ServiceNow Inc.: 10-K Risk Factor Changes

23 Table of ContentsPart I Table of Contents Part I to use, store or otherwise process customer data in connection with providing services and could alter or increase our compliance requirements. In some cases, this could impact our ability to offer our services in certain locations or our customers’ ability to deploy our services globally. For example, the EU Data Act has data portability, interoperability and accessibility requirements, as well as unclear data transfer restrictions that could impact our operations. In addition, the Trans-Atlantic Data Privacy Framework, which facilitates the transfer of data between the United States (“U.S.”) and European Union (“EU”), may be subject to legal challenges and regulatory interpretations that could create uncertainties and impact our operations and compliance obligations. We offer some region-specific services where customer data is hosted locally and customers may elect to receive support from locally-based ServiceNow teams. Setting up and maintaining these region-specific services require significant investment, including to comply with applicable laws and regulations. Actual or perceived non-compliance with those laws, regulations, or the terms of our region-specific service offerings may result in investigations or proceedings against us by regulatory authorities or others, significant fines or damages, orders, litigation, reputational harm and other adverse impacts on our business. We will also need to continually adapt to customer privacy and security requirements as they change over time. For example, as customers increasingly adopt a hybrid (on-premises and off-premises/hyperscale cloud) approach for their IT workloads, our cloud services may fail to address evolving customer requirements, including data localization. Further, due to heightened concerns relating to privacy and security regulatory matters, our customers from time to time request certain certifications, and a failure to obtain or consistently maintain those certifications may adversely impact our reputation and business.