Apple Inc. (AAPL)

The Company’s business, reputation, results of operations, financial condition and stock price can be materially and adversely affected by a number of factors, whether currently known or unknown, including those described in Part I, Item 1A of the 2025 Form 10-K and Part II, Item 1A of the Form 10-Q for the quarter ended March 28, 2026 (the “second quarter 2026 Form 10-Q”), in each case under the heading “Risk Factors.” Except as for the risk factors set forth below, there have been no material changes to below and those disclosed in Part II, Item 1A of the Company’s risk factors since the 2025 Form 10-K.

The Company’s products and services may be affected from time to time by design and manufacturing defects that could materially adversely affect the Company’s business and result in harm to the Company’s reputation. second quarter 2026

The Company offers complex hardware and software products and services that can be affected by design and manufacturing defects. Sophisticated operating system software and applications, such as those offered by the Company, often have issues that can unexpectedly interfere with the intended operation of hardware or software products and services. Defects can also exist in components and products the Company purchases from third parties. Component defects could make the Company’s products unsafe and create a risk of environmental or property damage and personal injury. These risks may increase as the Company’s products are introduced into specialized applications, including health. In addition, the Company’s service offerings can have quality issues and from time to time experience outages, service slowdowns or errors. As a result, from time to time the Company’s services have not performed as anticipated and may not meet user expectations. The Company’s products and services may also be used in unintended ways, or in a manner that its users allege is harmful. The introduction of new and complex technologies, such as artificial intelligence features, can increase these and other safety risks, including exposing users to harmful, inaccurate or other negative content and experiences. The Company may not be able to detect and fix all issues and defects in the hardware, software and services it offers, which can result in widespread technical and performance issues affecting the Company’s products and services. Errors, bugs and vulnerabilities can be exploited by third parties, compromising the safety and security of a user’s device. In addition, the Company can be exposed to product liability claims, recalls, product replacements or modifications, write-offs of inventory, property, plant and equipment or intangible assets, and significant warranty and other expenses, including litigation costs and regulatory fines. Quality problems can adversely affect the experience for users of the Company’s products and services, and result in harm to the Company’s reputation, loss of competitive advantage, poor market acceptance, reduced demand for products and services, delay in new product and service introductions and lost sales. Form 10-Q

Losses or unauthorized access , which are incorporated by reference herein, there have been no material changes to or releases of confidential information, including personal information, could subject the Company to significant reputational, financial, legal and operational consequences. Company’s risk factors since the 2025 Form 10-K.

The Company’s business requires it to use and store confidential information, including personal and sensitive health and financial information with respect to Future operating results depend upon the Company’s customers ability to obtain components and employees. The Company devotes significant computing resources to systems in sufficient quantities and data security, including through the use of encryption and other security measures intended to protect its systems and data. But these measures cannot provide absolute security, and losses or unauthorized access to or releases of confidential information occur and could materially adversely affect the Company’s business, reputation, results of operations, financial condition and stock price. on commercially reasonable terms.

The Company’s business also requires Company currently obtains certain components from single or limited sources, which exposes it to share confidential information with suppliers, service providers significant supply and other third parties. The Company relies on global suppliers pricing risks. In addition, many components, including those that are also exposed available from multiple sources, are at times subject to cybersecurity, ransomware industry-wide shortages and other malicious attacks significant commodity pricing fluctuations that can disrupt business operations. Although the Company takes steps to secure confidential information that is provided to or accessible by third parties working on the Company’s behalf, such measures are not always effective and losses or unauthorized access to, or releases of, confidential information occur. Such incidents and other malicious attacks could materially adversely affect the Company’s business, reputation, results of operations, financial condition and stock price. For example, the Company is experiencing a period of supply constraints and increasing costs for components driven by factors such as industry supply-demand imbalances for components, including advanced semiconductors, storage (NAND) and memory (DRAM), which adversely affects the Company’s ability to obtain sufficient quantities of components and products on commercially reasonable terms, or at all. The Company expects these trends to intensify, which may materially adversely impact the Company’s revenue, costs, gross margin, results of operations and financial condition. Actions, such as price increases, that have been and may in the future be taken by the Company may not effectively mitigate these negative impacts, and may also reduce demand for the Company’s products and materially adversely affect the Company’s revenue, costs, gross margin, results of operations and financial condition.

Additionally, the Company’s new products often utilize custom components available from only one source. When a component or product uses new technologies, initial capacity constraints may exist until the suppliers’ yields have matured or their manufacturing capacities have increased. The Company experiences malicious attacks and other attempts may not be able to gain unauthorized access to its systems extend or renew agreements for the supply of components on a regular basis. These attacks target the confidentiality, integrity similar terms, or availability of confidential information at all, and may disrupt normal business operations. Attacks can impair not be successful in obtaining sufficient quantities from its suppliers in a timely manner, or in identifying and obtaining sufficient quantities from an alternative source. In addition, component suppliers may fail, be subject to consolidation within a particular industry, or decide to concentrate on the production of common components instead of components customized to meet the Company’s requirements, further limiting the Company’s ability to attract and retain customers for its products and services, affect its stock price, damage commercial relationships, and expose the Company to litigation obtain sufficient quantities of components on commercially reasonable terms, or government investigations, potentially resulting in penalties, fines or judgments. Globally, attacks are expected to continue accelerating in frequency, scale and sophistication with increasing use by actors of tools and techniques that are designed to circumvent controls, avoid detection, and remove or obfuscate forensic evidence, all of which hinders the Company’s ability to identify, investigate and recover from incidents. In addition, attacks against the Company and its customers can escalate during periods of geopolitical tensions or conflict. at all.

Apple Inc. | Q2 2026 Form 10-Q | 21 The Company’s business, including its artificial intelligence and machine learning offerings, also depends on access to sufficient computing resources. Demand for cloud computing and artificial intelligence infrastructure has increased substantially across the technology industry, resulting in constrained supply, extended lead times, and increasing costs. In addition to its own data center infrastructure, the Company relies on third-party cloud service providers to meet these compute needs, and the Company may be unable to secure sufficient capacity on commercially reasonable terms, or at all, to meet customer demand. If the Company is unable to obtain adequate compute capacity in a timely manner or at commercially reasonable rates, this can limit the functionality and availability of its products and services, delay the deployment of new features or offerings, or cause the Company to incur significantly higher costs to operate its business, any of which could materially adversely affect the Company’s revenue, costs, gross margin, results of operations, and financial condition. In addition, the Company may over- or under-estimate requirements, either of which could result in higher-than-expected costs for the Company or an inability to fully satisfy customer demand. Therefore, the Company remains subject to significant risks of supply shortages and price increases that can materially adversely affect its business, results of operations, financial condition and stock price.

The rapid advancement and widespread dissemination of artificial intelligence technologies significantly increases the risks associated with cyberattacks. For example, artificial intelligence technologies are being used to produce highly targeted phishing campaigns, automate the discovery or exploitation of vulnerabilities, generate deepfake content designed to bypass authentication protocols, and identify and exploit vulnerabilities at a highly accelerated pace. As increasingly sophisticated and capable artificial intelligence models continue to become available, these risks are intensifying. Sophisticated and widespread cyberattacks could pose substantial systemic risks, such as cascading failures across interconnected systems, and potential disruptions to critical infrastructure and market stability. In addition, artificial intelligence technologies can themselves be susceptible to security threats, and the development and deployment of artificial intelligence by the Company and its suppliers may expose the Company to additional vulnerabilities and attacks. Company’s future performance depends in part on support from third-party software developers.

Although malicious attacks perpetrated The Company believes decisions by customers to gain access purchase its hardware products depend in part on the availability of third-party software applications and services. Third-party developers may discontinue the development and maintenance of software applications and services for the Company’s products. If third-party software applications and services cease to confidential information, including personal information, affect many companies across various industries, be developed and maintained for the Company is at a relatively greater risk Company’s products, customers may choose not to buy the Company’s products, materially adversely impacting the Company’s business, results of being targeted because of its high profile operations, financial condition and the value of the confidential information it creates, owns, manages, stores and processes. stock price.

As with all companies, The Company believes that third-party developer support depends on the security the Company has implemented may not be sufficient perceived benefits of creating software and services for all eventualities and are vulnerable to hacking, ransomware attacks, employee error, malfeasance, system error, faulty password management or other irregularities. For example, third parties can fraudulently induce the Company’s or its suppliers’ and other third parties’ employees or customers into disclosing usernames, passwords or other sensitive information, which can, in turn, be used for unauthorized access to the Company’s or such suppliers’ or third parties’ systems and services. To help protect customers and the Company, the Company deploys and makes available technologies like multifactor authentication, monitors its services and systems for unusual activity and may freeze accounts under suspicious circumstances, which, among other things, can result in the delay or loss of customer orders or impede customer access to the Company’s products compared to competitors’ platforms, such as Android for smartphones and tablets, Windows for personal computers and tablets, and PlayStation, Nintendo and Xbox for gaming platforms. This analysis may be based on factors such as the market position of the Company and its products, the anticipated revenue that may be generated, expected future growth of product sales, and the costs of developing such applications and services.

While the Company maintains insurance coverage that is intended to address certain aspects of data security risks, such insurance coverage may be insufficient to cover all losses or all types of claims that may arise. Apple Inc. | Q3 2026 Form 10-Q | 21

The Company’s minority market share in the global smartphone, personal computer, tablet and wearables markets can make developers less inclined to develop or upgrade software for the Company’s products and more inclined to devote their resources to developing and upgrading software for competitors’ products with larger market share. When developers focus their efforts on these competing platforms, the availability and quality of applications for the Company’s devices can suffer.

The Company relies on the continued availability and development of compelling and innovative software applications for its products. The Company’s products and operating systems are subject to rapid technological change, and when third-party developers are unable to or choose not to keep up with this pace of change, their applications can fail to take advantage of these changes to deliver improved customer experiences, can operate incorrectly, and can result in dissatisfied customers and lower customer demand for the Company’s products.

The Company distributes third-party applications through the App Store. Where applicable, the Company may retain a commission from sales of applications and sales of digital services or goods initiated within an application. If third-party developers use alternative methods of distribution and payment for their apps and digital content, including direct-to-consumer distribution models, the Company may earn a lower commission on such sales, or may not earn a commission at all, which can materially adversely affect the Company’s revenue, gross margin, results of operations, financial condition and stock price.

The technology industry, including, in some instances, the Company, is subject to intense media, political and regulatory scrutiny, which exposes the Company to increasing regulation, government investigations, legal actions and penalties.

From time to time, the Company has made changes to its business, including actions taken in response to litigation, competition, market conditions and legal and regulatory requirements. The Company expects to make further business changes in the future. For example, in the U.S., the Company has implemented changes to how developers communicate with consumers within apps on the U.S. storefront of the iOS and iPadOS App Store regarding alternative purchasing mechanisms. The Company is also currently subject to a court order in the U.S. preventing it from imposing any commission or fee on certain purchases that consumers make. The Ninth Circuit Court has instructed the California District Court to further amend or modify its injunction to allow the Company to charge a commission. If the Company is ultimately unsuccessful in defending its commission structure or if similar restrictions are imposed or expanded in other jurisdictions, and as a result the Company’s commission is narrowed or eliminated, the Company’s business, results of operations, and financial condition could be materially and adversely affected.

®

App Store regarding alternative purchasing mechanisms. The Company is also currently subject to a court order in the U.S. preventing it from imposing any commission or fee on certain purchases that consumers make. The Ninth Circuit Court has instructed the California District Court to further amend or modify its injunction to allow the Company to charge a commission. If the Company is ultimately unsuccessful in defending its commission structure or if similar restrictions are imposed or expanded in other jurisdictions, and as a result the Company’s commission is narrowed or eliminated, the Company’s business, results of operations, and financial condition could be materially and adversely affected.

Globally, several jurisdictions have adopted, or may in the future adopt, competition-related laws and regulations imposing wide-ranging obligations on technology companies and significant limitations on businesses, including the Company. For example, the Company has implemented changes to iOS, iPadOS, the App Store and Safari

®

in the EU as it seeks to comply with the DMA, including new business terms and alternative fee structures for iOS and iPadOS apps, alternative methods of distribution for iOS and iPadOS apps, alternative payment processing for apps across the Company’s operating systems, and additional tools and application programming interfaces for developers. The In addition, the DMA imposes interoperability obligations on the Company has also continued requiring it to make changes certain of its technologies and features available to its compliance plan in response to feedback third-party products and engagement with services for free, which increases security and privacy risks, requires significant engineering resources, and can adversely affect the Commission. Although functionality, competitiveness, and user experience of the Company’s compliance plan is intended to address products. Interoperability and other requirements have in the DMA’s obligations, it has been challenged by the Commission past, and may be challenged further by private litigants. The DMA provides for significant fines and penalties for noncompliance. While in the changes introduced by future, cause the Company to not launch or maintain products, services and features, such as Siri AI, in the EU are intended to reduce new privacy and security risks that the DMA poses to EU users, many risks will remain. Changes to certain jurisdictions. Any of these outcomes can have a negative impact on the Company’s business in response to the DMA or other laws competitive advantage and regulations could materially adversely affect the Company’s its business, reputation, results of operations, financial condition and stock price.

The Company has also continued to make changes to its DMA compliance plan in response to feedback and engagement with the Commission. Although the Company’s DMA compliance plan is intended to address the DMA’s obligations, it has been challenged by the Commission and may be challenged further by private litigants. The DMA provides for significant fines and penalties for noncompliance. While the changes introduced by the Company in the EU are intended to reduce new privacy and security risks that the DMA poses to EU users, many risks will remain. Changes to the Company’s business in response to the DMA or other laws and regulations in the EU or in other jurisdictions, including the U.S., could materially adversely affect the Company’s business, reputation, results of operations, financial condition and stock price.

The Company is also currently subject to antitrust investigations and litigation in various jurisdictions around the world, which can result in legal proceedings and claims against the Company that could, individually or in the aggregate, have a material adverse impact on the Company’s business, results of operations, financial condition and stock price. For example, the Company is subject to civil antitrust lawsuits in the U.S. alleging monopolization or attempted monopolization in the markets for “performance smartphones” and “smartphones” generally in violation of U.S. antitrust laws. In addition, the Company is the subject of investigations in Europe and other jurisdictions relating to App Store terms and conditions. If such investigations or litigation are resolved against the Company, the Company can be exposed to significant fines and may be required to make further changes to its business practices, all of which could materially adversely affect the Company’s business, reputation, results of operations, financial condition and stock price.

Apple Inc. | Q2 Q3 2026 Form 10-Q | 22

Further, the Company has commercial relationships with other companies in the technology industry that are or may become subject to investigations and litigation that, if resolved against those other companies, could materially adversely affect the Company’s commercial relationships with those business partners and materially adversely affect the Company’s business, results of operations, financial condition and stock price. For example, the Company earns revenue from licensing arrangements with Google LLC (“Google”) and other companies to offer their search services on the Company’s platforms and applications, and certain of these arrangements are currently subject to government investigations and legal proceedings. On August 5, 2024, Google was found to have violated U.S. antitrust laws. In connection with this finding, on September 2, 2025, the U.S. District Court for the District of Columbia (“D.C. District Court”) ordered certain remedies. The court’s order is subject to further proceedings before the D.C. District Court, which may result in changes to the interpretation or application of the remedies ordered by the court, as well as new or changed remedies being ordered. The court’s order was appealed by both the DOJ and Google. A reversal of the order on appeal could result in imposition of certain remedies initially proposed by the DOJ, such as those prohibiting Google from offering the Company commercial terms for search distribution. If implemented, these remedies could materially adversely affect the Company’s ability to earn revenue from such licensing arrangements.

The Company’s business, results of operations, financial condition and stock price can be materially adversely affected, individually or in the aggregate, by the outcomes of such investigations, litigation or changes to laws and regulations in the future. Changes to the Company’s business practices to comply with new laws and regulations or in connection with legal proceedings can negatively impact the reputation of the Company’s products for privacy and security. Such changes in business practices can also otherwise adversely affect the experience for users of the Company’s products and services, and result in harm to the Company’s reputation, loss of competitive advantage, poor market acceptance, reduced demand for products and services, lost sales, and lower profit margins.

The Company’s business is subject to a variety of U.S. and international laws, rules, policies and other obligations regarding the collection, use, protection and transfer of personal data.

The Company is subject to an increasing number of federal, state and international laws relating to the collection, use, retention, protection and transfer of various types of personal data. In many cases, these laws apply not only to third-party transactions, but also restrict transfers of personal data among the Company and its international subsidiaries. Several jurisdictions have passed laws in this area, and additional jurisdictions are considering imposing additional restrictions or have laws that are pending. For example, China has regulatory requirements relating to data processing and localization that govern the Company’s ability to collect, use, and transfer data in China, and could limit the Company’s ability to transfer data outside of China. These laws continue to develop and may be inconsistent from jurisdiction to jurisdiction. Complying with emerging and changing requirements causes the Company to incur substantial costs and has required and may in the future require the Company to change its business practices, including changes to the design of the Company’s products and services and limiting the Company’s ability to offer a product, service or feature to customers. Such changes in business practices can also otherwise adversely affect the experience for users of the Company’s products and services, and result in harm to the Company’s reputation, loss of competitive advantage, poor market acceptance, reduced demand for products and services, lower revenue, and lower profit margins. Noncompliance could result in suspension or revocation of business licenses, significant penalties and legal liability.

The Company makes statements about its use and disclosure of personal data through its privacy policy, information provided on its website, press statements and other privacy notices provided to customers. Any failure or perceived failure by the Company to comply with these public statements or with federal, state or international privacy or data protection laws and regulations could result in inquiries, proceedings and penalties from governmental entities or others. Such a failure or perceived failure could also result in reputational impacts, ongoing audit requirements and significant legal liability. The risks of inadvertent disclosure of personal data can increase with the introduction of new and complex technologies, such as artificial intelligence features, further exacerbating such risks.

In addition to the risks generally relating to the collection, use, retention, protection and transfer of personal data, the Company is also subject to specific obligations relating to the collection and processing of data associated with minors, as well as information considered sensitive under applicable laws, such as health, biometric, financial and payment card data. Health, biometric, financial and payment card data are subject to additional privacy, security and breach notification requirements, and the Company is subject to audit by governmental authorities regarding the Company’s compliance with these obligations. If the Company fails to adequately comply with these rules and requirements, the Company can be subject to litigation or government investigations, can be liable for associated investigatory expenses, and can incur significant fees or fines.

The Company is also subject to new and changing laws, regulations and other legal obligations regarding online safety, including enhanced protections for minors and mandatory age verification requirements. These obligations can increase regulatory risks by requiring complex compliance measures and significant modifications to the Company’s products, services and operations, and may lead to operational disruptions, heightened privacy and data security risks, and increased costs and potential liability and fines, costs, all of which can have a material adverse impact on the Company’s business, financial condition, results of operations operations, financial condition and stock price. Failure to comply with such changing laws, regulations and other legal obligations can also result in

Apple Inc. | Q2 2026 Form 10-Q | 23 significant penalties and fines, and legal liability.

Issues related to artificial intelligence may result in reputational, competitive and financial harm to the Company, regulatory action, legal liability, and other material adverse effects to the Company’s business, results of operations, financial condition and stock price. Apple Inc. | Q3 2026 Form 10-Q | 23

Artificial intelligence technologies are increasingly integrated into the Company’s products and services and its business and operations. These technologies present emerging legal, regulatory, ethical and operational risks that could materially adversely affect the Company’s business, results of operations and financial condition.

For example, the Company’s artificial intelligence efforts may give rise to risks related to: competition and strategy; recouping costs and returns on investments; product liability; intellectual property infringement; data privacy; cybersecurity; sanctions and export controls; exposing users to harmful, inaccurate or other negative content or experiences; bias and discrimination; and online safety and protection of minors; among other issues. While the Company is committed to developing and deploying artificial intelligence responsibly, the Company may be unsuccessful in identifying or resolving all potential issues and failures before they arise. As a result, the Company could be exposed to reputational and competitive harm, regulatory action, legal liability, and other material adverse effects to its business, results of operations, financial condition and stock price.

The Company’s net sales and gross margins are subject to volatility and downward pressure due to a variety of factors.

The Company’s gross margins vary significantly across its products, services, geographic segments and distribution channels and can change over time. The Company’s net sales and gross margins are subject to volatility and downward pressure due to a variety of factors, including: industry-wide supply constraints and increasing costs for components such as advanced semiconductors, storage (NAND) and memory (DRAM); product pricing pressures and product pricing actions that the Company may take in response to such pressures; increased competition; the Company’s ability to effectively stimulate demand for certain of its products and services; compressed product life cycles; supply shortages; potential increases in the cost of outside manufacturing services, and developing, acquiring and delivering content for the Company’s services; the Company’s ability to manage product quality and warranty costs effectively; shifts in the mix of products and services, or in the geographic, currency or channel mix, including to the extent that regulatory changes require the Company to modify its product and service offerings; fluctuations in foreign exchange rates; inflation and other macroeconomic pressures; the imposition of new or increased tariffs and other trade restrictions, their overall magnitude and duration, and retaliatory actions in response; and the introduction of new products or services, including new products or services with lower profit margins. These and other factors could have a materially adverse impact on the Company’s results of operations, financial condition and stock price. Further, the Company generates a significant portion of its net sales from a single product category and a decline in demand for that product could significantly impact net sales and gross margins.

Purchases of Equity Securities by the Issuer and Affiliated Purchasers

Share repurchase activity during the three months ended March 28, June 27, 2026, was as follows (in millions, except number of shares, which are reflected in thousands, and per-share amounts):

(1)

On May 1, 2025, the Company announced a program to repurchase up to $100 billion of the Company’s common stock. As of March 28, June 27, 2026, $36.2 billion of remaining availability under the May 2025 program had been utilized. was $38.0 billion. On April 30, 2026, the Company announced the Board of Directors had authorized an additional program to repurchase up to $100 billion of the Company’s common stock. The programs do not obligate the Company to acquire a minimum amount of shares. Under the programs, shares may be repurchased in privately negotiated or open market transactions, including under plans complying with Rule 10b5-1 under the Exchange Act.

Apple Inc. | Q2 2026 Form 10-Q | 24 (2)

In May 2026, the Company entered into new accelerated share repurchase agreements (“ASRs”). Under the terms of the ASRs, financial institutions committed to deliver shares of the Company’s common stock during the purchase periods in exchange for up-front payments totaling $10.0 billion. The total number of shares ultimately delivered under the ASRs, and therefore the average repurchase price paid per share, is determined based on the volume-weighted average price of the Company’s common stock during the ASRs’ purchase periods, which end in the fourth quarter of 2026.