Company: LIDRW
Filing Date: 2025-05-12
Form Type: 10-Q
Source: 0001437749-25-015868
Chunk: 295

Company: AEye, Inc.
Filing Date: 2025-05-12
Form: 10-Q
Item: Part I, Item 3
Chunk 295
---
 and protection of various types of data. For example, the European Commission has adopted the General Data Protection Regulation, or GDPR, and California enacted the California Consumer Privacy Act of 2018, both of which provide for potentially material penalties for non-compliance. These statutory regimes may, among other things, impose data security requirements, disclosure requirements, and restrictions on data collection, uses, and sharing that may impact our operations and the development of our business. While, generally, we do not have access to, collect, store, process, or share information collected by our solutions, unless our customers choose to proactively provide such information to us, our products may evolve both to address potential customer requirements or to add new features and functionality. Therefore, the full impact of these privacy regimes on our business is rapidly evolving across jurisdictions and remains uncertain at this time.

We may also be affected by cyber-attacks and other means of gaining unauthorized access to our products, systems, and data. For instance, cyber criminals or insiders may target us or third parties with which we have a business relationship in order to obtain data, or in a manner that disrupts our operations or compromises our products, or the systems into which our products are integrated.

       57

We are assessing the continually evolving privacy and data security regimes and measures we believe are appropriate in response. Since these privacy and data security regimes are evolving, uncertain, and complex, especially for a global business like ours, we may need to update or enhance our compliance measures as our products, markets, and customer demands further develop, and these updates or enhancements may require implementation costs, which may be material. In addition, we may not be able to monitor and react to all developments in a timely manner. The compliance measures we adopt may prove ineffective. Any failure, or perceived failure, by us to comply with current and future regulatory or customer-driven privacy, data protection, and information security requirements, or to prevent or mitigate security breaches, cyber-attacks, or improper access to, use of, or disclosure of data, or any security issues or cyber-attacks affecting us, could result in significant liability, costs (including the costs of mitigation and recovery), and a material loss of revenue resulting from the adverse impact on our reputation and brand, loss of proprietary information and data, disruption to our business and relationships, and diminished ability to retain or attract customers and business partners. Such events may result in governmental enforcement actions and prosecutions, private litigation, fines and penalties or adverse publicity, and could cause our customers and business partners to