Company: LIDRW
Filing Date: 2025-02-24
Form Type: 10-K
Source: 0001437749-25-004906
Chunk: 1045

Company: AEye, Inc.
Filing Date: 2025-02-24
Form: 10-K
Item: Item 1A
Chunk 1045
---
 requirements imposed by the Food and Drug Administration, or FDA.

As a lidar technology company, we are subject to the Electronic Product Radiation Control Provisions of the Federal Food, Drug, and Cosmetic Act. These requirements are enforced by the FDA. Electronic product radiation includes laser technology. Regulations governing these products are intended to protect the public from hazardous and unnecessary exposure. Manufacturers are required to certify by way of product labeling and reports to the FDA that their products comply with applicable performance standards as well as maintain manufacturing, testing, and distribution records for their products. Failure to comply with these requirements could result in enforcement action by the FDA, which could require us to cease distribution of our products, recall or remediate products already distributed to customers, or subject us to FDA enforcement actions.

Failures, or perceived failures, to comply with privacy, data protection, and information security requirements in the variety of jurisdictions in which we operate, may adversely impact our business, and such legal requirements are evolving, uncertain, and may require improvements in, or changes to, our policies and operations.

Our current and potential future operations and sales subject us to existing and future laws and regulations addressing privacy and the collection, use, storage, disclosure, transfer, and protection of various types of data. For example, the European Commission has adopted the General Data Protection Regulation, or GDPR, and California enacted the California Consumer Privacy Act of 2018, both of which provide for potentially material penalties for non-compliance. These statutory regimes may, among other things, impose data security requirements, disclosure requirements, and restrictions on data collection, uses, and sharing that may impact our operations and the development of our business. While, generally, we do not have access to, collect, store, process, or share information collected by our solutions, unless our customers choose to proactively provide such information to us, our products may evolve both to address potential customer requirements or to add new features and functionality. Therefore, the full impact of these privacy regimes on our business is rapidly evolving across jurisdictions and remains uncertain at this time.

We may also be affected by cyber-attacks and other means of gaining unauthorized access to our products, systems, and data. For instance, cyber criminals or insiders may target us or third parties with which we have a business relationship in order to obtain data, or in a manner that disrupts our operations or compromises our products, or the systems into which our products are integrated.

       40

We are assessing the continually evolving privacy and data security regimes and measures we believe are appropriate in response