Company: NET
Filing Date: 2025-10-30
Form Type: 10-Q
Source: 0001477333-25-000141
Chunk: 507

Company: Cloudflare, Inc.
Filing Date: 2025-10-30
Form: 10-Q
Item: Part I, Item 8
Chunk 507
---
-bribery laws, governmental trade sanctions laws, import and export controls, anti-corruption and anti-bribery laws, federal securities laws, and tax laws and regulations. In addition, emerging tools and technologies we may utilize in providing our products and solutions, like AI and machine learning, have, and may in the future, become subject to regulation under new laws or new applications of existing laws. For example, the EU AI Act has gone into effect and several U.S. states are also enacting laws governing the use of AI. In certain jurisdictions, some or all of these regulatory requirements may be more stringent than in the United States.

In addition, the United States, the EU, and other jurisdictions are considering expanding or have expanded regulatory requirements for services such as ours, with potential requirements such as collection and verification of customer data, limitations on the use of non-personal data, limitations on the transfer of certain types of data to named countries or entities, data switching obligations, requirements to block online content in response to regulatory notices or judicial orders, cybersecurity incident reporting obligations, expanded registration requirements, or requirements to have personnel in the country. The rapid expansion of proposed regulations, as well as possible conflicting requirements, may make it challenging for us to identify and comply with all new global regulations that may apply to our services. For example, the new EU Data Act imposes service switching obligations designed to remove commercial and technical obstacles for customers by phasing out switching charges and requiring us to assist with data portability. It also imposes requirements related to the cross-border data transfer of non-personal data. We may be required to provide more flexible termination rights to customers and incur substantial costs to comply with the EU Data Act, as well as become subject to substantial fines or civil litigation for noncompliance.

These laws and regulations impose added costs on our business. Actual or perceived noncompliance with applicable regulations or requirements could subject us to:

•investigations, enforcement actions, and sanctions;

•mandatory changes to our network and products;

•disgorgement of profits, fines, and damages;

•civil and criminal penalties or injunctions;

•claims for damages by our customers or channel partners;

•substantial changes to our termination of contracts;

•loss of intellectual property rights; and

•temporary or permanent debarment from sales to government organizations.

If any governmental sanctions are imposed, or if we do not prevail in any possible civil or criminal litigation, our business, results of operations, and financial condition could be adversely affected. In addition, responding to