45 added · 18 removed between the two most recent 10-Ks. The risks a company starts — or stops — disclosing are often the story.
Newly disclosed
The possession and use of personal information in conducting the Company’s business subjects it to a variety of complex and evolving domestic and foreign laws and regulations regarding data privacy. 12 For example, the European Union’s General Data Protection Regulation (“GDPR”), which became effective in May 2018, imposes specific operational requirements on entities that process personal information (including requirements relating to data transfers to certain countries outside the European Union) and strong enforcement mechanisms.
On January 5, 2026, the OECD released new guidance establishing the Side-by-Side (“SbS”) program under the Pillar Two global minimum tax framework.
These technologies in some cases may be made broadly available to employees, including through embedded features in existing enterprise software or low-code or no-code development environments that enable employees to build or customize AI-enabled tools.
Under the CCPA, a data breach affecting California residents’ personal information because of a failure to maintain reasonable security procedures and practices can trigger a private right of action lawsuit, and as a result data breach litigation is likely to increase.
Further, any actual or perceived failure by the Company or its subsidiaries to comply with applicable laws could result in litigation, reputational harm, governmental enforcement actions or fines, and other penalties that could potentially have an adverse effect on the Company’s operations, financial results and reputation.
This disparity may increase the risk of unauthorized or unintended use of AI, data leakage, regulatory non-compliance, intellectual property infringement, security vulnerabilities, or inconsistent application of Company policies.
As a result, the Company may have limited ability to fully evaluate, test, restrict, monitor or govern the security, data handling practices, model behavior, or downstream uses of such AI technologies before or after deployment.
Uncertainty in the legal regulatory regime relating to AI may require significant resources to modify and maintain business practices to comply with U.S. and non-U.S. laws, the nature of which cannot be determined at this time.
In addition, the Company increasingly relies on third-party technology vendors that regularly deploy new and enhanced AI-enabled features, tools and platforms, often at a rapid pace and with limited advance notice.
The operations of both the talent solutions business and Protiviti include services related to Sarbanes-Oxley, Anti-Money Laundering Act of 2020 reviews, the Bank Secrecy Act of 1970, as amended, and related anti-money laundering regulations, the Dodd-Frank Wall Street Reform and Consumer Protection Act (the “Dodd-Frank Act”), the Foreign Corrupt Practices Act of 1977 and other regulatory compliance services.
In the United States, the California Consumer Privacy Act (the “CCPA”), which became effective in January 2020, limits the collection and use of personal data and mandates that covered companies provide new disclosures to California consumers and afford such consumers new data privacy rights.
The Company may also incur additional costs and operational complexity through attempts to retrofit controls, implement safeguards, restrict access, or discontinue use of certain AI tools after deployment.
No longer disclosed
For example, the European Union’s General Data Protection Regulation (“GDPR”), which became effective in May 2018, imposes specific operational requirements for entities processing personal information, including requirements for data transfers to certain countries outside the European Union, and strong enforcement authorities and mechanisms.
The Company’s use of AI may also lead to novel and urgent cybersecurity risks, including access to or the misuse of personal data, all of which may adversely affect its operations and reputation. 8 Uncertainty in the legal regulatory regime relating to AI may require significant resources to modify and maintain business practices to comply with U.S. and non-U.S. laws, the nature of which cannot be determined at this time.
If the Company fails to comply with Anti-Bribery Laws, anti-forced labor laws or economic sanction regulations, it could be subject to substantial fines or other penalties and reputational harm .
In the U.S., various proposals to raise corporate income taxes are periodically considered such as the Inflation Reduction Act, which introduced a 15% Corporate Alternative Minimum Tax beginning in 2023.
The operations of both the talent solutions business and Protiviti include services related to Sarbanes-Oxley, Anti-Money Laundering Act of 2020 reviews and other regulatory compliance services.
During the global pandemic, the Company reported increased business from services rendered to the public sector due to, among other developments, the volume of unemployment claims and housing assistance claims, as well as the demands faced by public school districts.
It is unknown whether the shift in projects with state, local and other public sector clients will ultimately maintain the same level of business or to what extent business with the public sector may decrease as the effects of the pandemic lessen or change over time.
In addition, an unfavorable outcome in one or more of these cases could cause the Company to change its compensation plans for its employees, which could have a material adverse effect upon the Company’s business. 9 Government regulations may result in prohibition or restriction of certain types of employment services or the imposition of additional licensing or tax requirements that may reduce the Company ’ s future earnings.
These enacted changed in tax laws, treaties or regulations, or their interpretation or enforcement could impact our current or future tax positions while the proposed changes in tax laws, treaties or regulations, or their interpretation or enforcement, could have a material adverse impact on our current or future tax positions.
On an increasing frequency, the Company and its third-party vendors experience security incidents that have resulted in unauthorized access to the Company’s or its third-party vendors’ computer, technology and communications hardware and software systems.
This transition to remote working has also increased the Company’s vulnerability to risks related to the Company’s computer, technology, and communications hardware and software systems and has exacerbated certain related risks, including risks of phishing and other cybersecurity attacks.
Complying with the enhanced obligations imposed by the GDPR and other current and future laws and regulations relating to data storage, use, transfer, residency, privacy and protection has increased and may continue to increase the Company’s operating costs and require significant management time and attention, while any failure by the Company or its subsidiaries to comply with applicable laws could result in governmental enforcement actions, fines and other penalties that could potentially have an adverse effect on the Company’s operations, financial results and reputation.