Adobe Inc
Risk Factors synthesis.

If our reputation or our brands are damaged, our business and financial results may be adversely affected. We believe our reputation and brands have been, and we expect them to continue to be, important to our business and financial results. Maintaining and enhancing our brands may require us to make substantial investments and these investments may not be successful. We have experienced, and may in the future experience, reputational harm, reduced customer demand and customer attrition from, among other things, the introduction of new products, features, services, or terms that do not meet customer expectations; our position on or approach to new and evolving technologies, including AI; backlash from customers, the creative community, government entities or other stakeholders that disagree with our product offering decisions or public policy, social, ethical or political positions; significant litigation or regulatory or government actions that negatively reflect on our business practices; data security breaches or compliance failures; and public scrutiny or negative publicity, including being the target of media and social media campaigns, criticizing our actual or perceived actions or inactions, policies, terms, agreements, dispute resolution requirements, handling of user privacy, data practices or content. Our brands may be negatively affected by the actual or perceived failure to meet our sustainability commitments or appropriately respond to climate concerns; and uses of our solutions, particularly our AI solutions, in ways that are out of our control, such as to create or disseminate content that is deemed to be misleading, deceptive or intended to manipulate public opinion, or for illicit, objectionable or illegal ends, or by our failure to respond appropriately and in a timely manner to such uses. Further, such uses of our solutions may result in controversy or claims related to defamation, rights of publicity, illegal content, intellectual property infringement, 18 harmful content, misinformation and disinformation, harmful bias, misappropriation, data privacy, derivative uses of third-party AI and personal injury torts. If we fail to appropriately respond to objectionable content created using our solutions or shared on our platforms, our users may lose confidence in our brands. Entry into markets with weaker protection of brands or changes in the legal systems in countries in which we operate may also impact our ability to protect our brands. If we fail to maintain, enhance or protect our brands, or if we incur excessive expenses in our efforts to do so, our users' trust in us and purchasing decisions and our business and financial results may be adversely affected. We may not realize the anticipated benefits of acquisitions, investments or other strategic transactions, and they may disrupt our business and adversely affect our business and financial results. We have acquired and may continue to acquire businesses, products, talent and technologies as part of our business strategy. Acquisitions, investments and other strategic transactions involve numerous risks and uncertainties, the occurrence of which may have an adverse effect on our business. These risks and uncertainties include: •inability to achieve the expected financial and strategic benefits on a timely basis or at all; •difficulty in effectively integrating operations, technologies, products, services, solutions, culture or personnel; •disruption of our ongoing business and distraction of our management and other personnel; •challenges to completing or failure to complete an announced transaction related to the failure to obtain regulatory approval, or the need to satisfy certain conditions precedent to closing such transaction (such as divestitures, ownership or operational restrictions or other structural or behavioral remedies) that could limit the anticipated benefits of the transaction; •entry into markets in which we have minimal prior experience and where competitors in such markets have stronger market positions; •inability to retain personnel, key customers, distributors, vendors and other business partners of the acquired business; •delay in customer and distributor purchasing decisions due to uncertainty about the direction of our solutions; •incurring higher than anticipated costs to effectively integrate an acquired business, to bring an acquired company into compliance with applicable laws and regulations, additional compensation issued or assumed in connection with an acquisition, to divest products, services or solutions acquired in unsuccessful acquisitions to amortize costs for acquired intangible assets or because of our inability to take advantage of anticipated tax benefits; •increased collection times, elevated delinquency or bad debt write-offs related to receivables of an acquired business we assume; •difficulty in maintaining controls, procedures and policies during the transition and integration of an acquired business and inability to conclude that our internal controls over financial reporting are effective; •potential identified or unknown security vulnerabilities in acquired or integrated entities' systems, technologies, or products that expose us to additional security risks or delay our ability to integrate the acquired products into our existing solutions; •exposure to litigation or other claims in connection with, or inheritance of claims or litigation risk as a result of, a transaction; •incurrence of additional debt to finance a transaction, which will increase our interest expense and leverage, and/or issuance of equity securities to finance transactions, which will dilute current shareholders' percentage ownership and earnings per share; •in the case of foreign transactions, the impact of particular economic, tax, currency, political, legal and regulatory risks associated with specific countries;

We are subject to fluctuations in foreign currency exchange rates and may not be able to effectively hedge our exposure. Our operating results and performance metrics are subject to fluctuations in foreign currency exchange rates due to the global scope of our business. Geopolitical and economic events, including war, trade disputes, economic sanctions and emerging market volatility, and associated uncertainty have caused, and may in the future cause, currencies to fluctuate. Accordingly, amounts reported as annualized recurring revenue, a performance metric which we measure at currency rates that are set at the beginning of each fiscal year and held constant throughout the year, may vary from actual revenue recognized in accordance with generally accepted accounting principles in the United States. We attempt to mitigate a portion of these foreign currency exchange risks to our operating results through foreign currency hedging based on our judgment of the appropriate trade-offs among risk, opportunity and expense. We regularly review our hedging program and make adjustments that we believe are appropriate. Our hedging activities have not, and may not in the future, offset more than a portion of the adverse financial impact, including on our actual revenue recognized, resulting from unfavorable movement in foreign currency exchange rates, which could adversely affect our financial condition, business performance or results of operations. 32

General Risk Factors Catastrophic events, including events associated with climate change, may disrupt our business and adversely affect our financial condition and results of operations. Our business relies on our network infrastructure and enterprise Apps, internal technology systems and websites. A disruption, infiltration or failure of our systems, data centers or operations, or those of our third-party service providers due to a major earthquake, other natural disasters, including climate-related events (such as drought, water security, heat waves, cold waves, wildfires and poor air quality), power shutoff or loss, telecommunications failure, epidemic, pandemic, war, terrorist attack or other catastrophic event, could cause interruptions to our systems and business operations, damage to critical infrastructure, loss of intellectual property, data security breaches and data loss. Our corporate headquarters, significant research and development activity, certain of our data centers and other critical business operations are in the San Francisco Bay Area and the Salt Lake Valley Area, both of which are near major earthquake faults. Climate-related catastrophic events that may harm our business are also increasing in frequency and severity. A catastrophic event, particularly one that may disrupt our data centers or our critical activities, could prevent us from conducting normal business operations and providing our products, services and solutions, which could adversely affect our business. A catastrophic event could negatively impact a country or region in which we sell and, in turn, decrease demand for our products, services and solutions, which could negatively impact our business. Laws, regulations and policies relating to environmental, social, and governance are expanding globally. We may be subject to additional climate-related regulations and reporting requirements in the future, as well as changing market dynamics and stakeholder expectations regarding climate change and our environmental impacts. Compliance with such regulations, investments in our environmental, social and governance commitments, may involve significant costs and negatively impact our business, financial condition and results of operations. Additionally, we may experience reputational harm from our actual or perceived failure to meet our environmental, social and governance commitments. 33 The occurrence of an epidemic or a pandemic, such as the COVID-19 pandemic, has had, and may in the future, have an adverse effect on our operating results. The extent to which epidemics and pandemics impact our financial condition or results of operations will depend on many factors outside of our control and whether there is a material impact on the businesses or productivity of our customers, employees, suppliers and other partners. A global pandemic may also intensify the other risks described in this Part I, Item 1A of this report.

Some of our enterprise offerings have extended and complex sales cycles, which may increase our costs and make our sales cycles unpredictable. As we continue to target enterprise customers for certain of our offerings, including Adobe Experience Cloud in our Digital Experience business and our Enterprise Term License Agreements in our Digital Media business, we may face increased costs, longer sales cycles, greater competition and less predictability in completing our sales. For our enterprise customers, the 28 evaluation process may be longer and more involved, and require us to invest more in educating our customers about our products, services and solutions, particularly because the decision to use our products, services and solutions is often an enterprise-wide decision. We are increasingly offering end-to-end solutions that include cross-cloud and generative AI capabilities, which have in the past, and may in the future, increase the complexity of technical or contractual assurances or requirements that we or our customers require as part of the contracting process, leading to extended sales cycles. We may be required to submit more robust proposals, participate in extended proof-of-concept evaluation cycles and engage in more extensive contract negotiations. In addition, our enterprise customers often demand more complex configurations and additional integration services and product features. Adverse macroeconomic conditions have caused, and may continue to cause, additional spend scrutiny and delays in our enterprise customers' purchasing decisions. Due to these factors, we often must devote greater sales support to certain enterprise customers, which increases our costs and time required to complete a sale, without assurance that potential customers will ultimately purchase our solutions. We also may be required to devote more services resources to implementation, which increases our costs, without assurance that customers receiving these services will renew or renew at the same level. Since the sales cycles for our enterprise offerings are multi-phased and complex, it is often unpredictable when a given sales cycle will close. Our revenue from enterprise customers may be affected by longer-than-expected sales, contract negotiation and implementation cycles, extended collection cycles, potential deferral of revenue and alternative licensing arrangements. Additionally, our enterprise sales pattern has historically been, and is expected to remain, uneven, where a higher percentage of a quarter's total sales occur during the final weeks of each quarter, which is common in our industry. If we are unable to recruit and retain key personnel, our business may be harmed, and our hybrid work model may present challenges, which could adversely impact our business. Much of our future success depends on the continued service, availability and performance of our senior management and highly skilled personnel across all levels of our organization. Our senior management has acquired specialized knowledge and skills with respect to our business, and the loss of any of these individuals could harm our business, especially if we are not successful in developing adequate succession plans. Our efforts to attract, develop, integrate and retain highly skilled employees may be compounded by intensified restrictions on immigration or the availability of work visas. The technology industry has been and may continue to be subject to substantial and continuous competition for talent, particularly with AI and cybersecurity backgrounds, and demand for cutting-edge or unique skill sets may continue to be highly competitive, both of which are heightened with hybrid or remote working arrangements. Our hybrid work environment may also present operational, security and workplace culture challenges, which could negatively affect our ability to execute against our business objectives and retain and recruit personnel. We have experienced, and may continue to experience, higher compensation costs to retain and recruit senior management or highly skilled personnel that may not be offset by innovation, improved productivity or increased sales. We continue to hire personnel in countries where exceptional technical knowledge and other expertise are offered at lower costs, which increases the efficiency of our global workforce structure and reduces our personnel-related expenditures. Nonetheless, as globalization continues, competition for talent in those countries has increased, which may impact our ability to retain these employees and increase our compensation-related expenses.

Contracting with government entities exposes us to additional risks inherent in the government procurement process. We provide solutions, directly and indirectly, to a variety of domestic and foreign government entities, which introduces certain risks and challenges not present in private commercial agreements, including varying governmental budgeting processes; changes in governmental administrations and policies; fluctuations due to government spending cuts and shutdowns; and highly competitive and lengthy bidding process that may be subject to political influence. Additionally, we are subject to complex regulatory requirements and executive orders, including those related to procurement; export controls; employment; security; and other evolving government-specific contractual requirements. We incur significant up-front time and costs without any assurance that we will win a contract. Operating within a highly regulated industry, we have been and may in the future be subject to audits and investigations relating to our government contracts and any violations could result in termination of contracts and various civil and criminal penalties and administrative sanctions, including payment of fines and suspension or debarment from future government business, as well as harm to our reputation and financial results. We have made, and may 26 continue to make, significant investments to support future sales opportunities in various government sectors, including to obtain various security authorizations and certifications. Such processes are complex, lengthy and can often be delayed. Furthermore, requirements may change, or we may be unable to achieve or sustain one or more government authorizations or certifications, which could affect our ability to sell to government entities until we meet any new or revised requirements.

Risks Related to Financial Performance If there is a change in subscriptions or renewals in a reporting period, this could cause our financial results to suffer and may not be immediately reflected in our revenue and financial results for that period because we recognize revenue over the subscription term. Our solutions are typically subscription-based, pursuant to product and service agreements. We generally recognize revenue from our subscription solutions ratably over the terms of their subscription agreements, which typically range from 1 to 36 months. As a result, most of the subscription revenue we report each quarter is the result of subscription agreements entered into during previous quarters. Lower sales and subscriptions, reduced demand for our solutions, and increases in our attrition rate in any given period may not be fully reflected in our results of operations until future periods. Our subscription model could also make it difficult for us to rapidly increase our revenue from subscription-based or hosted services through additional sales in any period, as revenue from new customers will be recognized over the applicable subscription term. Our renewal rates may decline or fluctuate as a result of a number of factors, including our customers' level of satisfaction, our ability to continue enhancing features and functionality, reliability of our solutions, prices of ours and competitors' solutions, the actual or perceived information security of our systems and services, decreases in the size of our customer base, changes as a result of regulatory or legal requirements, changes in the composition of our customer base and reductions in our customers' spending levels or declines in customer activity. If our customers do not renew their subscriptions or if they renew on terms less favorable to us, our revenue may decline. Further, such impact on our revenue may not be immediately reflected in our financial results in the period in which our renewal rates changed and may adversely affect our financial results in future periods. If any of our assumptions about revenue from our subscription-based solutions prove incorrect, our actual results may suffer and vary from those anticipated.

Our stock price has been volatile and your investment could lose value. Our stock price has been, and may continue to be, volatile and subject to fluctuations. All factors described in this Part I, Item 1A of this report, some of which are beyond our control, may affect our stock price, including: •shortfalls or declines in our results or shortfalls, changes to estimates, recommendations or expectations in guidance we provide or provided by financial analysts about our revenue, margins, earnings, annualized recurring revenue, growth rates or other key performance metrics; •changes to our key performance metrics; •changes in investor and analyst valuation models for our stock; •changes in annualized recurring revenue, unearned revenue, remaining performance obligations and revenue recognized at a point in time, all of which may impact actual or implied growth rates; •developments related to products or services, technological advancements, strategic alliances, acquisitions or significant transactions by us or our competitors; •changes in the amounts or frequency of stock repurchases; •the loss of large customers or our inability to retain or increase sales to existing customers or attract new customers; •changes to our management team, including recruitment or departure of key personnel; •variations in our or our competitors' financial and business performance, changes in the competitive landscape generally and developments in our industry;

•adverse economic, political or market conditions; and 28 •other events, such as significant litigation, regulatory investigations or actions, and negative media or social media coverage. In addition, the market for technology stocks or the stock market in general has experienced, and may in the future experience, extreme fluctuations, which has caused, and may in the future cause, our stock price to decline for reasons unrelated to our financial performance. Volatility in our stock price has increased, and may continue to increase, our susceptibility to securities class action litigation, which could result in substantial costs and divert management's attention and resources, which may adversely affect our business.

•brand or reputational harm associated with our acquisitions, investments or other strategic transactions; and •failure to identify significant problems, liabilities or other challenges during due diligence. 19 Our ability to acquire other businesses or technologies, make strategic investments or integrate acquired businesses effectively may also be impaired by adverse economic and political events, including trade tensions, and increased global scrutiny and evolving regulatory expectations relating to acquisitions and other strategic transactions. We may not be able to complete acquisitions or other strategic transactions to realize the anticipated benefits of such acquisitions or transactions on favorable terms, or at all, including as a result of challenges in obtaining regulatory approvals, and may incur additional costs. For example, we have experienced difficulties in obtaining regulatory approvals, resulting in the termination of a previously announced acquisition and the incurrence of additional costs. Any of these factors may adversely affect our business and financial results.

Our solutions collect, store, manage and otherwise process third-party data, including our customers' data and our own data. Such solutions as well as our technologies, systems and networks have been subject to, and may in the future be subject to, cyberattacks, computer viruses, ransomware or other malware, fraud, worms, social engineering, denial-of-service attacks, malicious software programs, insider threats and other cybersecurity incidents that have in the past, and may in the future, result in the unauthorized access, disclosure, acquisition, use, loss or destruction of sensitive personal or business data belonging to us, our employees and our customers. Some of our solutions include third-party open-source software, which may contain security vulnerabilities that may be exploited, potentially compromising our solutions. Increasing use of AI in our internal systems and solutions may create new attack methods. Cybersecurity incidents can be caused by human error from our workforce or that of our third-party service providers, by malicious third parties, acting alone or in groups, or by more sophisticated organizations, including nation-states and state-sponsored organizations. Such risks may be elevated in connection with geopolitical tensions, including the Russia-Ukraine war and the conflict in the Middle East, as well as malicious third parties utilizing emerging technologies, such as AI and machine learning. Certain unauthorized parties have in the past managed, and may in the future manage, to overcome our security measures and those of our third-party service providers to access and misuse systems and software by exploiting defects in design, configuration or manufacture, including bugs, vulnerabilities, change management errors and other problems that unexpectedly compromise the security or operation of a product or system. Further, unauthorized parties or authorized parties that exceed their authorized access may also gain physical access to our facilities and infiltrate our information systems or attempt to gain logical access to our solutions or information systems to access content and data and may result in computer viruses, worms, ransomware or other malware. Malicious third parties have in the past, and may in the future, fraudulently induce our employees or users of our solutions to disclose sensitive, personal or confidential information via illegal electronic spamming, phishing, social engineering or other tactics, and this risk is heightened in our current hybrid model working environment. Our solutions are incorporated into the supply chain of a large number of companies worldwide and, as a result, if our solutions experience a compromise, a large portion or, in some instances, all of our customers and their data for a given solution could be simultaneously affected. The potential liability and associated consequences we could suffer as a result of such a large scale event could be significant, and materially and adversely impact our business. Malicious actors may also engage in fraudulent or abusive activities through our solutions, including unauthorized use of accounts through stolen credentials, use of stolen credit cards or other payment vehicles, failure to pay for services accessed, or other activities that violate our terms of service. While we actively combat such fraudulent activities, we have experienced, and may in the future experience, impacts to our revenue and reputation from such activities. Maintaining the security of our solutions is a critical issue for us and our customers. We devote significant resources to address security vulnerabilities through various methods, including, but not limited to, engineering more secure products, enhancing security and reliability features in our products and systems, regularly reviewing our service providers' security controls, and continually assessing and improving, as appropriate, our incident response process. However, it is impossible to accurately predict the extent, frequency or impact cybersecurity issues may have on us, and our security measures do not provide full effective protection from all such events. There can be no assurance that we have the capability to detect all vulnerabilities or new attack methods and our internal security controls may not keep pace with quickly evolving threats. The costs to prevent, eliminate, mitigate or remediate cybersecurity or other security problems and vulnerabilities are significant and may reduce our margins. Breaches of our security measures and the accidental loss, inadvertent disclosure or unauthorized dissemination of proprietary information or sensitive, personal or confidential data about us, our employees, our customers or their end users, including the potential loss or disclosure of such information or data have in the past, and could in the future, expose us, our employees, our customers or other individuals affected to a risk of loss or misuse of this information. Further, our efforts to address these problems, including notifying affected third parties when appropriate, have in the past been, and may in the future be, unsuccessful or delayed, which could result in business interruptions, cessation of service, loss of existing or potential customers and reputational harm. Actual or perceived security vulnerabilities or incidents have resulted in, and may result in additional, claims or litigation and liability or fines, costly and time-intensive notice requirements, governmental inquiry or oversight or a loss of customer confidence, any of which have in the past and may in the future harm our business and damage our brand and reputation. Our customers may also adopt security measures to protect their computer systems and their instances of our software from attack and may suffer a cybersecurity breach on their own systems, unrelated to our 21

•costs and delays associated with developing products in multiple languages; and •operating in locations with a higher rate of corruption and fraudulent business practices. Additionally, third parties we do business with and our customers have international operations and are also subject to the above risks. Adverse changes in global economic conditions, including, but not limited to recessions or slow economic growth have in the past resulted and may in the future result in our customers' and business partners' insolvency, inability to obtain credit to finance or purchase our solutions, or a delay in paying or an inability to pay their obligations to us. Other third parties, such as our service providers, suppliers and distributors, may be unable to deliver or be delayed in delivering critical services, products or technologies that we rely on, and our business and reputation may be harmed. Our customers' spending rate, ability to pay and demand for our solutions may also be adversely affected by the above risks. If our global sales are reduced, delayed or canceled because of any of the above risks, our revenue may decline. Further, a disruption in global financial markets could impair our banking partners, on which we rely for operating cash management, capital market transactions and derivative programs. Such disruption could also negatively impact our customers' ability to pay us due to delays or inability to access their existing cash. As of November 28, 2025, our investment portfolio consisted of money market funds, corporate debt securities, U.S. Treasury securities, time deposits and other investments. These investments are subject to credit, liquidity, market, and interest rate risks as well as economic downturns or events that affect global or regional financial markets that may cause the value of our investments to decline, requiring impairment charges, which could adversely affect our financial condition.

Risks Related to Laws and Regulations We are, and may in the future become, subject to litigation, regulatory inquiries, investigations and other actions, which could result in an unfavorable outcome and have an adverse effect on our business, financial condition, results of operations and cash flows. We are, and may in the future become, subject to various legal proceedings (including class action lawsuits), claims, negotiations, regulatory inquiries, investigations, enforcement actions and other actions, including relating to antitrust, consumer protection, data privacy and security, employment practices, product liability and the validity or alleged infringement of third-party intellectual property rights, including patent rights, among others. Such activity has increased over time with evolving global regulatory and enforcement landscapes and as our solutions have become more available to, and used by, more enterprises and consumers worldwide. For example, there is an increase in regulatory activity in connection with federal and state consumer protection laws, including some suits which seek civil penalties. Any proceedings, actions, claims or inquiries initiated by or against us, whether successful or not, may be highly time consuming; result in costly litigation, damage awards, consent decrees, injunctive relief or increased costs of business; require us to change our business practices or products; result in negative publicity; require significant amounts of management time; result in the diversion of significant operational resources; or otherwise harm our business and financial results. Disputes and litigation can be complex and are typically costly and can be disruptive to our business operations by diverting the attention of management and key personnel. For example, third-party intellectual property disputes, including those initiated by patent assertion entities or competitors, could subject us to significant liabilities, require us to enter into royalty and licensing arrangements on unfavorable terms, prevent us from offering certain solutions, subject us to injunctions restricting our sales, cause severe disruptions to our operations or the markets in which we compete, or require us to satisfy indemnification commitments with our customers, including contractual provisions under various license arrangements and service agreements. In addition, we have incurred, and may in the future incur, significant costs in acquiring the necessary third-party intellectual property rights for use in our products, in some cases to fulfill contractual obligations with our customers. Any of these occurrences could significantly harm our business. We have not prevailed, and may not in the future prevail, in every lawsuit or dispute. For further information about specific litigation and proceedings, see the section titled "Legal Proceedings" contained in Part II, Item 8, Note 16 of our Notes to Consolidated Financial Statements of this report.

We are subject to risks associated with compliance with laws and regulations globally, which may harm our business. We are a global company subject to varied and complex laws, regulations, government actions and customs, both domestically and internationally. These local, state, federal and international laws and regulations relate to a number of aspects of our business, including trade laws such as import and export controls, anti-boycott, economic sanctions and embargoes, data and transaction processing security, payment card industry data security standards, antitrust and competition, consumer protection, records management, user-generated content hosted on websites we operate, privacy practices, data residency and transfer, AI, corporate governance, employment practices, immigration, employee and third-party complaints, anti-corruption, conflicts of interest, securities regulations, sustainability and other regulatory requirements affecting trade and investment. The application of these laws and regulations to our business is often unclear and evolving, and may at times conflict. Further, we are subject to the U.S. Foreign Corrupt Practices Act and other anti-corruption and anti-bribery laws, which may conflict with local customs and practices in other foreign countries, particularly those with developing economies where it is common to engage in practices that would be prohibited under such laws. We cannot provide assurance that our employees, contractors, agents, business partners and vendors will not take actions in violation of our internal policies, U.S. laws or other applicable international laws. Compliance with the above laws and regulations may involve significant costs or require additional changes to our business practices that result in reduced revenue and profitability. Non-compliance could also result in fines, damages, criminal sanctions against us, our officers or our employees, prohibitions on the conduct of our business and damage to our reputation. In addition, approximately 50% of our employees are located outside the United States. Accordingly, we are exposed to changes in laws governing our employee relationships in various U.S. and foreign jurisdictions, including laws and regulations regarding wage and hour requirements, fair labor standards, employee data privacy, unemployment tax rates, workers' compensation rates, citizenship requirements, immigration and payroll and other taxes, which likely would have a direct impact on our operating costs. 24 Increasing regulatory focus on privacy and security issues and expanding laws and regulatory requirements could impact our business models and expose us to increased liability. We are subject to global data protection, privacy and security laws, regulations and codes of conduct that relate to our various business units and data processing activities, which may include sensitive, confidential, and personal information. These laws, regulations and codes are increasing in number, expanding in scope, inconsistent across jurisdictions and subject to evolving and differing (sometimes conflicting) interpretations. Government officials and regulators, privacy advocates and class action attorneys are increasingly scrutinizing how companies collect, process, use, store, share and transmit personal data, including the transferring of personal information across international borders. This scrutiny can result in new and shifting interpretations of existing laws, thereby further impacting our business. For example, European data transfers outside the European Economic Area are highly regulated and litigated. The mechanisms that we and many other companies rely upon for European data transfers (for example, Standard Contractual Clauses and the EU - US Data Privacy Framework) are the subject of legal challenge, regulatory interpretation and judicial decisions by the Court of Justice of the European Union. Certain other countries in which we do business have also established specific legal requirements for cross-border transfers of personal information and data localization. If these or other countries implement more restrictive regulations for cross-border data transfers or do not permit data to leave the country of origin, such developments could adversely impact our business and our enterprise customers' business, our financial condition and our results of operations in those jurisdictions. We may be subject to certain aspects of the EU's Digital Services Act, which imposes additional legal requirements on certain types of digital service providers, including online platforms and content sharing sites. Moreover, some of our customers are subject to the EU's Digital Operational Resilience Act and similar UK regulatory requirements on operational resilience. There may be certain aspects of the EU's Data Act that could apply to certain types of cloud services providers and require them to facilitate data portability (e.g., switching between services), as well as certain requirements concerning cross border international transfers of, and governmental access to, non-personal information outside of the European Economic Area. Further, the U.S. Department of Justice issued a rule entitled Preventing Access to U.S. Sensitive Personal Data and Government-Related Data by Countries of Concern or Covered Persons, which placed additional restriction on certain data transactions involving countries of concern and covered individuals that may impact certain business activities, and has impacted the transfer of data in connection with certain transactions.

We are subject to risks associated with compliance with laws and regulations globally, which may harm our business. We are a global company subject to varied and complex laws, regulations and customs, both domestically and internationally. These local, state, federal and international laws and regulations relate to a number of aspects of our business, including trade laws such as import and export controls, anti-boycott, economic sanctions and embargoes, data and transaction processing security, payment card industry data security standards, consumer protection, records management, user-generated content hosted on websites we operate, privacy practices, data residency, AI regulations, corporate governance, antitrust and competition, employee and third-party complaints, anti-corruption, conflicts of interest, securities regulations and other regulatory requirements affecting trade and investment. The application of these laws and regulations to our business is often unclear and evolving, and may at times conflict. Further, we are subject to the U.S. Foreign Corrupt Practices Act and other anti-corruption and anti-bribery laws, which may conflict with local customs and practices in other foreign countries, particularly those with developing economies where it is common to engage in practices that would be prohibited under such laws. We cannot provide assurance that our employees, contractors, agents, business partners and vendors will not take actions in violation of our internal policies, U.S. laws or other applicable international laws. Compliance with the above laws and regulations may involve significant costs or require additional changes to our business practices that result in reduced revenue and profitability. Non-compliance could also result in fines, damages, criminal sanctions against us, our officers or our employees, prohibitions on the conduct of our business and damage to our reputation. In addition, approximately 50% of our employees are located outside the United States. Accordingly, we are exposed to changes in laws governing our employee relationships in various U.S. and foreign jurisdictions, including laws and regulations regarding wage and hour requirements, fair labor standards, employee data privacy, unemployment tax rates, workers' compensation rates, citizenship requirements and payroll and other taxes, which likely would have a direct impact on our operating costs. Increasing regulatory focus on privacy and security issues and expanding laws and regulatory requirements could impact our business models and expose us to increased liability. We are subject to global data protection, privacy and security laws, regulations and codes of conduct that relate to our various business units and data processing activities, which may include sensitive, confidential, and personal information. These laws, regulations and codes are inconsistent across jurisdictions and are subject to evolving and differing (sometimes conflicting) interpretations. Government officials and regulators, privacy advocates and class action attorneys are increasingly scrutinizing how companies collect, process, use, store, share and transmit personal data, including the transferring of personal information across international borders. This scrutiny can result in new and shifting interpretations of existing laws, thereby further impacting our business. For example, European data transfers outside the European Economic Area are highly regulated and litigated. The mechanisms that we and many other companies rely upon for European data transfers (for example, Standard Contractual Clauses and the EU - US Data Privacy Framework) are the subject of legal challenge, regulatory interpretation and judicial decisions by the Court of Justice of the European Union. Several other countries, including but not limited to the United States, China, Australia, New Zealand, Brazil, Kingdom of Saudi Arabia, Hong Kong and Japan, have also established specific legal requirements for cross-border transfers of personal information and certain countries have also established specific legal requirements for data localization (such as where personal data must remain stored in the country). If other countries implement more restrictive regulations for cross-border data transfers or do not permit data to leave the country of origin, such developments could adversely impact our business and our enterprise customers' business, our financial condition and our results of operations in those jurisdictions. Additionally, the General Data Protection Regulation in the European Economic Area and the United Kingdom continues to be interpreted by European and UK courts in novel ways leading to shifting requirements, country-specific differences in application and uncertain enforcement priorities. Laws in Asia, such as the Personal Information Protection Law in China and developing laws in India, as well as state laws in the United States on privacy, data and related technologies, such as the California Consumer Privacy Act, the California Privacy Rights Act, the Colorado Privacy Act and the Virginia Consumer Data Protection Act, as well as industry self-regulatory codes and regulatory requirements, create additional privacy and security compliance obligations and expand the scope of potential liability, either jointly or severally with our customers and suppliers. Further, the U.S. Securities and Exchange Commission's Rules on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure requires us to make certain disclosures related 30

General Risk Factors Catastrophic events, including events associated with climate change, may disrupt our business and adversely affect our financial condition and results of operations. Our business relies on our network infrastructure and enterprise Apps, internal technology systems and websites. A disruption, infiltration or failure of our systems, data centers or operations, or those of our third-party service providers due to a major earthquake, other natural disasters, including climate-related events (such as drought, water security, heat waves, cold waves, wildfires and poor air quality), power shutoff or loss, telecommunications failure, epidemic, pandemic, war, terrorist attack or other catastrophic event, could cause interruptions to our systems and business operations, damage to critical infrastructure, loss of intellectual property, data security breaches and data loss. Our corporate headquarters, significant research and development activity, certain of our data centers and other critical business operations are in the San Francisco Bay Area and the Salt Lake Valley Area, both of which are near major earthquake faults. Climate-related catastrophic events that may harm our business are also increasing in frequency and severity. A catastrophic event, particularly one that may disrupt our data centers or our critical activities, could prevent us from conducting normal business operations and providing our products, services and solutions, which could adversely affect our business. A catastrophic event could negatively impact a country or region in which we sell and, in turn, decrease demand for our products, services and solutions, which could negatively impact our business. Laws, regulations and policies relating to environmental, social, and governance are expanding globally. We may be subject to additional climate-related regulations and reporting requirements in the future, as well as changing market dynamics and stakeholder expectations regarding climate change and our environmental impacts. Compliance with such regulations, investments in our environmental, social and governance commitments, may involve significant costs and negatively impact our business, financial condition and results of operations. Additionally, we may experience reputational harm from our actual or perceived failure to meet our environmental, social and governance commitments. 33 The occurrence of an epidemic or a pandemic, such as the COVID-19 pandemic, has had, and may in the future, have an adverse effect on our operating results. The extent to which epidemics and pandemics impact our financial condition or results of operations will depend on many factors outside of our control and whether there is a material impact on the businesses or productivity of our customers, employees, suppliers and other partners. A global pandemic may also intensify the other risks described in this Part I, Item 1A of this report.

Some of our enterprise offerings have extended and complex sales cycles, which may increase our costs and make our sales cycles unpredictable. As we continue to target enterprise customers for certain of our offerings, including Adobe Experience Cloud in our Digital Experience business and our Enterprise Term License Agreements in our Digital Media business, we may face increased costs, longer sales cycles, greater competition and less predictability in completing our sales. For our enterprise customers, the 28 evaluation process may be longer and more involved, and require us to invest more in educating our customers about our products, services and solutions, particularly because the decision to use our products, services and solutions is often an enterprise-wide decision. We are increasingly offering end-to-end solutions that include cross-cloud and generative AI capabilities, which have in the past, and may in the future, increase the complexity of technical or contractual assurances or requirements that we or our customers require as part of the contracting process, leading to extended sales cycles. We may be required to submit more robust proposals, participate in extended proof-of-concept evaluation cycles and engage in more extensive contract negotiations. In addition, our enterprise customers often demand more complex configurations and additional integration services and product features. Adverse macroeconomic conditions have caused, and may continue to cause, additional spend scrutiny and delays in our enterprise customers' purchasing decisions. Due to these factors, we often must devote greater sales support to certain enterprise customers, which increases our costs and time required to complete a sale, without assurance that potential customers will ultimately purchase our solutions. We also may be required to devote more services resources to implementation, which increases our costs, without assurance that customers receiving these services will renew or renew at the same level. Since the sales cycles for our enterprise offerings are multi-phased and complex, it is often unpredictable when a given sales cycle will close. Our revenue from enterprise customers may be affected by longer-than-expected sales, contract negotiation and implementation cycles, extended collection cycles, potential deferral of revenue and alternative licensing arrangements. Additionally, our enterprise sales pattern has historically been, and is expected to remain, uneven, where a higher percentage of a quarter's total sales occur during the final weeks of each quarter, which is common in our industry. If we are unable to recruit and retain key personnel, our business may be harmed, and our hybrid work model may present challenges, which could adversely impact our business. Much of our future success depends on the continued service, availability and performance of our senior management and highly skilled personnel across all levels of our organization. Our senior management has acquired specialized knowledge and skills with respect to our business, and the loss of any of these individuals could harm our business, especially if we are not successful in developing adequate succession plans. Our efforts to attract, develop, integrate and retain highly skilled employees may be compounded by intensified restrictions on immigration or the availability of work visas. The technology industry has been and may continue to be subject to substantial and continuous competition for talent, particularly with AI and cybersecurity backgrounds, and demand for cutting-edge or unique skill sets may continue to be highly competitive, both of which are heightened with hybrid or remote working arrangements. Our hybrid work environment may also present operational, security and workplace culture challenges, which could negatively affect our ability to execute against our business objectives and retain and recruit personnel. We have experienced, and may continue to experience, higher compensation costs to retain and recruit senior management or highly skilled personnel that may not be offset by innovation, improved productivity or increased sales. We continue to hire personnel in countries where exceptional technical knowledge and other expertise are offered at lower costs, which increases the efficiency of our global workforce structure and reduces our personnel-related expenditures. Nonetheless, as globalization continues, competition for talent in those countries has increased, which may impact our ability to retain these employees and increase our compensation-related expenses.

Our existing and future debt obligations may adversely affect our financial condition and future financial results. As of December 1, 2023, we had $3.65 billion in senior unsecured notes outstanding and a $3 billion commercial paper program with no amounts outstanding. We also had a $1.5 billion senior unsecured revolving credit agreement and $3.5 billion delayed draw term loan agreement, both of which were undrawn. Subsequent to December 1, 2023, the delayed draw term loan agreement was terminated. This debt or future additional indebtedness may adversely affect our financial condition and future financial results by, among other things: •requiring the dedication of a portion of our expected cash flows from operations to service our debt, thereby reducing the amount of expected cash flows available for other purposes, including capital expenditures and acquisitions;

We contract with a number of software distributors and other third parties to distribute our products, services and solutions, none of which are individually responsible for a material amount of our total net revenue in any recent period. Successfully managing our distribution channels and sales partners to reach various customers for our products, services and solutions is a complex and global process. If an agreement with one of our distributors or partners was terminated, any prolonged delay in securing a replacement distributor or partner could have a negative impact on our results of operations. We also face legal risk and potential reputational harm from the activities of these independent third parties including, but not limited to, export control violations, workplace conditions, corruption and anti-competitive behavior. If our partner and distribution channels are not effective or if we stop or change our partner or distribution channels, we may lose sales opportunities, customers and revenue. We rely on third-party distribution platforms and are subject to changes in pricing structure, terms of service, privacy practices and other policies at the discretion of the platform provider. Any adverse changes to the terms with such third-party distribution platforms which we rely on to distribute our products, services and solutions may adversely affect our financial results. Additionally, our distribution channels may not continue to market or sell our products, services and solutions effectively and may favor products, services and solutions of other companies. We sell many products, services and solutions through our direct sales force. Risks associated with this sales channel include challenges related to hiring, retaining and motivating our direct sales force, and substantial amounts of ongoing training for sales representatives. Our business could be harmed if our direct sales expansion efforts do not generate the corresponding efficiencies and revenue we anticipated from such investment. In addition, the loss of key sales employees could impact our customer relationships and future ability to sell to certain accounts covered by such employees. 26 We rely on third-party service providers and technologies to deliver our products, services and business operations and to operate critical business systems, such as cloud-based infrastructure, data center facilities, encryption and authentication technology and company email, communications with customers. If such third parties are negatively affected, if we fail to effectively develop, manage and maintain our relationships with such third parties, or if we are unable to renew our agreements with them on favorable terms or at all, our expenses could significantly increase, and we and our customers may experience service interruptions. Any disruption or damage to, or failure of our systems generally, including the systems of our third-party platform providers, could result in interruptions in our services and harm our business. Further, interruptions in our services caused by us or our third-party service providers may cause us to issue credits or pay penalties, cause customers to make warranty or other claims against us or to terminate their subscriptions or contracts, and adversely affect our attrition rates and our ability to attract new customers, all of which may adversely affect our financial results. Our business and reputation would also be harmed if our customers and potential customers believe our services are unreliable. We face various risks associated with our operating as a multinational corporation, and global adverse economic conditions may harm our business and financial condition. We derive a large portion of our total revenue from, and have significant operations, outside of the United States. As a multinational corporation, we are subject to a number of risks, including from global adverse economic conditions, that are uncertain and beyond our control and that make forecasting operating results and decisions about future investments difficult, such as: •inflation and actions taken by central banks to counter inflation, including increasing interest rates; •international and regional economic, political and labor conditions, including any instability or security concerns abroad, such as uncertainty caused by economic sanctions, downturns and recessions, trade disputes, armed conflicts and wars; •tax laws (including U.S. taxes on foreign subsidiaries); •increased financial accounting and reporting burdens and complexities; •changes in, or impositions of, legislative or regulatory requirements, including antitrust and competition regulations; •changes in laws governing the free flow of data across international borders; •inadequate local infrastructure and difficulties in managing and staffing international operations; •costs, potential liability, delays or loss of sales resulting from trade restrictions imposed by the United States and other countries, as well as trade laws, including but not limited to economic sanctions and export controls;

•costs and delays associated with developing products in multiple languages; and •operating in locations with a higher rate of corruption and fraudulent business practices. Additionally, third parties we do business with and our customers have international operations and are also subject to the above risks. Adverse changes in global economic conditions have in the past resulted and may in the future result in our customers' and business partners' insolvency, inability to obtain credit to finance or purchase our products, services and solutions, or a delay in paying or an inability to pay their obligations to us. Other third parties, such as our service providers, suppliers and distributors, may be unable to deliver or be delayed in delivering critical services, products or technologies that we rely on, and our business and reputation may be harmed. Our customers' spending rate and demand for our products, services and solutions may also be adversely affected by the above risks. If our global sales are reduced, delayed or canceled because of any of the above risks, our revenue may decline. Further, a disruption in global financial markets could impair our banking partners, on which we rely for operating cash management, capital market transactions and derivative programs. Such disruption could also negatively impact our customers' ability to pay us due to delays or inability to access their existing cash. As of December 1, 2023, our investment portfolio consisted of asset-backed securities, corporate debt securities, money market funds, time deposits, U.S. agency securities and U.S. Treasury securities. These investments are subject to credit, liquidity, market, and interest rate risks as well as economic downturns or events that affect global or regional financial markets that may cause the value of our investments to decline, requiring impairment charges, which could adversely affect our financial condition. 27 If we are unable to recruit and retain key personnel, our business may be harmed, and our hybrid work model may present challenges, which could adversely impact our business. Much of our future success depends on the continued service, availability and performance of our senior management and highly skilled personnel across all levels of our organization. Our senior management has acquired specialized knowledge and skills with respect to our business, and the loss of any of these individuals could harm our business, especially if we are not successful in developing adequate succession plans. Our efforts to attract, develop, integrate and retain highly skilled employees may be compounded by intensified restrictions on travel, immigration or the availability of work visas. The technology industry is often subject to substantial and continuous competition for talent, particularly with cybersecurity and AI backgrounds, and demand for cutting-edge or unique skill sets can be highly competitive, both of which are heightened with the increased availability of hybrid or remote working arrangements. We face an increasingly difficult challenge to attract and retain highly qualified security personnel to assist us in combating security threats. We may experience higher compensation costs to retain and recruit senior management and highly skilled personnel that may not be offset by improved productivity or increased sales. Our hybrid work environment may also present operational and workplace culture challenges, which could negatively affect our ability to execute against our business objectives and retain and recruit personnel. We continue to hire personnel in countries where exceptional technical knowledge and other expertise are offered at lower costs, which increases the efficiency of our global workforce structure and reduces our personnel-related expenditures. Nonetheless, as globalization continues, competition for talent in those countries has increased, which may impact our ability to retain these employees and increase our compensation-related expenses.

Risks Related to Our Ability to Grow Our Business We may be unsuccessful at innovating in response to rapid technological or industry changes to meet customer needs, which could cause our operating results to suffer. We operate in rapidly evolving industries and expect the pace of innovation to continue to accelerate. We must continually introduce new, and enhance existing, products, services and solutions to retain customers and attract new customers. Developing new products, services and solutions is complex, requires significant investment and operational costs and may not be profitable, and our investments in new technologies are speculative and may not yield the expected business or financial benefits. The commercial success of new or enhanced products, services and solutions depends on a number of factors, including timely and successful development; effective distribution and marketing; market acceptance; compatibility with existing and emerging standards, platforms, software delivery methods and technologies; accurately predicting and anticipating customer needs and expectations and the direction of technological change; identifying and innovating in the right technologies; and differentiation from other products, services and solutions. If we fail to anticipate or identify technological, creative or marketing trends or fail to devote appropriate resources to adapt to such trends, our business could be harmed. For example, generative artificial intelligence technologies enable users of all skill levels to create and provide new ways of marketing, creating content and interacting with documents, which could significantly disrupt industries in which we operate and our existing products, services and solutions and our business may be harmed if we fail to invest or adapt. While we have released new generative artificial intelligence products, such as Adobe Firefly, and are focused on enhancing the artificial intelligence ("AI") capabilities of our products and incorporating AI across existing products, services and solutions, there can be no assurance that our new or enhanced products and AI innovations will be successful, adopted or monetizable or that we will innovate effectively to keep pace with the rapid evolution of AI across our offerings. If we do not successfully innovate, adapt to rapid technological or industry changes and meet customer needs, our business and our financial results may be harmed. Issues relating to the development and use of AI, including generative AI, in our offerings may result in reputational harm, liability and adverse financial results. Social, ethical and operational issues relating to the use of AI, including generative AI, in our offerings may result in reputational harm, liability and additional costs. We are increasingly incorporating AI technologies, developed by us and by third parties, into many of our offerings. If our AI development, deployment, content labeling or governance is ineffective or inadequate, it may result in incidents that impair the public acceptance of AI solutions or cause harm to individuals, customers or society, or result in our offerings not working as intended or producing unexpected outcomes. Jurisdictions around the world are developing and passing new regulations that apply specifically to the use of AI. For example, the EU AI Act was adopted in 2024 and will be implemented in phases through 2030, and other jurisdictions are considering similarly focused legislation. These regulations and the evolving AI regulatory environment may, among other impacts, result in inconsistencies among AI regulations and frameworks across jurisdictions, increase our compliance, governance and research and development costs, increase our exposure to claims related to our AI models and increase liability related to the use of AI by our customers or users that are beyond our control. While we have taken a responsible approach to the development and use of AI, such as in our Adobe Firefly offerings, there can be no guarantee that future AI regulations will not adversely impact us or conflict with our approach to AI, including affecting our ability to make our AI offerings available without costly changes, delaying or halting development of AI offerings, requiring us to change our AI development practices, monetization strategies and/or indemnity protections and subjecting us to additional compliance requirements, regulatory action, competitive harm, reputational harm and/or legal liability. To the extent we rely on third-party AI models in our products, services and solutions, we will face risks inherent in how those models have been developed and deployed, including situations in which the third party may lack a proper license or consent for the training data used for their model. In addition, new competition regulations on AI development and deployment could impose new requirements on our markets that could impact our business and financial results. Uncertainty around new and evolving AI uses may require significant, additional investment to develop models and proprietary datasets, responsible-use frameworks and new approaches and processes to attribute or compensate content creators. We have experienced, and may in the future experience, challenges accessing AI models, datasets or hardware. Developing, testing and deploying AI systems may also increase the cost of our offerings, including due to the nature of the computing costs

Our stock price may be volatile and your investment could lose value. Our stock price has been and may continue to be volatile and subject to fluctuations. All factors described in this Part I, Item 1A of this report, some of which are beyond our control, may affect our stock price, including: •shortfalls in our results or shortfalls, changes to estimates, recommendations or expectations in guidance we provide or provided by financial analysts about our revenue, margins, earnings, annualized recurring revenue, growth rates or other key performance metrics; •changes in investor and analyst valuation models for our stock; •changes in unearned revenue, remaining performance obligations and revenue recognized at a point in time, all of which may impact implied growth rates; •developments related to products or services, technological advancements, strategic alliances, acquisitions or significant transactions by us or our competitors; •changes in the amounts or frequency of stock repurchases; •the loss of large customers or our inability to retain or increase sales to existing customers or attract new customers; •changes to our management team, including recruitment or departure of key personnel; •variations in our or our competitors' results of operations, changes in the competitive landscape generally and developments in our industry;

We participate in rapidly evolving and intensely competitive markets, and, if we do not compete effectively, our operating results could suffer. The markets for our products, services and solutions are rapidly evolving and intensely competitive. We expect competition to continue to intensify. Our numerous competitors range in size from diversified global companies with significant sales and research and development resources, broad brand awareness, long operating histories or access to large customer bases to small companies whose specialized focuses may allow them to more easily and effectively deploy technical, marketing and financial resources. Our competitors may develop or acquire products, services or solutions that are similar to ours or that achieve greater or faster acceptance, may undertake more far-reaching and successful product development efforts or marketing campaigns or may adopt more aggressive pricing policies. As a result, current and potential customers may select the products, services or solutions of our competitors. Further, our future success depends on our continued ability to effectively appeal to businesses and consumers. New industry standards, evolving distribution models, limited barriers to entry, short product life cycles, customer price sensitivity, global market conditions and the frequent entry of new products or competitors may increase downward pressure on pricing and gross margins and adversely affect our renewal, upsell and cross-sell rates as well as our ability to attract new customers. In addition, we expect to face more competition as AI continues to advance and be integrated into the markets in which we compete. Our competitors or other third parties may incorporate AI into their offerings more successfully and efficiently than we do and achieve greater and faster adoption, which could impair our ability to compete effectively and adversely affect our business and financial results. Other companies have, or in the future may obtain, proprietary rights that would prevent, limit or interfere with our ability to make, use or sell our AI offerings. Further, we expect AI offerings to be highly competitive and rapidly evolving. For example, we face increasing competition from companies offering generative AI capabilities, including text-to-image, text-to-video and multi-modal offerings that compete directly with our creative offerings. If we are not able to provide products, services and solutions that compete effectively, we could experience reduced sales and our business could be adversely affected. For additional information regarding our competition and the risks arising out of the competitive environment in which we operate, see the section titled "Competition" contained in Part I, Item 1 of this report.

•general economic, political or market conditions; and •other events, such as significant litigation and regulatory actions and media and social media scrutiny. In addition, the market for technology stocks or the stock market in general has experienced, and may in the future experience, extreme fluctuations, which has caused, and may in the future cause, our stock price to decline for reasons unrelated to our financial performance. Volatility in our stock price has increased, and may continue to increase, our susceptibility to securities class action litigation, which could result in substantial costs and divert management's attention and resources, which may adversely affect our business.

If our reputation or our brands are damaged, our business and financial results may be adversely affected. We believe our reputation and brands have been, and we expect them to continue to be, important to our business and financial results. Maintaining and enhancing our brands may require us to make substantial investments and these investments may not be successful. We have experienced, and may in the future experience, reputational harm from, among other things, the introduction of new products, features, services, or terms that do not meet customer expectations; our position on or approach to new and evolving technologies, including AI; backlash from customers, the creative community, government entities or other stakeholders that disagree with our product offering decisions or public policy, ethical or political positions; significant litigation or regulatory actions that negatively reflect on our business practices; data security breaches or compliance failures; and public scrutiny or negative publicity, including being the target of media and social media campaigns, criticizing our actual or perceived actions or inactions, policies, terms, agreements, handling of user privacy, data practices or content. Further, our brands may be negatively affected by uses of our products, services or solutions, particularly our AI offerings, in ways that are out of our control, such as to create or disseminate content that is deemed to be misleading, deceptive or intended to manipulate public opinion, or for illicit, objectionable or illegal ends, or by our failure to respond appropriately and in a timely manner to such uses. Such uses may result in controversy or claims related to defamation, rights of publicity, illegal content, intellectual property infringement, harmful content, misinformation and disinformation, harmful bias, misappropriation, data privacy, derivative uses of third-party AI and personal injury torts. If we fail to appropriately respond to objectionable content created using our products, services or solutions or shared on our platforms, our users may lose confidence in our brands. Entry into markets with weaker protection of brands or changes in the legal systems in countries in which we operate may also impact our ability to protect our brands. If we fail to maintain, enhance or protect our brands, or if we incur excessive expenses in our efforts to do so, our users' trust in us and purchasing decisions and our business and financial results may be adversely affected. 24

Cybersecurity incidents can be caused by human error from our workforce or that of our third-party service providers, by malicious third parties, acting alone or in groups, or by more sophisticated organizations, including nation-states and state-sponsored organizations. Such risks may be elevated in connection with geopolitical tensions, including the Russia-Ukraine war and the conflict in the Middle East. Certain unauthorized parties have in the past managed, and may in the future manage, to overcome our security measures and those of our third-party service providers to access and misuse systems and software by exploiting defects in design or manufacture, including bugs, vulnerabilities and other problems that unexpectedly compromise the security or operation of a product or system. Further, unauthorized parties may also gain physical access to our facilities and infiltrate our information systems or attempt to gain logical access to our products, services or information systems to access content and data and may result in computer viruses, worms, ransomware or other malware. Malicious third parties have in the past, and may in the future, fraudulently induce our employees or users of our products, services or solutions to disclose sensitive, personal or confidential information via illegal electronic spamming, phishing, social engineering or other tactics, and this risk is heightened in our current hybrid model working environment. Malicious actors may also engage in fraudulent or abusive activities through our products, services and solutions, including unauthorized use of accounts through stolen credentials, use of stolen credit cards or other payment vehicles, failure to pay for services accessed, or other activities that 26 violate our terms of service. While we actively combat such fraudulent activities, we have experienced, and may in the future experience, impacts to our revenue from such activities. Maintaining the security of our products, services and solutions is a critical issue for us and our customers. We devote significant resources to address security vulnerabilities through various methods, including, but not limited to, engineering more secure products, enhancing security and reliability features in our products and systems, regularly reviewing our service providers' security controls, and continually assessing and improving, as appropriate, our incident response process. However, it is impossible to accurately predict the extent, frequency or impact cybersecurity issues may have on us, and our security measures do not provide full effective protection from all such events. The costs to prevent, eliminate, mitigate or remediate cybersecurity or other security problems and vulnerabilities are significant and may reduce our margins. Breaches of our security measures and the accidental loss, inadvertent disclosure or unauthorized dissemination of proprietary information or sensitive, personal or confidential data about us, our employees, our customers or their end users, including the potential loss or disclosure of such information or data have in the past, and could in the future, expose us, our employees, our customers or other individuals affected to a risk of loss or misuse of this information. Further, our efforts to address these problems, including notifying affected third parties when appropriate, have in the past been, and may in the future be, unsuccessful or delayed, which could result in business interruptions, cessation of service, loss of existing or potential customers and reputational harm. Actual or perceived security vulnerabilities or incidents have resulted in, and may result in additional, claims or litigation and liability or fines, costly and time-intensive notice requirements, governmental inquiry or oversight or a loss of customer confidence, any of which could harm our business and damage our brand and reputation. Our customers may also adopt security measures to protect their computer systems and their instances of our software from attack and may suffer a cybersecurity breach on their own systems, unrelated to our systems. Even if such breach is unrelated to our security systems, solutions or programs, such breach could cause us reputational harm and require us to incur significant economic and operational consequences to adequately assess and respond to their breach, and to implement additional safeguards designed to protect against future breaches. While we maintain insurance to cover operational risks, such as cybersecurity risk and technology outages, our insurance may not be sufficient to cover all liability described herein. These risks will likely increase as we expand our hosted offerings, integrate our products, services and solutions and store and process more data. Moreover, delayed sales, lower margins or lost customers resulting from disruptions caused by cyberattacks, overly burdensome preventative security measures or failure to fully meet information security control certification requirements could materially and adversely affect our financial results, stock price and reputation. If we are unable to develop, manage and maintain critical third-party relationships, such as our sales, partner and distribution channels, suppliers and service providers, our revenue and business may be adversely affected. We rely on a number of third-party distributors and sales partners to distribute our products, services and solutions. The successful management of such third-party relationships is a complex, global process. If an agreement with one of our distributors or partners was terminated, any prolonged delay in securing a replacement distributor or partner could have a negative impact on our results of operations. We also face legal risk and potential reputational harm from the activities of these independent third parties including, but not limited to, export control violations, workplace conditions, corruption and anti-competitive behavior.

ITEM 1A. RISK FACTORS As previously discussed, our actual results could differ materially from our forward-looking statements. Below we discuss some of the factors that could cause these differences. The occurrence of these and many other factors described in this report, and factors that we do not presently know or that we currently believe to be immaterial, could materially and adversely affect our operations, performance and financial condition. Many factors affect more than one category and the factors are not in order of significance or probability of occurrence because they have been grouped by categories.

Contracting with government entities exposes us to additional risks inherent in the government procurement process. We provide products, services and solutions, directly and indirectly, to a variety of domestic and foreign government entities, which introduces certain risks and challenges not present in private commercial agreements, including varying governmental budgeting processes, fluctuations due to government spending cuts and shutdowns, highly competitive and lengthy bidding process that may be subject to political influence and adherence to complex procurement regulations and other government-specific contractual requirements. We incur significant up-front time and costs without any assurance that we will win a contract. Operating within a highly regulated industry, we have been and may in the future be subject to audits and investigations relating to our government contracts and any violations could result in termination of contracts and various civil and criminal penalties and administrative sanctions, including payment of fines and suspension or debarment from future government business, as well as harm to our reputation and financial results. We have made, and may continue to make, significant investments to support future sales opportunities in various government sectors, including to obtain various security authorizations and certifications. Such processes are complex, lengthy and can often be delayed. Furthermore, requirements may change, or we may be unable to achieve or sustain one or more government authorizations or certifications, which could affect our ability to sell to government entities until we meet any revised requirements.

We are subject to fluctuations in foreign currency exchange rates and may not be able to effectively hedge our exposure. Our operating results and performance metrics are subject to fluctuations in foreign currency exchange rates due to the global scope of our business. Geopolitical and economic events, including war, trade disputes, economic sanctions and 31 emerging market volatility, and associated uncertainty have caused, and may in the future cause, currencies to fluctuate. Accordingly, amounts reported as annualized recurring revenue, a performance metric which we measure at currency rates that are set at the beginning of each fiscal year and held constant throughout the year, may vary from actual revenue recognized in accordance with generally accepted accounting principles in the United States. We attempt to mitigate a portion of these foreign currency exchange risks to our operating results through foreign currency hedging based on our judgment of the appropriate trade-offs among risk, opportunity and expense. We regularly review our hedging program and make adjustments that we believe are appropriate. Our hedging activities have not, and may not in the future, offset more than a portion of the adverse financial impact, including on our actual revenue recognized, resulting from unfavorable movement in foreign currency exchange rates, which could adversely affect our financial condition, business performance or results of operations.

•increasing our vulnerability to adverse changes in our business and general economic and industry conditions; and •limiting our ability to obtain future financing for working capital, capital expenditures, future acquisitions, general corporate or other purposes, which may also impact our ability to service and repay outstanding indebtedness as it becomes due. Our senior unsecured notes, commercial paper program and revolving credit agreement impose restrictions on us and require us to maintain compliance with specified covenants. Our ability to comply with these covenants may be affected by events beyond our control. If we breach any of the covenants and do not obtain a waiver from the noteholders or lenders, then, subject to applicable cure periods, any outstanding debt may be declared immediately due and payable. In addition, changes by any rating agency to our credit rating may negatively impact the value and liquidity of both our debt and equity securities, as well as the potential costs associated with a refinancing of our debt. Under certain circumstances, if our credit ratings are downgraded or other negative action is taken, the interest rate payable by us under our revolving credit agreement could increase. Downgrades in our credit ratings could also restrict our ability to obtain additional financing in the future and affect the terms of any such financing.

Risks Related to Laws and Regulations We are subject to risks associated with compliance with laws and regulations globally, which may harm our business. We are a global company subject to varied and complex laws, regulations and customs, both domestically and internationally. These laws and regulations relate to a number of aspects of our business, including trade compliance, import and export control, anti-boycott, economic sanctions and embargoes, data and transaction processing security, payment card industry data security standards, consumer protection, records management, user-generated content hosted on websites we operate, privacy practices, data residency, corporate governance, antitrust and competition, employee and third-party complaints, anti-corruption, gift policies, conflicts of interest, securities regulations and other regulatory requirements affecting trade and investment. The application of these laws and regulations to our business is often unclear and may at times conflict. For example, we are subject to the U.S. Foreign Corrupt Practices Act and other anti-corruption and anti-bribery laws, but in other foreign countries, particularly those with developing economies, it is common to engage in practices that would be prohibited under such acts. We cannot provide assurance that our employees, contractors, agents, business partners and vendors will not take actions in violation of our internal policies, U.S. laws or other applicable international laws. Compliance with these laws and regulations may involve significant costs or require changes in our business practices that result in reduced revenue and profitability. Non-compliance could also result in fines, damages, criminal sanctions against us, our officers or our employees, prohibitions on the conduct of our business and damage to our reputation. 28 In addition, approximately 50% of our employees are located outside the United States. Accordingly, we are exposed to changes in laws governing our employee relationships in various U.S. and foreign jurisdictions, including laws and regulations regarding wage and hour requirements, fair labor standards, employee data privacy, unemployment tax rates, workers' compensation rates, citizenship requirements and payroll and other taxes, which likely would have a direct impact on our operating costs. Increasing regulatory focus on privacy and security issues and expanding laws and regulatory requirements could impact our business models and expose us to increased liability. We are subject to global data protection, privacy and security laws, regulations and codes of conduct that relate to our various business units and data processing activities, which may include sensitive, confidential, and personal information. These laws, regulations and codes are inconsistent across jurisdictions and are subject to evolving and differing (sometimes conflicting) interpretations. Government officials and regulators, privacy advocates and class action attorneys are increasingly scrutinizing how companies collect, process, use, store, share and transmit personal data. This scrutiny can result in new and shifting interpretations of existing laws, thereby further impacting our business. For example, the General Data Protection Regulation ("GDPR") in the European Economic Area, and the United Kingdom continues to be interpreted by European and UK courts in novel ways leading to shifting requirements, country specific differences in application and uncertain enforcement priorities. More recently enacted laws, such as the Personal Information Protection Law in China, and new and emerging state laws in the United States on privacy, data and related technologies, such as the California Consumer Privacy Act, the California Privacy Rights Act, the Colorado Privacy Act and the Virginia Consumer Data Protection Act, as well as industry self-regulatory codes and regulatory requirements, create new privacy and security compliance obligations and expand the scope of potential liability, either jointly or severally with our customers and suppliers. As a security example, pursuant to the U.S. Securities and Exchange Commission's Rules on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure we are required to make certain disclosures related to material cybersecurity incidents and the reasonably likely impact of such an incident on Form 8-K and will be required to make certain other cybersecurity disclosures on Form 10-K. Determining whether a cybersecurity incident is notifiable or reportable may not be straightforward and any such mandatory disclosures could be costly and lead to negative publicity, loss of customer confidence in the effectiveness of our security measures, diversion of management's attention and governmental investigations.

Changes in tax rules and regulations or interpretations thereof may adversely affect our effective tax rates. We are a United States-based multinational company subject to tax in multiple domestic and foreign tax jurisdictions. Significant judgment is required in determining our current provision for income taxes and deferred tax assets or liabilities. Tax laws in the United States and in foreign tax jurisdictions are dynamic and subject to change as new laws are passed and new interpretations are issued. The applicability and impact of changes in tax laws and interpretations thereof could adversely affect our effective income tax rate and cash flows in future years. Unanticipated changes in our tax rates could affect our future results of operations. Our future effective tax rates are likely to be unfavorably affected by changes in the tax rates in jurisdictions where our income is earned, changes in jurisdictions in which our profits are determined to be earned and taxed, changes in the valuation of our deferred tax assets and liabilities, changes in or interpretation of tax rules and regulations in the jurisdictions in which we do business, or unexpected negative changes in business and market conditions that could reduce certain tax benefits. In addition, the United States and other countries and jurisdictions in which we conduct business, including those covered by governing bodies that enact tax laws applicable to us, such as the European Commission of the European Union, 29 could make changes to relevant tax, accounting or other laws and interpretations thereof that have a material impact to us. These countries, governmental bodies and intergovernmental economic organizations such as the Organization for Economic Cooperation and Development, have or could make unprecedented assertions about how taxation is determined and, in some cases, have proposed or enacted new laws that are contrary to the way in which rules and regulations have historically been interpreted and applied. In the current global tax policy environment, any changes in laws, regulations and interpretations could adversely affect our effective tax rates, cause us to respond by making changes to our business structure, or result in other costs to us which could adversely affect our operations and financial results. Moreover, we are subject to the examination of our income tax returns by domestic and foreign tax authorities. We regularly assess the likelihood of outcomes resulting from these examinations to determine the adequacy of our provision for income taxes and have reserved for potential adjustments that may result from these examinations. We believe our tax estimates to be reasonable; however, we cannot provide assurance that the final determination of any of these examinations will not have an adverse effect on our financial position and results of operations.

If our goodwill or amortizable intangible assets become impaired, then we could be required to record a significant charge to earnings. GAAP requires us to test for goodwill impairment at least annually. In addition, we review our goodwill and amortizable intangible assets for impairment when events or changes in circumstances indicate the carrying value may not be recoverable, including declines in stock price, market capitalization or cash flows, and slower growth rates in our industry. Depending on the results of our review, we could be required to record a significant charge to earnings in our consolidated financial statements during the period in which any impairment of our goodwill or amortizable intangible assets was determined, negatively impacting our results of operations. We have issued $4.15 billion of notes in debt offerings and may incur other debt in the future, which may adversely affect our financial condition and future financial results. We have $4.15 billion in senior unsecured notes and a $1.5 billion senior unsecured revolving credit agreement, which is currently undrawn. This debt may adversely affect our financial condition and future financial results by, among other things: •increasing our vulnerability to adverse changes in general economic and industry conditions; •requiring the dedication of a portion of our expected cash flows from operations to service our debt, thereby reducing the amount of expected cash flows available for other purposes, including capital expenditures and acquisitions; and

Risks Related to the Operation of Our Business Security breaches in data centers we manage, or third parties manage on our behalf, may compromise the confidentiality, integrity or availability of employee and customer data, which could expose us to liability and adversely affect our reputation and business. We process and store significant amounts of employee and customer data, a large volume of which is hosted by third-party service providers. A security incident impacting our own data centers or those controlled by our service providers may compromise the confidentiality, integrity or availability of this data. Unauthorized access to or loss or disclosure of data stored by Adobe or our service providers may occur through physical break-ins, breaches of a secure network by an unauthorized party, software vulnerabilities or coding errors, employee mistakes, theft or misuse or other misconduct. It is also possible that unauthorized access to or disclosure of employee or customer data may occur through inadequate use of security controls by customers, service providers or employees. The compromise of personal, confidential or proprietary information could cause a loss of data, disrupt our operations, damage our reputation, give rise to remediation or other expenses and subject us to claims or other liabilities, regulatory investigations or fines. Adobe maintains insurance to cover operational risks, such as cyber risk and technology outages, but this insurance may not cover all costs associated with the consequences of personal, confidential or proprietary information being compromised. Further, such perceived or actual unauthorized loss or disclosure of the information we collect, process or store, or breach of our security could damage our reputation, result in the loss of customers and harm our business. We rely on data centers managed both by Adobe and third parties to host and deliver our services, as well as access, collect, process, use, transmit and store data, and any interruptions or delays in these hosted services, or failures in data collection or transmission could expose us to liability and harm our business and reputation. Much of our business relies on hardware and services that are hosted, managed and controlled directly by Adobe or third-party service providers, including our online store at adobe.com and our Creative Cloud, Document Cloud and Experience Cloud solutions. We do not have redundancy for all of our systems, many of our critical applications reside in only one of our data centers, and our disaster recovery planning may not account for all eventualities. If our business relationship with a third-party provider of hosting or content delivery services is negatively affected, or if one of our content delivery suppliers were to terminate its agreement with us without adequate notice, we might not be able to deliver the corresponding hosted offerings to our customers, which could disrupt our business operations and those of our customers, subject us to reputational harm, costly and time-intensive notification requirements, and cause us to lose customers and future business. The COVID-19 pandemic has disrupted and may continue to disrupt the supply chain of hardware needed to maintain these third-party systems and services or to run our business. In addition, supply chain disruptions stemming from the Russia-Ukraine war may harm our customers and suppliers and further complicate existing supply chain constraints. Occasionally, we migrate data among data centers and to third-party hosted environments. If a transition among data centers or to third-party service providers encounters unexpected interruptions, unforeseen complexity or unplanned disruptions despite precautions undertaken during the process, this may impair our delivery of products and services to customers and result in increased costs and liabilities, which may harm our operating results, reputation and our business. It is also possible that hardware or software failures or errors in our systems (or those of our third-party service providers) could result in data loss or corruption, cause the information that we collect or maintain to be incomplete or contain inaccuracies that our customers regard as significant, or cause us to fail to meet committed service levels or comply with applicable notification requirements. Furthermore, our ability to collect and report data may be delayed or interrupted by a number of factors, including access to the internet, the failure of our network or software systems, security breaches or significant variability in visitor traffic on customer websites. In addition, the loss of data resulting from computer viruses, worms, ransomware or other malware may harm our systems could expose us to litigation or regulatory investigation, and costly and time-intensive notification requirements. We may also find, on occasion, that we cannot deliver data and reports to our customers in near real time due to factors such as significant spikes in customer activity on their websites or failures of our network or software (or that of a third-party service provider). If we fail to plan infrastructure capacity appropriately and expand it proportionally with the needs of our customer base, and we experience a rapid and significant demand on the capacity of our data centers or those of third parties, service outages or performance issues could occur, which would impact our customers. Such a strain on our infrastructure 23 capacity could subject us to regulatory and customer notification requirements, violations of service level agreement commitments or financial liabilities and result in customer dissatisfaction or harm our business. If we supply materially inaccurate information or experience significant interruptions in our systems, our reputation could be harmed, we could lose customers and we could be found liable for damages or incur other losses.

Increasing regulatory focus on privacy and security issues and expanding laws could impact our business models and expose us to increased liability. As a global company, Adobe is subject to global data protection, privacy and security laws, regulations and codes of conduct that apply to our various business units and data processing activities. These laws, regulations and codes may be inconsistent across jurisdictions and are subject to evolving and differing (sometimes conflicting) interpretations. Government officials and regulators, privacy advocates and class action attorneys are increasingly scrutinizing how companies collect, process, use, store, share and transmit personal data. This increased scrutiny may result in new interpretations of existing laws, thereby further impacting Adobe's business. Globally, laws such as the General Data Protection Regulation ("GDPR") in Europe and the Personal Information Protection Law ("PIPL") in China, and new and emerging state laws in the United States on privacy, data and related technologies, such as the California Consumer Privacy Act, the California Privacy Rights Act and the Virginia Consumer Data Protection Act, as well as industry self-regulatory codes, create new compliance obligations and expand the scope of potential liability, either jointly or severally with our customers and suppliers. While we have invested in readiness to comply with applicable requirements, the dynamic and evolving nature of these laws, regulations and codes, as well as their interpretation by regulators and courts, may affect our ability (and our enterprise customers' ability) to reach current and prospective customers, to respond to both enterprise and individual customer requests under the laws (such as individual rights of access, correction and deletion of their personal information) and to implement our business models effectively. These laws, regulations and codes may also impact our innovation and business drivers in developing new and emerging technologies (e.g., artificial intelligence and machine learning). These requirements, among others, may impact demand for our offerings and force us to bear the burden of more onerous obligations in our contracts. Any perception of our practices, products or services as a violation of individual privacy or data protection rights may subject us to public criticism, class action lawsuits, reputational harm, or investigations or claims by regulators, industry groups or other third parties, all of which could disrupt or adversely impact our business and expose us to increased liability. Additionally, we collect and store information on behalf of our business customers and if our customers fail to comply with contractual obligations or applicable laws, it could result in litigation or reputational harm to us. Transferring personal information across international borders is complex and subject to legal and regulatory requirements as well as active litigation and enforcement in a number of jurisdictions around the world, each of which could have an adverse impact on our ability to process and transfer personal data as part of our business operations. For example, European data transfers outside the European Economic Area are highly regulated and litigated. The mechanisms that we and many other companies rely upon for European data transfers (e.g., Standard Contractual Clauses) are the subject of regulatory interpretation and judicial decisions by the Court of Justice of the European Union. We are closely monitoring for developments related to valid transfer mechanisms available for transferring personal data outside the European Economic Area (including the Trans-Atlantic Data Privacy Framework) and other countries that have similar trans-border data flow requirements and adjusting our practices accordingly. The open judicial questions and regulatory interpretations related to the validity of transfers using Standard Contractual Clauses have resulted in some changes in the obligations required to provide our services in the European Union and could expose us to potential sanctions and fines for non-compliance. Several other countries, including China, Australia, New Zealand, Brazil, Hong Kong and Japan, have also established specific legal requirements for cross-border transfers of personal information and for data localization (i.e., where personal data must remain stored in the country). If other countries implement more restrictive regulations for cross-border data transfers or do not permit data to leave the country of origin, such developments could adversely impact our business and our enterprise customers' business, our financial condition and our results of operations in those jurisdictions. Our intellectual property portfolio is a valuable asset and we may not be able to protect our intellectual property rights, including our source code, from infringement or unauthorized copying, use or disclosure. Our intellectual property portfolio is a valuable asset. Infringement or misappropriation of our patents, trademarks, trade secrets, copyrights and other intellectual property rights could result in lost revenues and ultimately reduce their value. Preventing unauthorized use or infringement of our intellectual property rights is inherently difficult. We actively combat software piracy as we enforce our intellectual property rights, but we nonetheless lose significant revenue due to illegal use of our software. If piracy activities continue at historical levels or increase, they may further harm our business. We apply for patents in the United States and internationally to protect our newly created technology and if we are unable to obtain patent protection for the technology described in our pending patent, or if the patent is not obtained timely, this could result in revenue loss, or have other adverse effects on operations and harm our business. We offer our products and services in foreign countries 28

Risks Related to Financial Performance If our customers fail to renew subscriptions in accordance with our expectations, our future revenue and operating results could suffer, and our subscription offerings may create additional risk related to the timing of revenue recognition. Our offerings are typically subscription-based, pursuant to product and service agreements. Since our customers have no obligation to renew their subscriptions for our services after the expiration of their initial subscription period, which typically ranges from 1 to 36 months, our customers may not renew their subscriptions at the same or a higher level of service, for the same number of seats or for the same duration of time, if at all. Our varied customer base and flexible duration complicates our ability to precisely forecast renewal rates. Our customers' renewal rates may decline or fluctuate as a result of a number of factors, including their level of satisfaction with our services, our ability to continue enhancing features and functionality, the reliability (including uptime) of our subscription offerings, the prices of offerings and competitors' offerings, the actual or perceived information security of our systems and services, decreases in the size of our customer base, reductions in our customers' spending levels or declines in customer activity as a result of general economic conditions or uncertainty in financial markets, including as a result of a global health crisis and geopolitical conflict, which has affected and may continue to affect certain sectors of the economy disproportionately. If our customers do not renew their subscriptions or if they renew on terms less favorable to us, our revenue may decline. We generally recognize revenue from our subscription offerings ratably over the terms of their subscription agreements. As a result, most of the subscription revenue we report in each quarter is the result of subscription agreements entered into during previous quarters. Any reduction in new or renewed subscriptions in a quarter may not be reflected in our revenue results until a later quarter and may decrease our revenue in future quarters. Lower sales, reduced demand for our products and services and increases in our attrition rate may not be fully reflected in our results of operations until future periods. Our subscription model could also make it difficult for us to rapidly increase our revenue from subscription-based or hosted services through additional sales in any period, as revenue from new customers will be recognized over the applicable subscription term. Additionally, in connection with our sales efforts to enterprise customers, a number of factors could affect our revenue, including longer-than-expected sales and implementation cycles, potential deferral of revenue and alternative licensing arrangements. If any of our assumptions about revenue from our subscription-based offerings prove incorrect, our actual results may vary materially from those anticipated.

General Risk Factors Catastrophic events, including global pandemics such as the COVID-19 pandemic, may disrupt our business and adversely affect our financial condition and results of operations. We are a highly automated business and rely on our network infrastructure and enterprise applications, internal technology systems and website for our development, marketing, operations, support, hosted services and sales activities. In 31 addition, some of our businesses rely on third-party hosted services, and we do not control the operation of third-party data center facilities serving our customers from around the world, which increases our vulnerability. A disruption, infiltration or failure of these systems or third-party hosted services in the event of a major earthquake, fire, flood, tsunami or other weather event, power loss, telecommunications failure, software or hardware malfunctions, pandemics (including the COVID-19 pandemic), cyber-attack, war, terrorist attack or other catastrophic event that our disaster recovery plans do not adequately address, could cause system interruptions, reputational harm, loss of intellectual property, delays in our product development, lengthy interruptions in our services, breaches of data security and loss of critical data. Any of these events could prevent us from fulfilling our customers' orders or could negatively impact a country or region in which we sell our products, which could in turn decrease that country's or region's demand for our products. Our corporate headquarters, a significant portion of our research and development activities, certain of our data centers and certain other critical business operations are located in the San Francisco Bay Area, and additional facilities where we conduct significant operations are located in the Salt Lake Valley Area, both of which are near major earthquake faults. A catastrophic event that results in the destruction or disruption of any of our data centers or our critical business or information technology systems could severely affect our ability to conduct normal business operations and, as a result, our future operating results could be adversely affected. The adverse effects of any such catastrophic event would be exacerbated if experienced at the same time as another unexpected and adverse event, such as the COVID-19 pandemic. The occurrence of regional epidemics or a global pandemic, such as the COVID-19 pandemic, have had and may continue to have an adverse effect on how we and our customers are operating our businesses and our operating results. Our operations have also been and may in the future be negatively affected by a range of external factors related to the pandemic that are not within our control, including the emergence and spread of more transmissible variants. The extent to which global pandemics, such as the COVID-19 pandemic, impact our financial condition or results of operations will depend on factors such as the duration and scope of the pandemic, as well as whether there is a material impact on the businesses or productivity of our customers, partners, employee, suppliers and other partners. To the extent that the pandemic harms our business and results of operations, many of the other risks described in this Part I, Item 1A of this report may be heightened.

Revenue, margin or earnings shortfalls or the volatility of the market generally may cause the market price of our stock to decline. In the past, the market price for our common stock experienced significant fluctuations and it may do so in the future. A number of factors may affect the market price for our common stock, such as: •shortfalls in, or changes in expectations about, our revenue, margins, earnings, Annualized Recurring Revenue ("ARR"), sales of our Digital Experience offerings or other key performance metrics; •changes in estimates or recommendations by securities analysts; •whether our results meet analysts' expectations; •compression or expansion of multiples used by investors and analysts to value high technology SaaS companies; •the announcement of new products or services, product enhancements, service introductions, strategic alliances or significant agreements by us or our competitors; •the loss of large customers or our inability to increase sales to existing customers, retain customers or attract new customers; •recruitment or departure of key personnel; •variations in our or our competitors' results of operations, changes in the competitive landscape generally and developments in our industry; •general socio-economic, political or market conditions; •macroeconomic conditions and the economic impact of the COVID-19 pandemic, inflation and rising interest rates and global conflicts, including the Russia-Ukraine war; and •unusual events such as significant acquisitions by us or our competitors, divestitures, litigation, regulatory actions and other factors, including factors unrelated to our operating performance. In addition, the market for technology stocks or the stock market in general may experience uneven investor confidence, which may cause the market price for our common stock to decline for reasons unrelated to our operating performance. Volatility in the market price of a company's securities for a period of time may increase the company's susceptibility to securities class action litigation. Oftentimes, this type of litigation is expensive and diverts management's attention and resources which may adversely affect our business.

•increased accounts receivables collection times and working capital requirements associated with acquired business models; and •incompatibility of business cultures. Mergers and acquisitions of technology companies are inherently risky. If we do not complete an announced acquisition transaction, including the pending acquisition of Figma, Inc., or integrate an acquired business successfully and in a timely manner, we may not realize the benefits of the acquisition to the extent anticipated, and in certain circumstances an acquisition could harm our financial position. Our ability to acquire other businesses or technologies, make strategic investments or integrate acquired businesses effectively may also be impaired by the effects of the COVID-19 pandemic, including government actions in light of the pandemic, trade tensions, restrictions and increased global scrutiny of foreign investments. For example, a number of countries, including the United States and countries in Europe and the Asia-Pacific region, are considering or have adopted restrictions on foreign investments. Governments may continue to adopt or tighten restrictions of this nature, and such restrictions could negatively impact our business and financial results. The success of some of our product and service offerings depends on our ability to continue to attract and retain customers of and contributors to our online marketplaces for creative content. The success of some of our product and service offerings, such as Adobe Stock, depends on our ability to continue to retain existing and attract new customers and contributors to these online marketplaces for creative content. An increase in paying customers has generally resulted in more content from contributors, which increases the size of our collection and in turn attracts new paying customers. We rely on the functionality and features of our online marketplaces, the size and content of our collection and the effectiveness of our marketing efforts to attract new customers and contributors and retain existing ones. New technologies may render the features of our online marketplaces obsolete, our collection may fail to grow as anticipated or our marketing efforts may be unsuccessful, any of which may adversely affect our results of operations. If our products or platforms are used to create or disseminate objectionable content, particularly misleading content intended to manipulate public opinion, our brand reputation may be damaged, and our business and financial results may be harmed. We believe that our brands have significantly contributed to the success of our business. Maintaining and enhancing the brands within Adobe increases our ability to enter new categories, launch new and innovative products to better serve our customers and expand our customer base. Our brands may be negatively affected by the use of our products or services to create or disseminate newsworthy content that is deemed to be misleading, deceptive or intended to manipulate public opinion (e.g., "DeepFakes"), by the use of our products or services for illicit, objectionable or illegal ends, or by our failure to respond appropriately and expeditiously to such uses of our products and services. Such uses of our products and services may also cause us to face claims related to defamation, rights of publicity and privacy, illegal content, misinformation and personal injury torts. Maintaining and enhancing our brands may require us to make substantial investments and these investments may not be successful. If we fail to appropriately respond to objectionable content created using our products or services or shared on our platforms, our users may lose confidence in our brands and our business and financial results may be adversely affected. In addition, government regulation designed to address DeepFakes could adversely impact our product offerings. Social and ethical issues relating to the use of new and evolving technologies, such as AI, in our offerings may result in reputational harm and liability. Social and ethical issues relating to the use of new and evolving technologies such as artificial intelligence ("AI") in our offerings, may result in reputational harm and liability, and may cause us to incur additional research and development costs to resolve such issues. We are increasingly building AI into many of our offerings. As with many innovations, AI presents risks and challenges that could affect its adoption, and therefore our business. If we enable or offer solutions that draw controversy due to their perceived or actual impact on society, we may experience brand or reputational harm, competitive harm or legal liability. Potential government regulation related to AI use and ethics may also increase the burden and cost of research and development in this area, and failure to properly remediate AI usage or ethics issues may cause public confidence in AI to be undermined, which could slow adoption of AI in our products and services. The rapid evolution of AI will require the application of resources to develop, test and maintain our products and services to help ensure that AI is implemented ethically in order to minimize unintended, harmful impact. Uncertainty around new and emerging AI applications such as generative AI content creation may require additional investment in the development of proprietary datasets and machine learning models, 22 development of new approaches and processes to provide attribution or remuneration to content creators and building systems that enable creatives to have greater control over the use of their work in the development of AI, which may be costly and could impact our profit margin if we decide to expand generative AI into all our product offerings. Developing, testing, and deploying AI systems may also increase the cost profile of our offerings due to the nature of the computing costs involved in such systems.

These issues affect our products and services in particular because cyber-attackers tend to focus their efforts on popular offerings with a large user base, and we expect them to continue to do so. From time to time we have identified, and in the future we may identify other, vulnerabilities in some of our applications and services and those of our third-party service providers. In some cases, such vulnerabilities may not be immediately detected, which may make it difficult to recover critical services and lead to damaged assets. We continuously monitor and develop our information technology networks and infrastructure in an effort to prevent, detect, address and mitigate the risk of threats to our data, systems and networks, including malware and computer virus attacks, ransomware, unauthorized access, business email compromise, misuse, denial-of-service attacks, system failures and disruptions. These continued enhancements and changes, as well as changes designed to update and enhance our protective measures to address new threats, may increase the risk of a system or process failure or the creation of a gap in the associated security measures. Any such failure or gap could materially and adversely affect our business, results of operations and financial results. We devote significant resources to address security vulnerabilities through engineering more secure products, enhancing security and reliability features in our products and systems, code hardening, conducting rigorous penetration tests, deploying updates to address security vulnerabilities, regularly reviewing our service providers' security controls, reviewing and auditing our hosted services against independent security control frameworks (such as ISO 27001, SOC 2 and PCI), providing resources, such as mandatory security training, for our workforce and improving our incident response time, but security vulnerabilities cannot be totally eliminated. The cost of undertaking these efforts could reduce our operating margins, and we may be unable to implement these measures quickly enough to prevent unauthorized access into our systems and products in all circumstances. Despite our preventative efforts, there is no assurance that our security measures will provide 24 full effective protection from such events, and actual or perceived security vulnerabilities in our products and systems may harm our reputation or lead to claims against us (and have in the past led to such claims) and could lead some customers to stop using certain products or services or to reduce or delay future purchases. If we do not make the appropriate level of investment in our technology systems and we are not able to deliver the quality of data security and privacy our customers require or that meet our independent security control certification requirements, our business could be adversely affected. Customers may also adopt security measures designed to protect their existing computer systems from attack, which could delay adoption of new technologies. Moreover, delayed sales, lower margins or lost customers resulting from disruptions caused by cyber-attacks, overly burdensome preventative security measures or failure to fully meet independent security control certification requirements could adversely affect our financial results, stock price and reputation.

Our business could be harmed if we fail to effectively manage critical strategic third-party business relationships. As our offerings expand and our customer base grows, our relationships with strategic partners become increasingly valuable. If our contractual relationships with these third parties were to terminate, or if we were unable to renew on favorable terms, our business could be harmed. This is especially the case when the third party's offerings are integrated with our products and services, or where the third party's offerings are difficult to substitute or replace. Alternative arrangements for such products and services may not be available to us on commercially reasonable terms, and we may experience business interruptions upon a transition to an alternative partner. The failure of third parties to provide acceptable products and services or to update their technology may result in a disruption to our business operations and those of our customers, which may reduce our revenues and profits, cause us to lose customers and damage our reputation. We increasingly utilize third-party distribution platforms, such as Apple's App Store and Google's Play Store, for the distribution of certain of our product offerings. Although we benefit from the strong brand recognition and large user base of these distribution platforms to attract new customers, the platform owners have wide discretion to change the pricing structure, terms of service and other policies with respect to us and other developers, and may offer or promote products that compete with our product offerings. Adverse changes by these third parties could adversely affect our financial results. Failure of our third-party customer service and technical support providers to adequately address customers' requests could harm our business and adversely affect our financial results. Our customers rely on our customer service support organization to resolve issues with our products and services. We depend heavily, and expect to continue to rely heavily, on third-party customer service and technical support representatives to provide such services. This strategy presents risks to our business since we may not be able to influence the quality of support 25 as directly as if our own employees performed these activities. Our customers may react negatively to providing information to, and receiving support from, third-party organizations, especially if these third-party organizations are based overseas. If we encounter problems with our third-party customer service and technical support providers, our reputation may be harmed, our ability to sell our offerings could be adversely affected, and we could lose customers and associated revenue. If we are unable to recruit and retain key personnel, our business may be harmed, and our attempts to operate under a hybrid work model may not be successful and adversely impact our business. Much of our future success depends on the continued service, availability and performance of our senior management and highly-skilled personnel across all levels of our organization. Our senior management has acquired specialized knowledge and skills with respect to our business, and the loss of any of these individuals could harm our business, especially if we are not successful in developing adequate succession plans. Our efforts to attract, develop, integrate and retain highly skilled employees with appropriate qualifications may be compounded by intensified restrictions on travel, immigration or the availability of work visas. Competition for experienced personnel in the information technology industry is intense and has recently intensified further due to industry trends in many areas where our employees are located. Further, the increased availability of hybrid or remote working arrangements has expanded the pool of companies that can compete for our employees and employment candidates. We may experience higher compensation costs to retain senior management and experienced personnel that may not be offset by improved productivity or increased sales. A hybrid work environment may also present operational, cybersecurity and workplace culture challenges. If we are unable to continue to successfully attract and retain highly skilled personnel and maintain our corporate culture in a hybrid work environment, our business may be harmed. We continue to hire personnel in countries where exceptional technical knowledge and other expertise are offered at lower costs, which increases the efficiency of our global workforce structure and reduces our personnel related expenditures. Nonetheless, as globalization continues, competition for employees in these countries has increased, which may impact our ability to retain these employees and increase our compensation-related expenses. We may continue to expand our international operations and international sales and marketing activities, which would require significant management attention and resources. We may be unable to scale our infrastructure effectively or as quickly as our competitors in these markets, and our revenue may not increase sufficiently to offset these expected increases in costs, causing our results to suffer. We believe that a critical contributor to our success to date has been our corporate culture, which we have built to foster innovation, teamwork and employee satisfaction. As we grow, including from the integration of employees and businesses acquired in connection with previous or future acquisitions, we may find it difficult to maintain important aspects of our corporate culture, which could negatively affect our ability to retain and recruit personnel who are essential to our future success.

Risks Related to Laws and Regulations We are subject to risks associated with compliance with laws and regulations globally, which may harm our business. We are a global company subject to varied and complex laws, regulations and customs, both domestically and internationally. These laws and regulations relate to a number of aspects of our business, including trade protection, import and export control, anti-boycott, sanctions and embargoes, data and transaction processing security, payment card industry data security standards, records management, user-generated content hosted on websites we operate, privacy practices, data residency, corporate governance, anti-trust and competition, employee and third-party complaints, anti-corruption, gift policies, conflicts of interest, securities regulations and other regulatory requirements affecting trade and investment. The application of these laws and regulations to our business is often unclear and may at times conflict. For example, in many foreign countries, particularly in those with developing economies, it is common to engage in business practices that are prohibited by U.S. regulations applicable to us, including the Foreign Corrupt Practices Act. We cannot provide assurance that our employees, 29 contractors, agents and business partners will not take actions in violation of our internal policies or U.S. laws. Compliance with these laws and regulations may involve significant costs or require changes in our business practices that result in reduced revenue and profitability. Non-compliance could also result in fines, damages, criminal sanctions against us, our officers or our employees, prohibitions on the conduct of our business, and damage to our reputation. In response to the COVID-19 pandemic, federal, state, local and foreign governmental authorities have imposed, and may continue to impose, protocols and restrictions intended to contain the spread of the virus, including limitations on the size of gatherings, closures of work facilities, schools, public buildings and businesses, quarantines, lockdowns and travel restrictions. Such restrictions have disrupted and may continue to disrupt our business operations and limit our ability to perform critical functions. In addition, approximately 48% of our employees are located outside the United States. Accordingly, we are exposed to changes in laws governing our employee relationships in various U.S. and foreign jurisdictions, including laws and regulations regarding wage and hour requirements, fair labor standards, employee data privacy, unemployment tax rates, workers' compensation rates, citizenship requirements and payroll and other taxes, which likely would have a direct impact on our operating costs.

Changes in tax rules and regulations, or interpretations thereof, may adversely affect our effective tax rates. We are a United States-based multinational company subject to tax in multiple U.S. and foreign tax jurisdictions. The U.S. Tax Cuts and Jobs Act ("U.S. Tax Act"), enacted into law in December 2017, changed existing U.S. tax law and 31 introduced certain international provisions applicable to us. Among other considerations, the applicability and impact of these tax provisions, and of other U.S. or international tax law changes could adversely affect our effective income tax rate and cash flows in future years. Our income tax expense has differed from the tax computed at the U.S. federal statutory income tax rate due primarily to discrete items including, but not limited to, the effects of tax credits, net tax benefits from trading structure changes, tax benefits from stock-based compensation and settlements of tax examinations, and to net tax on earnings from foreign operations. Unanticipated changes in our tax rates could affect our future results of operations. Our future effective tax rates are likely to be unfavorably affected by changes in the tax rates in jurisdictions where our income is earned, the geographic mix of earnings, our repatriation policy or the valuation of our deferred tax assets and liabilities, by changes in or our interpretation of tax rules and regulations in the jurisdictions in which we do business, or by unexpected negative changes in business and market conditions that could reduce certain tax benefits. In addition, in the United States and other countries where we conduct business and in jurisdictions in which we are subject to tax, including those covered by governing bodies that enact tax laws applicable to us, such as the European Commission of the European Union, we are subject to potential changes in relevant tax, accounting and other laws, regulations and interpretations, including changes to tax laws applicable to corporate multinationals such as Adobe. These countries, governmental bodies and intergovernmental economic organizations such as the Organization for Economic Cooperation and Development, have or could make unprecedented assertions about how taxation is determined in their jurisdictions that are contrary to the way in which we have interpreted and historically applied the rules and regulations described above in such jurisdictions. In the current global tax policy environment, any changes in laws, regulations and interpretations related to these assertions could adversely affect our effective tax rates, cause us to respond by making changes to our business structure, or result in other costs to us which could adversely affect our operations and financial results. Moreover, we are subject to the examination of our income tax returns by the U.S. Internal Revenue Service and other domestic and foreign tax authorities. These tax examinations are expected to focus on our research and development tax credits, intercompany transfer pricing practices and other matters. We regularly assess the likelihood of outcomes resulting from these examinations to determine the adequacy of our provision for income taxes and have reserved for potential adjustments that may result from these examinations. We cannot provide assurance that the final determination of any of these examinations will not have an adverse effect on our financial position and results of operations.

•customer budget constraints, economic conditions and unplanned administrative delays. We spend substantial time and expense on our sales efforts without assurance that potential customers will ultimately purchase our solutions. Further, restrictions in place for the COVID-19 pandemic have resulted and could continue to result in our inability to negotiate in person, even as we return many employees to their offices. As we target our sales efforts at larger enterprise customers, these trends are expected to continue and could have a greater impact on our results of operations. Additionally, our enterprise sales pattern has historically been uneven, where a higher percentage of a quarter's total sales occur during the final weeks of each quarter, which is common in our industry. Our extended sales cycle for these products and services makes it difficult to predict when a given sales cycle will close.

ITEM 1A. RISK FACTORS As previously discussed, our actual results could differ materially from our forward-looking statements. Below we discuss some of the factors that could cause these differences. These and many other factors described in this report could adversely affect our operations, performance and financial condition.

We face various risks associated with our operating as a multinational corporation. As a global business that generates approximately 42% of our total revenue from sales to customers outside of the Americas, we are subject to a number of risks, including: •inflation and actions taken by central banks to counter inflation; •foreign currency fluctuations and controls; •international and regional economic, political and labor conditions, including any instability or security concerns abroad, such as uncertainty caused by economic sanctions, trade disputes, armed conflicts and wars; •tax laws (including U.S. taxes on foreign subsidiaries); •increased financial accounting and reporting burdens and complexities; •changes in, or impositions of, legislative or regulatory requirements; •changes in laws governing the free flow of data across international borders; •failure of laws to protect our intellectual property rights adequately; •inadequate local infrastructure and difficulties in managing and staffing international operations; •delays resulting from difficulty in obtaining export licenses for certain technology, tariffs, quotas and other trade barriers; •the imposition of governmental economic sanctions on countries in which we do business or where we plan to expand our business; •costs and delays associated with developing products in multiple languages;

•operating in locations with a higher incidence of corruption and fraudulent business practices; and •other factors beyond our control, such as terrorism, war, natural disasters, climate change and pandemics, including the COVID-19 pandemic and resulting restrictions on business activity, which may vary significantly by region. Some of our third-party business partners have international operations and are also subject to these risks, and our business may be harmed if such partners are unable to appropriately manage these risks. If sales to any of our customers outside of the Americas are reduced, delayed or canceled because of any of the above factors, our revenue may decline.

We may incur substantial costs defending against third parties alleging that we infringe their proprietary rights. We have been, are currently and may in the future be subject to claims, negotiations and complex, protracted litigation relating to disputes regarding the validity or alleged infringement of third-party intellectual property rights, including patent rights. Intellectual property disputes and litigation are typically costly and can be disruptive to our business operations by diverting the attention of management and key personnel. We may not prevail in every lawsuit or dispute. Third-party intellectual property disputes, including those initiated by patent assertion entities, could subject us to significant liabilities, require us to enter into royalty and licensing arrangements on unfavorable terms, prevent us from offering certain products or services, subject us to injunctions restricting our sales, cause severe disruptions to our operations or the markets in which we compete, or require us to satisfy indemnification commitments with our customers, including contractual provisions under various license arrangements and service agreements. In addition, we may incur significant costs in acquiring the necessary third-party intellectual property rights for use in our products, in some cases to fulfill contractual obligations with our customers. Any of these occurrences could significantly harm our business.

Changes in accounting principles or interpretations thereof could have a significant impact on our financial position and results of operations. We prepare our consolidated financial statements in accordance with accounting principles generally accepted in the United States of America ("GAAP"). These principles are subject to interpretation by the SEC and various bodies formed to interpret and create appropriate accounting principles. A change in these principles, how the principles are interpreted, or the adoption of new accounting standards can have a significant effect on our reported results, could retroactively affect previously reported transactions and may require that we make significant changes to our systems, processes and controls. Changes resulting from these new standards may result in materially different financial results and may require that we change how we process, analyze and report financial information and that we change financial reporting controls. For additional information regarding new standards that may have significant impact to our consolidated financial statements, see the section titled "Recent Accounting Pronouncements Not Yet Effective" in Note 1 of our Notes to Consolidated Financial Statements. Such changes in accounting principles may have an adverse effect on our business, financial position and results of operations, or cause an adverse deviation from our revenue and profitability targets, which may negatively impact our financial results.

Contracting with government entities exposes us to additional risks inherent in the government procurement process. We provide products and services, directly and indirectly, to a variety of domestic and foreign government entities, which introduces certain risks, including extended sales and collection cycles, varying governmental budgeting processes and adherence to complex procurement regulations and other government-specific contractual requirements. We have been, are currently and may in the future be subject to audits and investigations relating to our government contracts and any violations could result in various civil and criminal penalties and administrative sanctions, including termination of contracts, payment of fines and suspension or debarment from future government business, as well as harm to our reputation and financial results.

We may incur losses associated with currency fluctuations and may not be able to effectively hedge our exposure. Our operating results are subject to fluctuations in foreign currency exchange rates due to the global scope of our business. Geopolitical and economic events, including war, trade disputes, economic sanctions and emerging market volatility, and associated uncertainty have caused, and may in the future cause, currencies to fluctuate. We attempt to mitigate a portion of these risks through foreign currency hedging based on our judgment of the appropriate trade-offs among risk, opportunity and expense. We regularly review our hedging program and make adjustments that we believe are appropriate. Our hedging 30 activities have not and may not in the future offset more than a portion of the adverse financial impact resulting from unfavorable movement in foreign currency exchange rates, which could adversely affect our financial condition or results of operations.

Introduction of new technology could harm our business and results of operations. The expectations and needs of technology consumers are constantly evolving. As new technology is developed, integration of our products and services with one another and other companies' offerings creates an increasingly complex ecosystem that is also partly reliant on third parties. If any disruptive technology, or competing products, services or operating systems that are not compatible with our solutions, achieve widespread acceptance, our operating results could suffer and our business could be harmed. The introduction of, or limitations on, certain technologies may reduce the effectiveness of our products and our business operations. For example, some of our products and services, including those marketed or licensed through adobe.com, rely on tracking, third-party cookies or other identifiers to help our customers more effectively advertise and detect and prevent fraudulent activity. However, consumers can, with increasing ease, implement technologies to limit the ability to collect and use data to deliver or advertise services. Increased use of methods to control the use of these technologies through customers' browsers, operating systems, device settings or "ad-blocking" software or applications may harm our business. We may not realize the anticipated benefits of past or future investments or acquisitions, and integration of acquisitions may disrupt our business and management. We may not realize the anticipated benefits of an investment or acquisition of a company, division, product or technology, each of which involves numerous risks. These risks include: •inability to achieve the financial and strategic goals for the acquired and combined businesses; •difficulty in, and the cost of, effectively integrating the operations, technologies, products or services, and personnel of the acquired business; •potential identified or unknown security vulnerabilities in acquired products that expose us to additional security risks or delay our ability to integrate the product into our offerings; •entry into markets in which we have minimal prior experience and where competitors in such markets have stronger market positions; •disruption of our ongoing business and distraction of our management and other employees from other opportunities and challenges; •inability to retain personnel of the acquired business; •inability to retain key customers, distributors, vendors and other business partners of the acquired business; •inability to take advantage of anticipated tax benefits; •incurring acquisition-related costs or amortization costs for acquired intangible assets that could impact our operating results; •elevated delinquency or bad debt write-offs related to receivables of the acquired business we assume; •additional costs of bringing acquired companies into compliance with laws and regulations applicable to a multinational corporation; •difficulty in maintaining controls, procedures and policies during the transition and integration; •impairment of our relationships with employees, customers, partners, distributors or third-party providers of our technologies, products or services; •failure of our due diligence processes to identify significant problems, liabilities or other challenges of an acquired company or technology; •exposure to litigation or other claims in connection with, or inheritance of claims or litigation risk as a result of, an acquisition, such as claims from terminated employees, customers, former stockholders or other third parties; •incurring significant exit charges if products or services acquired in business combinations are unsuccessful; •inability to conclude that our internal controls over financial reporting are effective; •inability to obtain, or obtain in a timely manner, approvals from governmental authorities, which could delay prevent or impose conditions on such acquisitions; •the failure of strategic investments to perform as expected or to meet financial projections; •delay in customer and distributor purchasing decisions due to uncertainty about the direction of our product and service offerings; •additional stock-based compensation issued or assumed in connection with an acquisition, including the impact on stockholder dilution and our results of operations;

If our goodwill or amortizable intangible assets become impaired, then we could be required to record a significant charge to earnings. GAAP requires us to test for goodwill impairment at least annually. In addition, we review our goodwill and amortizable intangible assets for impairment when events or changes in circumstances indicate the carrying value may not be recoverable, including declines in stock price, market capitalization or cash flows, and slower growth rates in our industry. Depending on the results of our review, we could be required to record a significant charge to earnings in our consolidated financial statements during the period in which any impairment of our goodwill or amortizable intangible assets was determined, negatively impacting our results of operations. We have issued $4.15 billion of notes in debt offerings and may incur other debt in the future, which may adversely affect our financial condition and future financial results. We have $4.15 billion in senior unsecured notes and a $1.5 billion senior unsecured revolving credit agreement, which is currently undrawn. This debt may adversely affect our financial condition and future financial results by, among other things: •increasing our vulnerability to adverse changes in general economic and industry conditions; •requiring the dedication of a portion of our expected cash flows from operations to service our debt, thereby reducing the amount of expected cash flows available for other purposes, including capital expenditures and acquisitions; and

Our investment portfolio may become impaired by deterioration of the financial markets. Our cash equivalent and short-term investment portfolio as of December 2, 2022 consisted of asset-backed securities, corporate debt securities, foreign government securities, money market funds, municipal securities, time deposits, U.S. agency securities and U.S. Treasury securities. We follow an established investment policy and set of guidelines to monitor and help mitigate our exposure to interest rate and credit risk. The policy sets forth credit quality standards and limits our exposure to any one issuer, as well as our maximum exposure to various asset classes. Should financial market conditions worsen in the future, including from impacts of the COVID-19 pandemic or the Russia-Ukraine war, investments in some financial instruments may pose risks arising from market liquidity and credit concerns. In addition, any deterioration of the capital markets could cause our other income and expense to vary from expectations. As of December 2, 2022, we had no material impairment charges associated with our short-term investment portfolio, and although we believe our current investment portfolio has little risk of material impairment, we cannot predict future market conditions, market liquidity or credit availability, and we can provide no assurance that our investment portfolio will remain materially unimpaired.

Climate change may have a long-term impact on our business. While we seek to partner with organizations that mitigate their business risks associated with climate change, we recognize that there are inherent risks wherever business is conducted. Access to clean water and reliable energy in the communities where we conduct our business, whether for our offices or for our vendors, is a priority. Our major sites in California, Utah and India are vulnerable to climate change effects. For example, in California, increasing intensity of drought throughout the state and annual periods of wildfire danger increase the probability of planned power outages in the communities where we work and live. While this danger has a low-assessed risk of disrupting normal business operations, it has the potential impact on employees' abilities to commute to work or to work from home and stay connected effectively. Climate-related events, including the increasing frequency of extreme weather events and their impact on U.S., India and other major regions' critical infrastructure, have the potential to disrupt our business, our third-party suppliers and/or the business of our customers, and may cause us to experience higher attrition, losses and additional costs to maintain or resume operations. To inform our disclosures and take potential action as appropriate, Adobe is aligned with the guidelines of the Financial Stability Board's Task Force on Climate-related Financial Disclosures recommendations and the Sustainability Accounting Standards Board and the Global Reporting Initiative environmental metrics. Regulatory developments, changing market dynamics and stakeholder expectations regarding climate change may impact our business, financial condition and results of operations. Uncertainty about current and future economic conditions and other adverse changes in general political conditions in any of the major countries in which we do business could adversely affect our operating results. As our business has grown, we have become increasingly subject to the risks arising from adverse changes in economic and political conditions, both domestically and globally, including trends toward protectionism and nationalism, other unfavorable changes in economic conditions, such as inflation, rising interest rates or a recession, and other events beyond our control, such as economic sanctions, natural disasters, pandemics, including the COVID-19 pandemic, epidemics, political instability, armed conflicts and wars, including the Russia-Ukraine war. Worsening economic conditions have had and may continue to have an adverse impact on the businesses and financial health of many of our customers and hurt their creditworthiness. As a result, current or potential customers may be unable to fund software purchases, which could cause them to delay, decrease or cancel purchases of our products and services. Uncertainty about the effects of current and future economic and political conditions on us, our customers, suppliers and partners makes it difficult for us to forecast operating results and to make decisions about future investments. If economic growth in countries where we do business slows, customers may delay or reduce technology purchases, advertising spending or marketing spending. This could result in reductions in sales of our products and services, more extended sales cycles, slower adoption of new technologies and increased price competition. Among our customers are government entities, including the U.S. federal government, and our revenue could decline if spending cuts impact the government's ability to purchase our products and services. Deterioration in economic conditions in 32 any of the countries in which we do business could also cause slower or impaired collections on accounts receivable, which may adversely impact our liquidity and financial condition. A disruption in financial markets could impair our banking partners, on which we rely for operating cash management and derivative programs. Any of these events would likely harm our business, financial condition and results of operations.

Risks Related to the Operation of Our Business Security breaches in data centers we manage, or third parties manage on our behalf, may compromise the confidentiality, integrity or availability of employee and customer data, which could expose us to liability and adversely affect our reputation and business. We process and store significant amounts of employee and customer data, a large volume of which is hosted by third-party service providers. A security incident impacting our own data centers or those controlled by our service providers may compromise the confidentiality, integrity or availability of this data. Unauthorized access to or loss or disclosure of data stored by Adobe or our service providers may occur through physical break-ins, breaches of a secure network by an unauthorized party, software vulnerabilities or coding errors, employee mistakes, theft or misuse or other misconduct. It is also possible that unauthorized access to or disclosure of employee or customer data may occur through inadequate use of security controls by customers, service providers or employees. The compromise of personal, confidential or proprietary information could cause a loss of data, disrupt our operations, damage our reputation, give rise to remediation or other expenses and subject us to claims or other liabilities, regulatory investigations or fines. Adobe maintains insurance to cover operational risks, such as cyber risk and technology outages, but this insurance may not cover all costs associated with the consequences of personal, confidential or proprietary information being compromised. Further, such perceived or actual unauthorized loss or disclosure of the information we collect, process or store, or breach of our security could damage our reputation, result in the loss of customers and harm our business. We rely on data centers managed both by Adobe and third parties to host and deliver our services, as well as access, collect, process, use, transmit and store data, and any interruptions or delays in these hosted services, or failures in data collection or transmission could expose us to liability and harm our business and reputation. Much of our business relies on hardware and services that are hosted, managed and controlled directly by Adobe or third-party service providers, including our online store at adobe.com and our Creative Cloud, Document Cloud and Experience Cloud solutions. We do not have redundancy for all of our systems, many of our critical applications reside in only one of our data centers, and our disaster recovery planning may not account for all eventualities. If our business relationship with a third-party provider of hosting or content delivery services is negatively affected, or if one of our content delivery suppliers were to terminate its agreement with us without adequate notice, we might not be able to deliver the corresponding hosted offerings to our customers, which could disrupt our business operations and those of our customers, subject us to reputational harm, costly and time-intensive notification requirements, and cause us to lose customers and future business. The COVID-19 pandemic has disrupted and may continue to disrupt the supply chain of hardware needed to maintain these third-party systems and services or to run our business. In addition, supply chain disruptions stemming from the Russia-Ukraine war may harm our customers and suppliers and further complicate existing supply chain constraints. Occasionally, we migrate data among data centers and to third-party hosted environments. If a transition among data centers or to third-party service providers encounters unexpected interruptions, unforeseen complexity or unplanned disruptions despite precautions undertaken during the process, this may impair our delivery of products and services to customers and result in increased costs and liabilities, which may harm our operating results, reputation and our business. It is also possible that hardware or software failures or errors in our systems (or those of our third-party service providers) could result in data loss or corruption, cause the information that we collect or maintain to be incomplete or contain inaccuracies that our customers regard as significant, or cause us to fail to meet committed service levels or comply with applicable notification requirements. Furthermore, our ability to collect and report data may be delayed or interrupted by a number of factors, including access to the internet, the failure of our network or software systems, security breaches or significant variability in visitor traffic on customer websites. In addition, the loss of data resulting from computer viruses, worms, ransomware or other malware may harm our systems could expose us to litigation or regulatory investigation, and costly and time-intensive notification requirements. We may also find, on occasion, that we cannot deliver data and reports to our customers in near real time due to factors such as significant spikes in customer activity on their websites or failures of our network or software (or that of a third-party service provider). If we fail to plan infrastructure capacity appropriately and expand it proportionally with the needs of our customer base, and we experience a rapid and significant demand on the capacity of our data centers or those of third parties, service outages or performance issues could occur, which would impact our customers. Such a strain on our infrastructure 23 capacity could subject us to regulatory and customer notification requirements, violations of service level agreement commitments or financial liabilities and result in customer dissatisfaction or harm our business. If we supply materially inaccurate information or experience significant interruptions in our systems, our reputation could be harmed, we could lose customers and we could be found liable for damages or incur other losses.

Security vulnerabilities in our products and systems, or in our supply chain, could lead to reduced revenue or to liability claims. Maintaining the security of our products and services is a critical issue for us and our customers. Cyberthreats are constantly evolving and becoming increasingly sophisticated and complex, making it increasingly difficult to detect and successfully defend against them. Certain unauthorized parties have in the past managed, and may again in the future manage, to gain access to and misuse some of our systems and software, or that of our third-party service providers, in order to access the authentication, payment and personal information of our end users and employees. In addition, cyber-attackers (which may include individuals or groups, as well as sophisticated groups with significant resources, such as nation-state and state-sponsored attackers) also develop and deploy viruses, worms, credential stuffing attack tools and other malicious software programs, some of which may be specifically designed to attack our products, services, information systems or networks. The frequency and sophistication of such threats continues to increase and often becomes further heightened in connection with geopolitical tensions. Hardware, software and operating system applications that we develop or procure from third parties have contained and may contain defects in design or manufacture, including bugs, vulnerabilities and other problems that could unexpectedly compromise the security of the system or impair a customer's ability to operate or use our products. Like other global companies, we face an increasingly difficult challenge to attract and retain highly qualified security personnel to assist us in combating these security threats. The costs to prevent, eliminate, mitigate or alleviate cyber or other security problems, bugs, viruses, worms, malicious software programs and security vulnerabilities are significant, and our efforts to address these problems, including notifying affected parties, may not be successful or may be delayed and could result in interruptions, delays, cessation of service and loss of existing or potential customers. It is impossible to predict the extent, frequency or impact these problems may have on us. Outside parties have in the past and may in the future attempt to fraudulently induce our employees or users of our products or services to disclose sensitive, personal or confidential information via illegal electronic spamming, phishing or other tactics. This existing risk is compounded given the current hybrid model work environment, where a large portion of our workforce spends a portion of their time working in our offices and a portion of their time working from home. Unauthorized parties may also attempt to gain physical access to our facilities in order to infiltrate our information systems or attempt to gain logical access to our products, services or information systems for the purpose of exfiltrating content and data. These actual and potential breaches of our security measures and the accidental loss, inadvertent disclosure or unauthorized dissemination of proprietary information or sensitive, personal or confidential data about us, our employees, our customers or their end users, including the potential loss or disclosure of such information or data could expose us, our employees, our customers or other individuals affected to a risk of loss or misuse of this information. This may result in litigation and liability or fines, costly and time-intensive notice requirements, governmental inquiry or oversight or a loss of customer confidence, any of which could harm our business or damage our brand and reputation, thereby requiring time and resources to mitigate these impacts. These risks will likely increase as we expand our hosted offerings, integrate our products and services and store and process more data.

Some of our enterprise offerings have extended and complex sales cycles, which can make our sales cycles unpredictable. Sales cycles for some of our enterprise offerings, including our Adobe Experience Cloud and Adobe Experience Platform solutions and Enterprise Term License Agreements ("ETLAs") in our Digital Media business, are multi-phased and complex, which also makes it difficult to predict when a given sales cycle will close. The complexity in these sales cycles is due to several factors, including: •the need for our sales representatives to educate customers about the use and benefit of large-scale deployments of our products and services; •the desire of organizations to undertake significant evaluation processes to determine their technology requirements prior to making information technology expenditures and the need for our representatives to spend a significant amount of time assisting with such evaluations; •intensifying competition within the industry; •the negotiation of large, complex, enterprise-wide contracts; •the need for our customers to obtain requisition approvals from various decision makers within their organizations due to the complexity of our solutions touching multiple departments; and

Failure to manage our sales, partner and distribution channels effectively could result in a loss of revenue and harm our business. We contract with a number of software distributors and other strategic partners, none of which are individually responsible for a material amount of our total net revenue in any recent period. Nonetheless, if an agreement with one of our distributors were terminated, any prolonged delay in securing a replacement distributor could have a negative impact on our results of operations. Successfully managing our indirect distribution channel efforts to reach various customer segments for our products and services is a complex process across the broad range of geographies where we do business or plan to do business. Our distributors and other channel partners are independent businesses that we do not control. Notwithstanding the independence of our channel partners, we face legal risk and potential reputational harm from the activities of these third parties including, but not limited to, export control violations, workplace conditions, corruption and anti-competitive behavior. We cannot be certain that our distribution channel will continue to market or sell our products and services effectively. If our partner and distribution channels are not successful, we may lose sales opportunities, customers and revenue. If our distributors favor our competitors' products or services for any reason, they may fail to market our products or services effectively, which would cause our results to suffer. If our OEMs through which we distribute products and services decide not to bundle our applications on their devices, our results could suffer. Further, the financial health of our distributors and partners and our continuing relationships with them are important to our success. Some of these distributors and partners may be unable to withstand adverse changes in economic conditions, which could result in insolvency, the inability of such distributors and partners to obtain credit to finance access to or purchases of our products and services, or a delay in paying their obligations to us. We also sell some of our products and services through our direct sales force. Risks associated with this sales channel include more extended sales and collection cycles, challenges related to hiring, retaining and motivating our direct sales force, 26 and substantial amounts of ongoing training for sales representatives. Moreover, recent hires may not be as productive as we would like, as in most cases it takes significant time for them to achieve full productivity. Our business could be seriously harmed if our expansion efforts of our direct sales do not generate a corresponding significant increase in revenue and we are unable to achieve the efficiencies we anticipate. In addition, the loss of key sales employees could impact our customer relationships and future ability to sell to certain accounts covered by such employees.