence: \"As we implement new systems or integrate existing systems, they may not perform as expected.\"", "Removed sentence: \"We also face the challenge of supporting our older systems, which are vulnerable to increased risks, including the risk of security breaches, system failures and disruptions, and implementing necessary upgrades.\"", "Removed sentence: \"If we experience a problem with the functioning of an important IT system as a result of increased burdens placed on our IT infrastructure or a security breach of our IT systems, the resulting disruptions could have a material adverse effect on our business.\"", "Removed sentence: \"Global cybersecurity threats and incidents can range from uncoordinated individual attempts to gain unauthorized access to IT systems to sophisticated and targeted measures known as advanced persistent threats directed at the Company, its products, its customers and/or its third-party service providers, including cloud providers.\"", "Removed sentence: \"We and third parties utilize vendors to support our business and operations have experienced, and expect to continue to experience, these types of threats and incidents, which add to the risks to our IT systems (including our cloud services providers’ systems), internal networks, our customers’ systems and the information that they store and process.\"", "Removed sentence: \"We have and may in the future experience cybersecurity incidents that cause us to incur significant costs, reputational damage, expose us to legal claims or enforcement actions and fines levied by governmental organizations, which in turn could materially and adversely affect our results of operations.\"", "Removed sentence: \"There can be no assurance that unauthorized access or cyber incidents will not occur or that we will not suffer material losses in the future.\"", "Removed sentence: \"Other potential consequences could include the theft of intellectual property and the diminution in the value of our investment in research, development and engineering, which in turn could materially and adversely affect our competitiveness and results of operations.\"", "Added sentence: \"We rely on the capacity, reliability and security of our IT and data security infrastructure, and on our ability to expand and update it as our business changes.\"", "Added sentence: \"Implementing new systems, integrating existing systems and supporting our older systems all increase the risk of security breaches.\"", "Added sentence: \"If an important IT system fails because of increased burdens on our IT infrastructure or a security breach, the resulting disruption could have a material adverse effect on our business, reputation and financial results.\"", "Added sentence: \"Cybersecurity threats range from uncoordinated individual attempts to gain unauthorized access to sophisticated, targeted attacks known as advanced persistent threats.\"", "Added sentence: \"These are directed at us, our products, our customers and our third-party service providers, including cloud providers.\"", "Added sentence: \"AI and machine learning technologies continue to develop rapidly, and the risks and market disruptions they may cause are impossible to predict.\"", "Added sentence: \"Threat actors already use these technologies to build new hacking tools and attack vectors, exploit vulnerabilities, hide their activities and make attacks harder to attribute.\"", "Added sentence: \"New AI tools can find previously undetected vulnerabilities in short time spans and create exposure to zero-day attacks.\"", "Added sentence: \"These developments may enable faster, larger-scale and more sophisticated attacks on us, our products, connected building environments, customers and third-party providers.\"", "Added sentence: \"They also significantly shorten the time we and our third-party service providers have to detect, respond to and fix vulnerabilities.\"", "Added sentence: \"In addition, the vendors we use to support our business and operations have experienced, and will likely continue to experience, these types of threats and incidents, which add to the risks to our IT systems (including our cloud services providers’ systems), internal networks, our customers’ systems and the information stored and processed on such networks and systems.\"", "Added sentence: \"Despite our efforts to deploy countermeasures to deter, prevent, detect, respond to and mitigate cybersecurity threats, we have experienced, and will likely continue to experience, cybersecurity incidents and attacks.\"", "Added sentence: \"Such incidents have remained, and could in the future remain, undetected for an extended period of time, and the losses arising from such incidents could exceed our available insurance coverage for such matters.\"", "Added sentence: \"An increasing number of our products, services and technologies are delivered with digital capabilities and interconnected device networks, including sensors, data, building management systems and advanced computing and analytics capabilities.\"", "Added sentence: \"If\"", "Added sentence: \"13\"", "Added sentence: \"we fail to manage lifecycle cybersecurity risk in the development, deployment and operation of these digital platforms and services, they could suffer cybersecurity incidents.\"", "Added sentence: \"That could lead to third-party claims that our product failures damaged our customers.\"", "Added sentence: \"This risk is heightened by the increasingly connected nature of our products and the role they play in managing building systems.\"", "Added sentence: \"Any future cybersecurity incidents or attacks, depending on their nature and scope, may result in the Company incurring significant costs, reputational damage, exposure to legal claims, enforcement actions, audits, investigations and fines levied by governmental organizations, misappropriation, destruction, corruption or unavailability of critical data and confidential or proprietary information (our own or that of third parties), the theft of intellectual property and the diminution in the value of our investment in research, development and engineering, and the disruption of business operations.\"", "Removed sentence: \"Despite our efforts to deploy countermeasures to deter, prevent, detect, respond to and mitigate cybersecurity threats, we have experienced, and will likely continue to experience, attacks and resulting breaches or breakdowns of our, or our third-party service providers’, databases or systems.\"", "Removed sentence: \"Cybersecurity incidents, depending on their nature and scope, have resulted, and may in the future result, in misappropriation, destruction, corruption or unavailability of critical data and confidential or proprietary information (our own or that of third parties) and the disruption of business operations.\"", "Removed sentence: \"Such incidents have remained, and could in the future remain, undetected for an extended period of time, and the losses arising from such incidents could exceed our available insurance coverage for such matters.\"", "Removed sentence: \"In addition, security breaches impacting our IT systems have in certain cases resulted in, and in the future could result in, a risk of loss or unauthorized disclosure or theft of information, which could lead to enforcement actions, litigation, regulatory or governmental audits, investigations and possible liability.\"", "Removed sentence: \"An increasing number of our products, services and technologies, including our OpenBlue software platform, are delivered with digital capabilities and accompanying interconnected device networks, which include sensors, data, building management systems and advanced computing and analytics capabilities.\"", "Removed sentence: \"If we are unable to manage the lifecycle cybersecurity risk in development, deployment and operation of our digital platforms and services, they could become susceptible to cybersecurity incidents and lead to third-party claims that our product failures have caused damage to our customers.\"", "Removed sentence: \"This risk is enhanced by the increasingly connected nature of our products and the role they play in managing building systems.\"", "Added sentence: \"Evolving cybersecurity laws, standards and customer requirements mandating secure-by-design and lifecycle security controls may increase costs, delay product launches, limit market access, and require us to modify or discontinue offerings that cannot be economically or technically adapted.\"" ], "current_body": "We rely on the capacity, reliability and security of our IT and data security infrastructure, and on our ability to expand and update it as our business changes. Implementing new systems, integrating existing systems and supporting our older systems all increase the risk of security breaches. If an important IT system fails because of increased burdens on our IT infrastructure or a security breach, the resulting disruption could have a material adverse effect on our business, reputation and financial results.\n\nCybersecurity threats range from uncoordinated individual attempts to gain unauthorized access to sophisticated, targeted attacks known as advanced persistent threats. These are directed at us, our products, our customers and our third-party service providers, including cloud providers. AI and machine learning technologies continue to develop rapidly, and the risks and market disruptions they may cause are impossible to predict. Threat actors already use these technologies to build new hacking tools and attack vectors, exploit vulnerabilities, hide their activities and make attacks harder to attribute. New AI tools can find previously undetected vulnerabilities in short time spans and create exposure to zero-day attacks. These developments may enable faster, larger-scale and more sophisticated attacks on us, our products, connected building environments, customers and third-party providers. They also significantly shorten the time we and our third-party service providers have to detect, respond to and fix vulnerabilities. In addition, the vendors we use to support our business and operations have experienced, and will likely continue to experience, these types of threats and incidents, which add to the risks to our IT systems (including our cloud services providers’ systems), internal networks, our customers’ systems and the information stored and processed on such networks and systems. Despite our efforts to deploy countermeasures to deter, prevent, detect, respond to and mitigate cybersecurity threats, we have experienced, and will likely continue to experience, cybersecurity incidents and attacks. Such incidents have remained, and could in the future remain, undetected for an extended period of time, and the losses arising from such incidents could exceed our available insurance coverage for such matters.\n\nAn increasing number of our products, services and technologies are delivered with digital capabilities and interconnected device networks, including sensors, data, building management systems and advanced computing and analytics capabilities. If\n\n13\n\nwe fail to manage lifecycle cybersecurity risk in the development, deployment and operation of these digital platforms and services, they could suffer cybersecurity incidents. That could lead to third-party claims that our product failures damaged our customers. This risk is heightened by the increasingly connected nature of our products and the role they play in managing building systems.\n\nAny future cybersecurity incidents or attacks, depending on their nature and scope, may result in the Company incurring significant costs, reputational damage, exposure to legal claims, enforcement actions, audits, investigations and fines levied by governmental organizations, misappropriation, destruction, corruption or unavailability of critical data and confidential or proprietary information (our own or that of third parties), the theft of intellectual property and the diminution in the value of our investment in research, development and engineering, and the disruption of business operations.\n\nOur customers, including the U.S. government, are increasingly requiring cybersecurity protections and mandating cybersecurity standards in our products, and we may incur additional costs to comply with such demands. Evolving cybersecurity laws, standards and customer requirements mandating secure-by-design and lifecycle security controls may increase costs, delay product launches, limit market access, and require us to modify or discontinue offerings that cannot be economically or technically adapted.", "prior_body": "We rely upon the capacity, reliability and security of our IT and data security infrastructure and our ability to expand and continually update this infrastructure in response to the changing needs of our business. As we implement new systems or integrate existing systems, they may not perform as expected. We also face the challenge of supporting our older systems, which are vulnerable to increased risks, including the risk of security breaches, system failures and disruptions, and implementing necessary upgrades. If we experience a problem with the functioning of an important IT system as a result of increased burdens placed on our IT infrastructure or a security breach of our IT systems, the resulting disruptions could have a material adverse effect on our business.\n\nGlobal cybersecurity threats and incidents can range from uncoordinated individual attempts to gain unauthorized access to IT systems to sophisticated and targeted measures known as advanced persistent threats directed at the Company, its products, its customers and/or its third-party service providers, including cloud providers. We and third parties utilize vendors to support our business and operations have experienced, and expect to continue to experience, these types of threats and incidents, which add to the risks to our IT systems (including our cloud services providers’ systems), internal networks, our customers’ systems and the information that they store and process. We have and may in the future experience cybersecurity incidents that cause us to incur significant costs, reputational damage, expose us to legal claims or enforcement actions and fines levied by governmental organizations, which in turn could materially and adversely affect our results of operations. There can be no assurance that unauthorized access or cyber incidents will not occur or that we will not suffer material losses in the future. Other potential consequences could include the theft of intellectual property and the diminution in the value of our investment in research, development and engineering, which in turn could materially and adversely affect our competitiveness and results of operations.\n\nOur customers, including the U.S. government, are increasingly requiring cybersecurity protections and mandating cybersecurity standards in our products, and we may incur additional costs to comply with such demands. Despite our efforts to deploy countermeasures to deter, prevent, detect, respond to and mitigate cybersecurity threats, we have experienced, and will likely continue to experience, attacks and resulting breaches or breakdowns of our, or our third-party service providers’, databases or systems. Cybersecurity incidents, depending on their nature and scope, have resulted, and may in the future result, in misappropriation, destruction, corruption or unavailability of critical data and confidential or proprietary information (our own or that of third parties) and the disruption of business operations. Such incidents have remained, and could in the future remain, undetected for an extended period of time, and the losses arising from such incidents could exceed our available insurance coverage for such matters. In addition, security breaches impacting our IT systems have in certain cases resulted in, and in the future could result in, a risk of loss or unauthorized disclosure or theft of information, which could lead to enforcement actions, litigation, regulatory or governmental audits, investigations and possible liability.\n\nAn increasing number of our products, services and technologies, including our OpenBlue software platform, are delivered with digital capabilities and accompanying interconnected device networks, which include sensors, data, building management systems and advanced computing and analytics capabilities. If we are unable to manage the lifecycle cybersecurity risk in development, deployment and operation of our digital platforms and services, they could become susceptible to cybersecurity incidents and lead to third-party claims that our product failures have caused damage to our customers. This risk is enhanced by the increasingly connected nature of our products and the role they play in managing building systems." } ], "full_url": "https://riskdiff.com/jci/2026-vs-2025/full/" }