Company: GHC
Filing Date: 2025-02-26
Form Type: 10-K
Source: 0000104889-25-000022
Chunk: 216

Company: Graham Holdings Co
Filing Date: 2025-02-26
Form: 10-K
Item: Item 1A
Chunk 216
---
 Virginia, Colorado, Connecticut and Utah during 2023, other privacy laws have been passed that will go into effect in 2024 and 2025, and data privacy bills continue to be introduced at the state level. There are also comprehensive privacy bills that have been introduced at the U.S. federal level. In addition to the comprehensive privacy laws and bills, the recent emergence of new AI tools has raised some additional information security and privacy issues. There are currently numerous bills for new laws to regulate the use of AI both at the U.S. federal and state level, and in other locations in which the Company does business such as the EU. The passage of any additional laws could result in further uncertainty and cause the Company to incur additional costs and expenses in order to comply. Compliance with the GDPR, the CCPA, the CPRA and other applicable international and U.S. privacy laws can be costly and time-consuming. If the Company fails to properly respond to security breaches of its or its third-party’s information technology systems or fails to properly respond to an individual’s requests under these laws, the Company could experience damage to its 

40

reputation, adverse publicity, loss of consumer confidence, reduced sales and profits, complications in executing the Company’s growth initiatives and regulatory and legal risk, including criminal penalties or civil liabilities.

Claims of failure to comply with the Company’s privacy policies or applicable laws or regulations could form the basis of governmental or private party actions against the Company and could result in significant penalties. Additionally, evolving concerns regarding data privacy may cause the Company’s customers and potential customers to resist providing the data necessary to allow the Company to deliver its solutions effectively. Even the perception that personal information is not satisfactorily protected or does not meet regulatory requirements could inhibit sales and any failure to comply with such laws and regulations could lead to significant fines, penalties or other liabilities. Such claims and actions could cause damage to the Company’s reputation and could have an adverse effect on the Company’s businesses.

•Uncertainty in the Development, Deployment, and Use of AI in the Company’s Products and Services, as Well as its Businesses More Broadly, Could Adversely Affect the Company’s Business and Reputation.

The Company is building and expects to use systems and tools that incorporate AI-based technologies, including generative AI, for its customers and workforce. The development, adoption and use of generative AI technology remains in early stages, and effective or inadequate AI or generative AI development or deployment practices by the Company or third parties could result in unintended consequences.