Investing in our securities involves a high degree of risk. You should carefully consider the risks and uncertainties described below, together with all of the other information in this report, including the condensed consolidated financial statements and the related notes included elsewhere in this report, before making an investment decision. The risks and uncertainties described below reflect our beliefs and opinions as to the factors and events that could materially and adversely affect our business or the market price of our securities in the future. References to past events are provided by way of example only and are not intended to be a complete listing or a representation as to whether or not any of the risks, events, or uncertainties described below have occurred in the past. The risks and uncertainties described below are not the only ones we face. Additional risks and uncertainties that we are unaware of, or that we currently believe are not material, may also become important factors that materially and adversely affect our business. If any of the following risks actually occurs, our business operations, financial condition, operating results, and prospects could be materially and adversely affected. The market price of our securities could decline due to the materialization of these or any other risks, and you could lose part or all of your investment. Summary of Risk Factors The following summary provides an overview of the material risks we are exposed to in the normal course of our business activities. This risk factor summary does not contain all of the information that may be important to you, and you should read these together with the more detailed discussion of risks set forth following this section, as well as elsewhere in this report under the heading “Management’s Discussion and Analysis of Financial Condition and Results of Operations.” Additional risks beyond those summarized below, or discussed elsewhere in “Risk Factors” and “Management’s Discussion and Analysis of Financial Condition and Results of Operations,” may apply to our activities or operations as currently conducted or as we may conduct them in the future, or to the markets in which we currently operate or may in the future operate. Consistent with the foregoing, we are exposed to a variety of risks, including those associated with the following: •any compromise of our information technology systems or security measures (including of our critical suppliers and service partners), or the unauthorized access of customer or user data; •any slowdown or failure of our technical operations infrastructure, including data centers operated by third parties, or the impact of service outages or delays in the deployment of our applications, or the failure of our applications to perform properly; •our ability to compete effectively in the intensely competitive markets in which we participate, including against non-specialist AI-native solutions; •privacy concerns and evolving domestic or foreign laws and regulations; •any loss of key employees or the inability to attract, develop, and retain highly skilled employees; •our reliance on our network of partners to drive additional growth of our revenues; •our ability to realize a return on our current development efforts or offer new features, such as those involving AI, enhancements, and modifications to our products and services, and our ability to realize a return on the investments we have made toward entering new markets and new lines of business; •exposure to risks inherent to international expansion and sales to customers outside the U.S. or with international operations; •our ability to realize the expected business or financial benefits of company, employee, or technology acquisitions; •government contracts and related procurement regulations; •any dissatisfaction of our users with the deployment, training, and support services provided by us and our partners; •delays in the reflection of downturns or upturns in new sales in our operating results associated with long sales cycles and our subscription model; •our ability to predict the rate of customer subscription renewals or adoptions; •the technical, legal, and regulatory environment in connection with our use of new and evolving technologies in our offerings, such as AI; •any adverse litigation results; •our ability to successfully integrate our applications with third-party technologies; •any failure to protect our intellectual property rights or any lawsuits against us for alleged infringement of third-party proprietary rights; •the impact of continuing global economic and geopolitical volatility and conflicts; •the fluctuation of our quarterly results; •our existing and future debt obligations; and •the limited ability of third parties to influence corporate matters due to our dual class structure and to seek a merger, tender offer, or proxy contest due to Delaware law and provisions in our organizational documents. 41 Table of Contents Risks Related to Our Business and Industry Any slowdown or failure in our technical operations infrastructure or applications may subject us to liabilities and adversely affect our reputation and operating results. We have experienced significant growth in the number of users, transactions, and data that our operations infrastructure supports. If we do not accurately predict our infrastructure requirements or fail to adapt and scale, we may see an increase in service outages or delays, or significant increases in operating costs, which may adversely affect our business and operating results. We have experienced, and may in the future experience, defects, system disruptions, outages, and other performance problems, including the failure of our applications to perform properly. These problems may be caused by a variety of factors, including infrastructure and software or code changes, vendor issues, software and system defects, human error, viruses, worms, security attacks (internal and external), fraud, spikes in customer usage, and denial of service issues. For example, in July 2025, we identified and subsequently remediated an issue impacting reporting from high-volume data sources in the tenants of certain customers that may have yielded incomplete queries without displaying an error message. In addition, we may also encounter difficulties integrating acquired technologies, which may result in the failure of our applications to perform properly. All of these issues may result in increased operational costs, delays in new feature rollouts, customer loss, reputational damage, and legal or regulatory liability, including liability under customer contracts. Such issues have, and may in the future, result in certain parties having unauthorized access to data, which could increase the scope of our liability. Because of the large amount of data that we collect and process in our systems, and the sensitive nature of such data, it is possible that these issues could result in significant disruption, data loss or corruption, or cause the data to be incomplete or contain inaccuracies that our customers and other users regard as significant. Furthermore, our applications are essential to many of the business processes for our customers. For example, our financial management application is essential to our and our customers’ financial planning, reporting, and compliance programs. Any interruption in our service may affect the availability, accuracy, or timeliness of such programs and as a result could damage our reputation, cause our customers to terminate their use of our applications, require us to issue refunds for prepaid and unused subscription services, require us to compensate our customers for certain losses, and prevent us from gaining additional business from current or future customers. In addition, because we use Workday’s financial management application, any problems that we experience with financial reporting and compliance could be negatively perceived by prospective or current customers and negatively impact demand for our applications. Our insurance policies, including our errors and omissions insurance, may be inadequate or may not be available in the future on acceptable terms, or at all, to protect against claims and other legal actions arising from breaches of our contracts, disruptions in our service, including those caused by cybersecurity incidents, failures or disruptions to our infrastructure, catastrophic events and disasters, or otherwise. In addition, our policy may not cover all claims made against us and defending a suit, regardless of its merit, could be costly. We depend on data centers and other infrastructure operated by third parties, as well as internet availability, and any disruption in these operations could adversely affect our business and operating results. We host our applications and serve our customers and users globally from data centers operated by third parties and rely upon third-party vendors to operate certain aspects of our services. We control our applications and data, but we do not control the facilities, operations, and physical security of these locations. Disruption of or interference at these locations has and could in the future impact our operations and our business could be adversely impacted. For example, we have experienced disruptions at certain of our co-location data centers in the U.S. due to high temperatures and power outages that resulted in a brief temporary outage of our services for a subset of our customers. These facilities may also be subject to cybersecurity breaches, capacity constraints, financial difficulties, break-ins, sabotage, intentional acts of vandalism and similar misconduct, natural catastrophic events, as well as local administrative actions, changes to legal or permitting requirements, and litigation to stop, limit, or delay operations, and our disaster recovery planning may not account for all eventualities. Furthermore, our customers and other users access our applications through their internet service providers. If a service provider fails to provide sufficient capacity to support our applications or otherwise experiences service outages, such failure could interrupt our customers’ and other users’ access to our applications, which could adversely affect their perception of our applications’ reliability and our revenues. In addition, certain countries have implemented or may implement legislative and technological actions that either do or can effectively regulate access to the internet, including the ability of internet service providers to limit access to specific websites or content. 42 Table of Contents Any changes in service levels with our infrastructure providers, or any errors, defects, disruptions, or other performance problems with our applications or the infrastructure on which they run, including internet infrastructure, could adversely affect our reputation and may damage our customers’ or other users’ data or result in lengthy interruptions in our services. Interruptions in our services might adversely affect our reputation and operating results, cause us to issue refunds or service credits to customers, subject us to potential liabilities, result in contract terminations, or adversely affect our renewal rates. The markets in which we participate are intensely competitive, and if we do not compete effectively, our operating results could be adversely affected. The markets for enterprise cloud applications, including AI-powered solutions, are highly competitive, with relatively low barriers to entry for some applications or services. Some of our competitors are larger and have greater name recognition, significantly longer operating histories, access to larger customer bases, larger marketing budgets, and significantly greater resources to devote to the research, development, promotion, and sale of their products and services than we do. This may allow our competitors to respond more effectively than us to new or emerging technologies and changes in market conditions. Our primary competitors are Oracle and SAP, well-established providers of financial management and HCM applications, which have long-standing relationships with customers and partners. Some customers may be hesitant to switch vendors or to adopt cloud applications such as ours and may prefer to maintain their existing relationships with competitors. We also face competition from other enterprise software vendors, from regional competitors that only operate in certain geographic markets, and from vendors of specific applications that address only one or a portion of our applications, some of which offer cloud-based or AI-powered solutions. These vendors include, without limitation: Anaplan, Inc., ADP, Coupa Software Inc., Dayforce, Inc., Microsoft, ServiceNow, Inc., and UKG Inc. We may also face greater competition from non-specialist solutions relying on generic large language models (“LLMs”), generative AI, and general-purpose agents to address a broad range of business needs. In order to take advantage of customer demand for cloud and AI-powered applications, legacy vendors are expanding their cloud or AI-powered applications through acquisitions, strategic alliances, and organic development. In addition, other cloud or AI platform companies that provide services in different target markets or industries may develop applications or acquire companies that operate in our target markets or industries, and some potential customers may elect to develop their own internal applications. As the market evolves and as existing and new market participants introduce new types of technologies, such as generative and agentic AI, and different approaches that enable organizations to address their HCM and financial needs, our ability to maintain market differentiation may affect our competitive position. Furthermore, our current or potential competitors may be acquired by, or merge with, third parties with greater available resources and the ability to initiate or withstand substantial price competition. Our competitors may also establish cooperative relationships among themselves or with third parties that may further enhance their offerings, integrations, or resources. Many of our competitors also have major distribution agreements with consultants, system integrators, and resellers and such partners may prefer to maintain their existing relationships with competitors. With the introduction of new technologies, such as generative AI, we expect competition to intensify in the future. As we attempt to sell our products and solutions to potential and current customers, we must demonstrate that our products and solutions are superior to other solutions available to their organizations, including generic LLMs, software created using natural language prompts and generative AI (referred to as vibe coding) and other emerging technologies. If our competitors’ products, services, or technologies, including generative and agentic AI capabilities, become more accepted than our products, if their customer support efforts are preferred by customers, if they are successful in bringing their products or services to market earlier than ours, if they scale at a faster rate, or if their products or services are more technologically capable or resonate more with the market than ours, including having more or easier to use integrations for software solutions used and preferred by our customers, then our revenues could be adversely affected. In addition, our competitors may offer their products and services at a lower price, or may offer price concessions, delayed payment terms, financing terms, or other terms and conditions that are more enticing to potential customers. Due to the complex nature of implementing financial management solutions, the lifecycle of the contracts for such solutions tends to be long. Therefore, if we lose a current customer to a competitor or fail to secure a prospective customer for financial management solutions, there is a long duration before we will be able to approach that customer again with our sales efforts for such solutions. Pricing pressures and increased competition could result in reduced sales, reduced margins, losses, or a failure to maintain or improve our competitive market position, any of which could adversely affect our business and operating results. 43 Table of Contents We may lose key employees or be unable to attract, enable, and retain highly skilled employees. Our success and future growth depend largely upon the continued services of our executive officers, other members of senior management, and other key employees. We do not have employment agreements with our executive officers or other key employees that require them to continue to work for us for any specified period, and they could terminate their employment with us at any time. In February 2026, Aneel Bhusri, formerly Executive Chair, assumed the role of CEO and Carl Eschenbach ceased to serve as CEO. Key employee and executive leadership changes have the potential to disrupt our business, impact our ability to preserve our culture, negatively affect our ability to attract and retain talent, or otherwise have a serious adverse effect on our business and operating results. We have and may continue to execute our growth plan through strategic investments to attract and retain executive officers, senior management, or other key employees that may not be offset by increased performance or revenues. To execute our growth plan, we must attract, enable, develop, and retain highly qualified talent. Our ability to compete and succeed in a highly competitive environment is directly correlated to our ability to recruit and retain highly skilled and experienced employees, especially in the areas of product development, cybersecurity, senior sales executives, and engineers with significant experience in designing and developing software and internet-related services, especially in AI and emerging technologies. The expansion of our sales infrastructure, both domestically and internationally, is necessary to grow our customer base and business. Our business may be adversely affected if our efforts to attract and enable new members of our direct sales force do not generate a corresponding increase in revenues. We have experienced, and we expect to continue to experience, significant competition in hiring and retaining employees with appropriate qualifications. We must also continue to retain, develop, and motivate existing employees through our compensation practices, company culture, and career development opportunities. The compensation and incentives we provide to attract, retain, and motivate employees may not meet the expectations of current and prospective employees as the competition for talent intensifies, and if our stock price decreases or increases at a slower rate than our talent competitors, our equity awards become less effective. As a part of our annual refresh grant cycle in May 2026, we awarded additional equity grants to our most critical talent to bolster their commitment to our company and to further incentivize their performance towards our goals. Further, our current and future office environments and hybrid work policy may not meet the expectations of our employees or prospective employees, and may amplify challenges in recruiting and retention. We believe that a critical component of our success has been our corporate culture and core values. As we continue to grow and change, we may find it difficult to maintain our corporate culture among a larger number of employees who are dispersed throughout various geographic regions, including difficulties due to managing the complexities of communicating with all employees. Efforts to restructure our workforce may be disruptive and adversely impact employee morale or our corporate culture. Failure to maintain or adapt our culture could negatively affect our ability to attract new employees or to retain our current employees and our business and future growth prospects could be adversely affected. We rely on our network of partners to drive additional growth of our revenues, and if these partners fail to perform, our ability to sell and distribute our products may be impacted, and our operating results and growth rate may be harmed. Our strategy for additional growth depends, in part, on sales generated through our network of partners and professional services provided by our partners. If the operations of these partners are disrupted, including as a direct or indirect result of recent macroeconomic conditions, our own operations may suffer, which could adversely impact our operating results. Identifying partners, negotiating and documenting relationships with them, and marketing and promoting partnerships requires significant time and resources, and we cannot ensure that these partnerships will result in increased customer adoption or usage of our applications or increased revenue. We may be at a disadvantage if our competitors are effective in providing incentives to our current or potential partners to favor their products or services or to prevent or reduce subscriptions to our services, or in negotiating better rates or terms with such partners, particularly in international markets where our potential partners may have existing relationships with our competitors. In addition, acquisitions of our partners by our competitors could end our strategic relationship with such acquired partner and result in a decrease in the number of our current and potential customers. 44 Table of Contents Our partner training and educational programs may not be effective or utilized consistently by partners. New partners may require extensive training and/or may require significant time and resources to achieve productivity, and such requirements may deter potential partners due to the significant time and financial investment required. Changes to our direct go-to-market models and expanded product and service offerings may cause friction with our partners, require increased time and financial investment, and may increase the risk in our partner ecosystem. The actions of our partners may subject us to lawsuits, potential liability, and reputational harm if, for example, any of our partners misrepresent the functionality of our products to prospective or current customers, fail to perform services to our customers’ expectations, or violate laws or our corporate policies, such as laws and policies around privacy, cybersecurity, and responsible AI. In addition, we resell certain products and services offered by our partners and could incur potential liability and reputational harm if our partners fail to provide such products and services as represented to customers. Our partners may utilize our platform to develop products and services that could potentially compete with products and services that we offer currently or in the future. Concerns over competitive matters or intellectual property ownership could constrain these partnerships. If we fail to effectively manage and grow our network of partners, maintain good relationships with our partners, or properly monitor the quality and efficacy of their service delivery, or if our partners do not effectively market and sell our subscription services, use greater efforts to market and sell their own products or services or those of our competitors, or fail to meet the needs or expectations of our customers, our ability to sell our products and efficiently provide our services may be impacted, and our operating results and growth rate may be harmed. If we are not able to realize a return on our current development efforts or offer new features, enhancements, and modifications to our products and services that are desired by current or potential customers, our business and operating results could be adversely affected. Developing software applications and related enhancements, features, and modifications, including those involving AI, including generative and agentic AI or other emerging technologies, is expensive, and the investment in product development often involves a long return on investment cycle. We believe that we must continue to dedicate a significant amount of resources to our development efforts to maintain our competitive position. Accelerated application introductions and short application life cycles require high levels of expenditures that could adversely affect our operating results if not offset by revenue increases. However, we may not receive significant revenues from these investments for several years, if at all. If we are unable to provide new features, enhancements to user experience, and modifications in a timely and cost-effective manner that achieve market acceptance, align with customer expectations, and that keep pace with rapid technological developments and changing regulatory landscapes, it may negatively impact our customer renewal rates, limit the market for our solutions, or impair our ability to attract new customers and our business and operating results could be adversely affected. For example, AI is propelling advancements in technology, but rapid deployment of generative and agentic AI technologies can increase operational, legal, and reputational risks. If we fail to innovate and keep up with advancements in AI technology; if Workday’s AI-powered solutions, including our current and planned agentic AI solutions, fail to be delivered as planned or at all, fail to operate as expected, or fail to meet customer expectations; if our AI solutions generate inaccurate, incomplete, or misleading outputs and if our customers rely on or use such outputs to their detriment; if we fail to successfully monetize our AI-powered solutions; or if we do not have sufficient access to development resources and the technologies required to build and improve our applications, our business and reputation may be harmed. 45 Table of Contents If we are not able to realize a return on the investments we have made toward entering new markets and new lines of business, our business and operating results could be adversely affected. We continue to seek opportunities to enter into new markets and/or new lines of business, some of which we may have very limited or no experience in. For example, we have and continue to make significant targeted investments in entering the medium-enterprise and U.S. federal government markets and see our success in these markets as key contributors to our future growth. Additionally, we have made and continue to make significant investments in platform offerings and AI, including generative AI and agentic capabilities. As an entrant to new markets and new lines of business, we may not be effective in convincing prospective customers that our solutions will address their needs, and we may not accurately estimate our infrastructure needs, human resource requirements, or operating expenses with regard to these new markets and new lines of business. We may also fail to accurately anticipate adoption rates of these new lines of business or their underlying technology. Also, we may not be able to properly price our solutions in these new markets, which could negatively affect our ability to sell to customers. The markets and monetization strategies for certain of our offerings, including our agentic AI solutions and Workday Data Cloud, remain relatively new and uncertain and as a result, our expansion into such offerings, and related investments, may present additional risks and challenges. For example, we offer certain AI and platform capabilities through a subscription-based flexible pricing model and may increase the number of products through which we do so. Our success is dependent on our ability to determine optimal pricing under this model, our ability to educate customers and effectively market and sell our AI solutions, the level of adoption and usage of our AI solutions by our customers, and our costs to deliver these solutions. Furthermore, customers in these new markets or of the new lines of business may demand more or different features and professional services, which may require us to devote even greater research and development, sales, support, and professional services resources to such customers. If we fail to generate adequate revenues from these new markets and lines of business, or if we fail to do so within the envisioned timeframe, it could have an adverse effect on our business, financial condition, and operating results. Our international presence, continued expansion, and sales to customers outside the U.S. or with international operations expose us to risks inherent in global operations. The growth of our business and future prospects depends on our ability to further expand our operations and increase our sales outside of the U.S. as a percentage of our total revenues. Operating globally requires significant resources and management attention and subjects us to regulatory, economic, and political risks that are different from those in the U.S. Our investments and efforts to further expand internationally may not be successful in creating additional demand for our applications outside of the U.S. or in effectively selling subscriptions to our applications in all of the markets we enter. Risks associated with doing business on a global scale that could adversely affect our business, include: •the need to develop, localize, and adapt our applications and customer support for specific countries; •the need to successfully develop and execute on a localized go-to-market strategy; •the need to adhere to local laws and regulations, including those related to data localization, privacy, and anti-corruption, which may make it more difficult to penetrate certain international market segments with highly specialized compliance, contracting, and data sovereignty requirements; •difficulties in appropriately staffing and managing foreign operations and providing appropriate compensation and benefits for local markets; •difficulties in leveraging executive presence, maintaining company culture globally, and conforming with local cultural contexts and customs; •increased travel, real estate, infrastructure, and legal and regulatory compliance costs associated with international operations; •different pricing environments, longer sales cycles, and longer trade receivables payment cycles, and collections issues; •new and different sources of competition; •potentially weaker protection for intellectual property and other legal rights than in the U.S. and practical difficulties in enforcing intellectual property and other rights; •laws, contracting approaches, customs, and business practices favoring local vendors over U.S.-based companies, which may be increased by geopolitical tensions; •restrictive governmental actions focused on cross-border trade, such as import and export restrictions, duties, quotas, potential or imposed tariffs, trade disputes, and barriers or sanctions, as well as any retaliatory actions, that may prevent us from offering certain portions of our products or services to a particular market, may increase our operating costs, or may subject us to monetary fines or penalties; •compliance challenges related to the complexity of multiple, conflicting, and changing governmental laws and regulations, including employment, tax, privacy, intellectual property, financial services, AI, and data protection laws and regulations, as well as challenges with differing legal, alternative dispute, and regulatory systems; •increased compliance costs related to government regulatory reviews or audits, including those related to international cybersecurity and sustainability requirements; 46 Table of Contents •increased financial accounting and reporting burdens and complexities; •the effects of currency fluctuations on our revenues and expenses and customer demand for our services; •restrictions on the transfer of funds; •adverse tax consequences and tax rulings; and •unstable economic and political conditions. Certain of the above factors have and may continue to negatively impact our ability to sell our applications and offer services globally, reduce our competitive position in foreign markets, increase our costs of global operations, reduce demand for our applications and services from global customers, or subject us to legal or regulatory liability. Additionally, the majority of our international costs are denominated in local currencies and we anticipate that over time an increasing portion of our sales contracts may be outside the U.S. and will therefore be denominated in local currencies. Fluctuations in the value of foreign currencies, which may be amplified by macroeconomic events, may impact our operating results when translated into U.S. dollars. Such fluctuations may also impact our ability to predict our future results accurately. If we are not able to successfully hedge against the risks associated with foreign currency fluctuations, our financial condition and operating results could be adversely affected. We have acquired, and may in the future acquire, other companies, employee teams, or technologies, which could divert our management’s attention, result in additional indebtedness or dilution to our stockholders, and otherwise disrupt our operations and adversely affect our operating results. We have acquired, and may in the future acquire, other companies, employee teams, or technologies to complement or expand our applications, enhance our technical capabilities, obtain personnel, or otherwise offer growth opportunities. The pursuit of acquisitions may divert the attention of management, disrupt ongoing business, and cause us to incur various expenses in identifying, investigating, and pursuing suitable acquisitions, whether or not they are consummated. These impacts may continue through integration activities. Moreover, we may be unable to complete proposed transactions timely or at all for a variety of reasons, such as our failure to obtain any necessary funding, the failure to obtain required regulatory or other approvals, or the impact of litigation or other disputes. We also may not achieve the anticipated benefits from an acquisition due to a number of factors, including: •inability or difficulty integrating the intellectual property, technology infrastructure, and operations of the acquired business, including difficulty in addressing potential identified or unknown security risks or vulnerabilities of the acquired business or product; •inability to retain key personnel or challenges in integrating the workforce from the acquired company, including the inability to maintain our culture and values; •acquisition-related costs, liabilities, or tax impacts, some of which may be unanticipated; •the impact on stockholder dilution and our operating results from the additional stock-based compensation issued in connection with the acquisition; •difficulty in leveraging the data of the acquired business if it includes personal data; •a failure to maintain the information systems of an acquired business, including difficulties in increasing or maintaining the security standards for acquired technology, which could increase the risk of a security breach of such system; •a failure to implement, restore, or maintain controls, procedures, or policies at the acquired company and an increased risk of non-compliance; •multiple product lines or service offerings as a result of our acquisitions that are offered, priced, and supported differently, as well as the potential for such acquired product lines and service offerings to impact the profitability of existing products; •the opportunity cost of diverting management and financial resources away from other products, services, and strategic initiatives; •difficulties and additional expenses associated with synchronizing product offerings, customer relationships, and contract portfolio terms and conditions between Workday and the acquired business; •known and unknown liabilities or risks associated with the acquired businesses, including those arising from existing contractual obligations or litigation matters; •adverse effects on our brand, reputation, or existing business relationships with business partners and customers as a result of the acquisition, including integrating acquired technologies and a delay in market acceptance of and difficulty in transitioning new and existing customers to acquired product lines or services; •risks and challenges presented by the use of innovative technologies that we acquire, such as AI; •potential write-offs of acquired assets and potential financial and credit risks associated with acquired customers; •inability to maintain relationships with key customers, suppliers, and partners of the acquired business; •difficulty in predicting and controlling the effect of integrating multiple acquisitions concurrently; •lack of experience in new geographies, markets, products, or technologies; 47 Table of Contents •difficulty in integrating operations and assets of an acquired foreign entity with differences in language, culture, or country-specific currency and regulatory risks; •the inability to obtain (or a material delay in obtaining) regulatory approvals necessary to complete transactions or to integrate operations, or potential remedies imposed by regulatory authorities as a condition to or following the completion of a transaction, which may include divestitures, ownership or operational restrictions or other structural or behavioral remedies; and •the failure of strategic acquisitions to perform as expected or to meet financial projections, which may be heightened due to recent macroeconomic events and market volatility. In addition, a significant portion of the purchase price of companies we acquire has been and may in the future be allocated to acquired goodwill and other intangible assets, which must be assessed for impairment at least annually. In the future, if our acquisitions do not yield expected returns, we may be required to take charges to our operating results based on this impairment assessment process, which could adversely affect our operating results. Acquisitions could also result in use of substantial portions of our available cash, which may limit other potential uses of cash, and dilutive issuances of equity securities or the issuance of debt, which could adversely affect our operating results. If we finance acquisitions by issuing debt, we could face constraints related to the terms of and repayment obligation related to the incurrence of such indebtedness. In addition, if an acquired business fails to meet our expectations, our business, financial condition, and operating results may suffer. Our business could be adversely affected if our users are not satisfied with the deployment, training, and support services provided by us and our partners. Implementation of our applications may be technically complicated because they are designed to enable complex and varied business processes across large organizations, integrate data from a broad and complex range of workflows and systems, and manage, develop, and build AI-powered solutions and agents, and may involve deployment in a variety of environments. Incorrect or improper implementation or use of our applications, including generative and agentic AI capabilities, could result in customer and user dissatisfaction and harm our business and operating results. In order for our customers to successfully implement our applications, they need access to highly skilled and trained service professionals. Third parties provide a majority of deployment services for our customers, but professional services may also be performed by our own staff or by a combination of the two. If customers are not satisfied with the quality, timing, and cost of work performed by us or a third party or with the type of professional services or applications delivered, or if we or a third party have not delivered on commitments made to our customers, then we could incur additional costs to address the situation, the revenue recognition of the contract could be impacted, and the dissatisfaction with our services could damage our ability to expand the applications subscribed to by our customers. Negative publicity related to our customer relationships, regardless of its accuracy, may further damage our business by affecting our ability to compete for new business with current and prospective customers both domestic and abroad. Customers and other users also depend on our support organization to provision the environments used by our customers and to resolve technical issues relating to our applications. Increased demand for these services, without corresponding revenues, could increase costs and adversely affect our operating results. Failure to maintain high-quality technical support and training, or a market perception that we do not maintain high-quality support or training, could adversely affect our reputation, our ability to offer and sell our applications, our renewal rates, and our business and operating results. Our future success depends on the rate of customer subscription renewals, and our revenues or operating results could be adversely impacted if we do not achieve renewals at expected rates or on anticipated terms. Our customers have no obligation to renew their subscriptions for our applications after the expiration of either the initial or renewed subscription period and it is difficult to predict attrition rates given our varied customer base and the number of multi-year subscription contracts. Our customers’ renewal rates fluctuate as a result of a number of factors, including our mix of customer base and their level of satisfaction with our offerings and pricing, their awareness and adoption of the benefits and features of our applications, their ability to continue their operations and spending levels, reductions in their headcount, the evolution of their business, and the macroeconomic environment. Acquisitions of our customers by other companies have led, and could continue to lead, to cancellation of our contracts with those customers, thereby reducing the number of our existing and potential customers. If our customers do not renew their subscriptions for our applications on similar pricing terms or renew for fewer elements of our offerings or for a lower headcount, our revenues may decline, and we may not be able to meet our revenue projections, which could negatively impact our business and the market price of our Class A common stock. 48 Table of Contents Our future success also depends, in part, on our ability to sell additional products to our current customers, and the success rate of such endeavors is difficult to predict, especially with regard to any new lines of business that we may introduce from time to time. This has and may continue to require increasingly costly marketing and sales efforts that are targeted at senior management, and if these efforts are not successful, our business and operating results may suffer. Similarly, the rate at which our customers purchase new or enhanced services, including certain of our AI and platform capabilities that we offer through a subscription-based flexible pricing model, depends on a number of factors, including general economic conditions and customer receptiveness to any price changes related to these additional features and services. The use of new and evolving technologies in our offerings at Workday, including generative and agentic AI capabilities, may result in reputational harm and increased litigation, and adversely affect our operating results. We are increasingly building and integrating AI into the Workday product suite, including generative and agentic AI, and we are increasingly using AI products and technologies in the course of running our business at Workday. As with many cutting-edge innovations, these technologies can present new risks and challenges. A quickly evolving technical, legal, and regulatory environment may cause us to incur increased research and development costs, or divert resources from other development efforts, to address ethical, legal, operational, or compliance requirements or other issues related to AI. For example, the European Union’s (“EU”) AI Act (“EU AI Act”) puts new requirements on providers and deployers of AI technologies and we are currently working to ensure compliance with corresponding deadlines. Additionally, existing laws and regulations apply to the development and deployment of AI in new ways, the nature and extent of which are difficult to predict and subject to change over time. The risks and challenges presented by these technologies could undermine public confidence in AI and could increase costs and burdens to us and our customers, which could slow its adoption and affect our business. Many of our products are powered by AI, some of which include the use of generative and agentic AI, for use cases that could potentially impact human, civil, privacy, or employment rights and dignities. To the extent that the products and technologies we develop and deploy rely on the use of generative or agentic capabilities provided by third parties, we face additional uncertainties and liabilities, especially where such third-party capabilities may be insufficient, biased, inaccurate, or of poor quality. Any failure to accurately identify and address our responsibilities and liabilities in this uncertain environment, including with respect to third-party capabilities, and to adequately address relevant ethical and social issues that may arise with such technologies and use cases, as well as failure by others in our industry or actions taken by our customers, employees, suppliers, or end users (including misuse of these technologies), could negatively affect the adoption of our offerings and subject us to reputational harm, regulatory action, or litigation, which may harm our financial condition and operating results. We are currently defending against a lawsuit alleging that certain of our AI-related products and services enable discrimination, and although we believe that such claims lack merit, and the majority of the claims have been dismissed, legal proceedings can be lengthy, expensive, and disruptive to our operations and customers (particularly where, as in the present litigation, the plaintiff may seek to also litigate against certain of Workday’s customers). We may be subject to other litigation and regulatory actions that may cause financial, competitive, and developmental impacts, and could lead to legal liability. Regardless of outcome, these types of claims have and could continue to cause reputational harm to our brand, including our ability to sell newly acquired products that use AI. Our employees, customers, or customers’ employees who are dissatisfied with our public statements, policies, practices, or solutions related to the development and use of AI may express opinions that could introduce reputational or business harm, or cease their relationship with us. If we fail to develop and maintain widespread positive awareness of our brand, our business may suffer. We believe that developing and maintaining widespread positive awareness of our brand is critical to our growth and that the importance of maintaining positive brand awareness will increase as competition in our markets increases. Successfully promoting and maintaining our brand will depend on our ability to provide reliable solutions that meet the needs of our customers, our ability to successfully differentiate our products and solutions from those of our competitors, and the effectiveness of our marketing efforts. However, brand promotion activities may not generate the awareness or increased revenues we anticipate, and even if they do, any increase in revenues may not offset the significant expenses we incur in promoting our brand. If we fail to successfully promote and maintain positive awareness of our brand, or we fail to expand positive awareness of our newer solutions or products, we may fail to attract or retain customers necessary to realize a sufficient return on our brand-building investments. We have and may continue to experience reputational harm from, among other things, the introduction of new products, features, or services that do not meet customer expectations; our use of new and evolving technologies, including AI; service outages or disruptions; issues with product quality or performance; backlash from customers, government entities, or other stakeholders that disagree with our product offering decisions or public policy, ethical, or political positions; significant litigation or regulatory or government actions that negatively reflect on our business practices; and data security breaches or compliance failures. Additionally, the performance of our partners may affect our brand and reputation if customers do not have a positive experience with our partners’ solutions or services. Any unfavorable publicity or perception of our brand or our applications, including any unfavorable candidate or end user experience, could negatively impact our ability to attract and retain customers and also make it more difficult to hire and retain employees. 49 Table of Contents If we are unable to successfully integrate our applications with a variety of third-party technologies, our business and operating results could be adversely affected. We depend on relationships with third-party technology and content providers and other key suppliers, and are also dependent on third parties for the license of certain software and development tools that are incorporated into or used with our applications or used to help improve our own internal systems, processes, or controls. For example, we leverage software and services for development tools and to deliver applications from many third-party suppliers including AWS and Google Cloud. If the operations of these third parties are disrupted, our own operations may suffer, which could adversely impact our operating results. Additionally, if we are unsuccessful in establishing or maintaining our relationships with these third parties, or if the quality of their products or performance is inadequate, our ability to compete in the marketplace or to grow our revenues could be impaired and our operating results may suffer. To the extent that our applications depend upon the successful integration and operation of third-party software in conjunction with our software, any undetected errors or defects in this third-party software, as well as cybersecurity threats or attacks related to such software could prevent the deployment or impair the functionality of our applications, delay new application introductions, result in a failure of our applications, result in increased costs, including warranty and other related claims from customers, and injure our reputation. Any failure of our applications to operate effectively with future network platforms and other third-party technologies, or changes in such technologies that degrade the functionality of our products or give preferential treatment to competitive services, could reduce the demand for our applications, result in customer and end user dissatisfaction, and adversely affect our business and operating results. The extent to which the continuing global economic and geopolitical volatility, and any resulting effect on customer spending, will continue to impact our business, financial condition, and operating results will depend on future developments, which are highly uncertain and difficult to predict. We operate on a global scale, and as a result, our business and revenues are impacted by global economic and geopolitical conditions. Global economic developments, including new or increased tariffs, geopolitical volatilities and conflicts, downturns or recessions, political instability, and global health crises may negatively affect us or our ability to accurately forecast and plan our future business activity. In addition, volatile economic and geopolitical situations have led and could lead to further economic disruption. Any sustained adverse impacts from these and other recent macroeconomic events could materially and adversely affect our business, financial condition, operating results, and earnings guidance that we may issue from time to time, which could have a material effect on the value of our Class A common stock. Our future revenues rely on continued demand by existing customers and the acquisition of new customers who may be subject to economic hardship due to recent macroeconomic events, including concerns about the impact of potential or imposed tariffs, inflation or the interest rate environment, and may delay or reduce their enterprise software spending to preserve capital and liquidity. In connection with recent macroeconomic events, we have experienced and may continue to experience delays in purchasing decisions from existing and prospective customers, increased demand for price concessions and delayed payment terms, and a reduction in customer demand. Our business, financial condition, and operating results may be negatively impacted in future periods due to the prolonged impacts of recent macroeconomic events, which may not be fully reflected in our operating results and overall financial performance until future periods. To the extent recent macroeconomic events adversely affect our business, financial condition, and operating results, it may also have the effect of heightening many of the other risks described in this “Risk Factors” section. Our quarterly results may fluctuate significantly and may not fully reflect the underlying performance of our business. Our quarterly operating results, including our revenues, subscription revenue backlog, operating margin, profitability, and cash flow, may vary significantly in the future and period-to-period comparisons of our operating results may not be meaningful. Accordingly, the results of any one quarter should not be relied upon as an indication of future performance. Additionally, we typically sign a significantly higher percentage of agreements with new customers as well as renewal agreements with existing customers in the fourth quarter of each year, and this year-over-year compounding effect in billing patterns causes the value of invoices that we generate in the fourth quarter to continually increase in proportion to our billings in the other three quarters of our fiscal year. Our quarterly financial results may fluctuate as a result of a variety of factors, including the risks described in this “Risk Factors” section, many of which are outside of our control, and as a result, may not fully reflect the underlying performance of our business. The extent to which recent macroeconomic events could continue to impact our operating results will depend on future developments, which are highly uncertain and difficult to predict. Fluctuations in our quarterly results and related impacts to any earnings guidance we may issue from time to time, including any modification or withdrawal thereof, may negatively impact the value of our securities. 50 Table of Contents Catastrophic or climate-related events may disrupt our business. Our corporate headquarters are located in Pleasanton, California, and we host our applications in data centers operated by third parties located in the U.S., Europe, Canada, and the Asia-Pacific region. The west coast of the U.S. contains active earthquake zones and the southeast is subject to seasonal hurricanes or other extreme weather conditions. Additionally, we rely on internal technology systems, our website, our network, and third-party infrastructure and enterprise applications, which are located in a wide variety of regions, for our development, marketing, operational support, hosted services, and sales activities. In the event of a major earthquake, hurricane, or other natural disaster, or a catastrophic event such as fire, power loss, telecommunications failure, vandalism, civil unrest, cyber-attack, geopolitical instability, war, terrorist attack, acts of violence, insurrection, pandemics or other public health emergencies, or the effects of climate change (such as drought, flooding, heat waves, wildfires, increased storm severity, and sea level rise), we may be unable to continue our operations and have, and may in the future, endure system interruptions, and may experience delays in our product development, lengthy interruptions in our services, breaches of data security, and loss of critical data, all of which could cause reputational harm or otherwise have an adverse effect on our business and operating results. In addition, the impacts of climate change on the global economy and our industry are rapidly evolving. We may be subject to increased regulations, reporting requirements, standards, or stakeholder expectations regarding climate change that may impact our business, financial condition, and operating results. Our disclosures related to corporate responsibility and sustainability-related matters expose us to risks that could adversely affect our reputation and performance. The positions we take on corporate responsibility and sustainability-related matters, human capital management initiatives, and ethical issues from time to time may impact our brand, reputation, or ability to attract or retain customers. In particular, our brand and reputation are associated with our environmental sustainability commitments (including our science-based targets), strong corporate governance practices, inclusivity, and ethical use, and any perceived changes in our dedication to these commitments could impact our relationships with potential and current customers, employees, stockholders, and other stakeholders. Standards and requirements for tracking and reporting corporate responsibility and sustainability-related matters continue to evolve. Our failure to accomplish stated commitments or accurately track and report on these matters on a timely basis, or at all, could adversely affect our reputation and could expose us to increased scrutiny from the investment community as well as enforcement authorities. In addition, our processes and controls may not always comply with evolving standards for identifying, measuring, and reporting sustainability metrics, including sustainability-related disclosures that may be required by various regulatory bodies, and such standards have and may continue to change over time. If our sustainability or other corporate responsibility practices do not align with or meet evolving investor or other stakeholder expectations and standards, then our reputation, our ability to attract or retain employees, and our attractiveness as an investment, business partner, acquirer, or service provider could be negatively impacted. Conflicting laws, regulations, and executive orders and a lack of harmonization of legal and regulatory environments and stakeholder expectations across the jurisdictions in which we operate may create enhanced compliance risks and costs. Risks Related to Cybersecurity, Data Privacy, and Intellectual Property If our information technology systems are compromised or unauthorized access to customer or user data is otherwise obtained, our applications may be perceived as not being secure, our operations may be disrupted, our applications may become unavailable, customers and end users may reduce the use of or stop using our applications, and we may incur significant liabilities. Our applications involve the storage and transmission of our customers’ and other users’ sensitive and proprietary information, including personal or identifying information regarding our customers, their employees, job candidates, customers, prospects, and suppliers, as well as financial, accounting, health, and payroll data. Additionally, our operations and the availability of the services we provide also depend on our information technology systems. As a result, a compromise of our applications or systems, or unauthorized access to, acquisition, use, tampering, release, alteration, theft, loss, or destruction of sensitive data, or unavailability of data or our applications, has and could disrupt our operations or impact the availability or performance of our applications; expose us and our customers to regulatory obligations and enforcement actions, litigation, investigations, remediation and indemnity obligations, or supplemental disclosure obligations; damage our reputation and brand; result in loss of customer, consumer, and partner confidence in the security of our applications; result in an increase in our insurance premiums, suspension or loss of authorization under the Federal Risk and Authorization Management Program (“FedRAMP”) or other authorizations; impair our competitive position; and result in other potential liabilities or related fees, expenses, or loss of revenues, any of which could adversely affect our business and operating results. 51 Table of Contents In the normal course of business, we are and have been the target of malicious cyber-attack attempts and have experienced and may in the future experience other security events, including the compromise of our information systems by computer hackers, employees, contractors, or vendors, as well as those involving attempts to exploit vulnerabilities in third-party technologies or services on which we rely and those involving software bugs, human error, technical malfunctions, or other malfeasance. The financial and personnel resources we employ to implement and maintain security measures, including our information security risk insurance policy, may not be sufficient to address our security needs. The security measures we have in place vary in maturity across the organization and may not be sufficient to protect against security risks, preserve our operations and services and the integrity of customer and personal information, and prevent data loss, misappropriation, and other security breaches. Our logging may not be and has not been sufficient to fully investigate the scope of an incident. Cybersecurity threats and attacks are often targeted at companies such as ours and may take a variety of forms ranging from individuals or groups of security researchers, to insiders, to sophisticated hacker organizations, including state-sponsored actors and financially motivated actors. These threats may be directed at us or at third parties in our supply chain, including cloud service providers, software vendors, open-source software maintainers, and other service providers or partners whose products or services are integrated with or support our platform and solutions. As our market presence grows and as our ecosystem of partners, integrations, and service providers expands, we face increased risks of cybersecurity attack or other security threats, including supply chain attacks. Additionally, as AI technologies, including generative AI models, develop rapidly, threat actors are using these technologies to create sophisticated new attack methods that are increasingly automated, targeted, damaging, and more difficult to defend against. Threat actors may also target our AI models and related infrastructure in ways that we cannot yet anticipate. Further, remote work and resource access, including our hybrid work model, has and may continue to result in an increased risk of cybersecurity-related events, including phishing and other social engineering attacks, exploitation of any cybersecurity flaws that may exist, an increase in the number cybersecurity threats or attacks, and other security challenges as a result of our employees and our service providers continuing to work remotely from non-corporate managed networks. Examples of key cybersecurity risks include viruses, worms, ransomware, and other malicious software programs, along with social engineering attacks, fraud, credential theft or abuse, exploitation of software bugs or other defects, targeted attacks against cloud services and other hosted software, and exploitation of unmanaged software or systems. As the techniques used to obtain unauthorized access or sabotage systems change frequently, are becoming increasingly sophisticated and complex, and often are not identified until they are launched against a target, and because evidence of unauthorized activity may not have been captured or retained, or may be proactively destroyed by unauthorized actors, we may be unable to anticipate or timely detect these attacks, assess the true impact they may have on our business and operations, or to implement adequate preventative measures. Any cyber-attacks and other security events may have a significant or material impact on our business and operating results. There may also continue to be attacks targeting any vulnerabilities in our applications, internally built infrastructure, enhancements, and updates to our existing offerings, or in the many different underlying networks and services that power the internet that our products depend on, most of which are not under our control or the control of our vendors, partners, or customers. Systems and processes designed to protect our applications, systems, software, and data, as well as customer data and other user data, and to prevent data loss and detect security breaches, may not be effective against all cybersecurity threats or perceived threats. We have been subject to such incidents, including through third-party service providers and in connection with acquisitions we have made. In addition, our software development practices have not and may not identify all potential privacy or security issues, and inadvertent disclosures of data have occurred and may occur again. Furthermore, we have acquired or partnered with a number of companies, products, services, and technologies over the years, and incorporated third-party products, services, and technologies into our own products and services. Addressing security issues associated with acquisitions, partnerships, incorporated technologies, and our supply chain requires significant resources, and we have inherited and may in the future inherit additional risks upon integration with or use by Workday. In addition, if a high-profile security breach occurs with respect to an industry peer, our customers and potential customers may generally lose trust in the security of financial management, spend management, human capital management, planning, or analytics applications, or in cloud applications for enterprises in general. We rely on sophisticated information systems and technology, including those provided by third parties, for the secure collection, processing, transmission, and storage of confidential, proprietary, and personal information, and to support our business operations and the availability of our applications. In the past several years, supply chain attacks have increased in frequency and severity. As we are both a provider and consumer of information systems and technology, we are at higher risk of being impacted either directly or indirectly by these attacks. The control systems, cybersecurity program, infrastructure, physical facilities of, and personnel associated with third parties that we rely on or partner with are beyond our control. Our customers may authorize third-party technology providers to access their customer data and any unauthorized use of the third-party technology may result in unauthorized access to such data. The audits we periodically conduct of some of our third-party vendors are unable to prevent security events impacting the information technology systems of third parties we rely on. 52 Table of Contents Privacy concerns, evolving regulation of cloud computing, cross-border data transfer, and other domestic or foreign laws and regulations, including those that seek to regulate access to data, may reduce the adoption of our applications, result in significant costs and compliance challenges, and adversely affect our business and operating results. Legal requirements related to collecting, storing, handling, retaining, and transferring (collectively, “processing”) personal data are rapidly evolving at both the national and international level in ways that require our business to adapt to comply with applicable laws and support customer compliance. As the complexity of our products grows, the regulatory focus on privacy intensifies worldwide, and jurisdictions increasingly consider and adopt privacy laws, the risks related to our business’s processing of personal data also grow. The volume and complexity of these regulatory requirements may continue to increase, including in response to heightened geopolitical tensions and the rapid adoption of AI technologies. In addition, possible adverse interpretations of existing privacy-related laws and regulations by regulators in jurisdictions where our customers operate, as well as the potential adoption of new privacy-related requirements, could impose significant obligations affecting our business or prevent us from offering certain services in jurisdictions where we operate. The global privacy and data protection compliance landscape continues to become increasingly complex, fragmented, and financially relevant to business operations. As a result, our data processing creates current and prospective risks related to increased regulatory compliance costs, government enforcement actions and/or financial penalties for non-compliance, and reputational harm. For example, the EU-U.S. Data Privacy Framework (“DPF”) is in place and provides one method under which EU data can legally be transferred to the U.S. However, it is facing legal challenges. As legal challenges to the DPF remain unresolved, uncertainty may continue regarding the legal requirements for transferring personal data from Europe, an integral aspect of our business that remains governed by, and subject to, General Data Protection Regulation (“GDPR”) requirements. Gaps in compliance with the GDPR data processing requirements by either ourselves or our subprocessors could lead to regulatory enforcement actions, which can result in monetary penalties of up to 4% of worldwide revenue, private lawsuits, reputational damage, and loss of customers. Other EU laws, including the EU Data Act, which primarily governs access to and use of non-personal data generated by digital services, have been, and may continue to be implemented, interpreted, and enforced in ways that impose additional rules and restrictions on the deployment, operation, or use of our products and services and may require us to adapt our business practices or contractual arrangements to comply with such requirements. In addition, potential changes to the laws and regulations that relate to the processing of personal data, including legislative proposals pending in the EU and elsewhere, may change the scope or timing of our compliance obligations. Other countries such as Russia, China, Vietnam, and India have also passed or are in the process of passing laws imposing new requirements, including requirements related to consent and varying degrees of restrictive data residency or localization. Additionally, a final rule issued by the U.S. Department of Justice establishing a “Data Security Program” came into effect on April 8, 2025. The rule prohibits or restricts certain transactions that could result in access to bulk U.S. sensitive personal data or U.S. government-related data by countries of concern, including China (which includes Hong Kong and Macau). The rule imposes certain diligence, security, audit and record-keeping requirements, and may adversely impact certain of our global business operations, including by restricting or conditioning certain data access or transfers involving subsidiaries, affiliates, and vendors. Other regulatory developments in the U.S. present additional risks. For example, the California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives California consumers, including employees, certain rights similar to those provided by the GDPR, and also provide for statutory damages or fines on a per violation basis that could be very large depending on the regulator's assessed severity of the violation. In addition, numerous states have enacted, or are considering, comprehensive privacy laws and other laws that touch on the processing of personal data in specific contexts, including in connection with AI and automated systems. Certain of these laws and related regulations, including those governing the use of automated decision-making technologies in employment and other consequential decisions, have recently taken effect or will take effect in the near term, further contributing to a fragmented and evolving regulatory landscape that has and may continue to create compliance challenges. Furthermore, the U.S. Congress has considered, and may in the future adopt, federal privacy-related legislation and data regulation, and regulators, including the U.S. Federal Trade Commission, have brought and continue to bring enforcement actions related to data protection practices and may undertake its own privacy-related rulemaking. In addition to government activity, privacy advocacy and other industry groups have established or may establish various new, additional, or different self-regulatory standards that customers may require us to adhere to, which may place additional burdens on us. Increasing sensitivity of individuals to the unauthorized processing of personal data, whether real or perceived, and an increasingly uncertain trust climate has and may continue to create negative public reaction to technologies, products, and services such as ours or otherwise expose us to liability. 53 Table of Contents In addition, as AI technologies are increasingly used across the industry, including in connection with data analytics, automation, customer service, and decision-support features, the speed, scale, and complexity of data processing may increase, which may heighten data privacy risks. AI-enabled or agentic AI features may be targeted, misused, or produce outputs or inferences that implicate personal data in ways that are difficult to anticipate or control, potentially resulting in regulatory scrutiny, litigation, or reputational harm, even in the absence of a data breach. Taken together, the costs of compliance with and other obligations imposed by privacy and data protection laws and regulations have and may continue to require modification of our services and operations, limit use or adoption of our services, slow the pace at which we close sales transactions, or otherwise adversely affect our business. In addition, privacy and data protection laws, regulations and related enforcement activities may lead to significant fines, penalties, or liabilities for noncompliance. These requirements may impact how personal data must be stored, accessed, and deleted within the products and services and impose certain limitations on how it may be used or shared. Further, the perception of privacy concerns, whether or not valid, may inhibit the adoption, effectiveness, or use of our applications or otherwise impact our business. Compliance with applicable laws and regulations regarding personal data may require changes in services, business practices, or internal systems that result in increased costs, lower revenue, reduced efficiency, or greater difficulty competing with foreign-based firms which could adversely affect our business and operating results. Any failure to protect our intellectual property rights domestically and internationally could impair our ability to protect our proprietary technology and our brand. Our success and ability to compete depend in part upon our intellectual property. We rely on patent, copyright, trade secret and trademark laws, trade secret protection, and confidentiality or license agreements with our employees, customers, suppliers, partners, and others to protect our intellectual property rights. However, the steps we take to protect our intellectual property rights may be inadequate. We have patent applications pending in the U.S. and throughout the world, but we may be unable to obtain patent protection for the technology covered in our patent applications. In addition, any patents issued to us in the future may not provide us with competitive advantages or may be successfully challenged by third parties. Furthermore, legal standards relating to the validity, enforceability, and scope of protection of intellectual property rights are uncertain. Despite our precautions, it may be possible for unauthorized third parties, including those affiliated with state-sponsored actors, to copy or reverse engineer our applications, including with the assistance of insiders, and use information that we regard as proprietary to create products and services that compete with ours. Some license provisions protecting against unauthorized use, copying, transfer, and disclosure of our technology may be unenforceable under the laws of jurisdictions outside the U.S. In addition, the laws of some countries do not protect proprietary rights to the same extent as the laws of the U.S. We enter into confidentiality and invention assignment agreements with our employees and consultants and enter into confidentiality agreements with the parties with whom we have strategic relationships and business alliances. These agreements may not be effective in controlling access to and distribution of our applications and proprietary information. Further, these agreements do not prevent our competitors or partners from independently developing technologies that are substantially equivalent or superior to our applications. We may be required to spend significant resources to monitor and protect our intellectual property rights. Litigation brought to protect and enforce our intellectual property rights could be costly, time-consuming, and distracting to management and could result in the impairment or loss of portions of our intellectual property. Furthermore, our efforts to enforce our intellectual property rights may be met with defenses, counterclaims, and countersuits attacking the validity and enforceability of our intellectual property rights. Our failure to secure, protect, and enforce our intellectual property rights could have a serious adverse effect on our brand and business. 54 Table of Contents We may be sued by third parties for alleged infringement of their proprietary rights. There is considerable patent and other intellectual property development activity in our industry. Our competitors, as well as a number of other entities and individuals, may own or claim to own intellectual property relating to our industry. From time to time, third parties may claim that our applications and underlying technology infringe or violate their intellectual property rights, even if we are unaware of the intellectual property rights that others may claim cover some or all of our technology or services, and we may be found to be infringing such rights. Any claims or litigation could cause us to incur significant expenses and, if successfully asserted against us, could require that we pay substantial damages or ongoing royalty payments, prevent us from offering our services, require us to change our products, technology, or business practices, or require that we comply with other unfavorable terms. We may also be obligated to indemnify our customers or business partners or pay substantial settlement costs, including royalty payments, in connection with any such claim or litigation and to obtain licenses, modify applications, or refund fees, which could be costly. In addition, we may be sued by third parties who seek to target us for actions taken by our customers, including through the use or misuse of our products. Even if we were to prevail in an intellectual property dispute, any litigation regarding our intellectual property could be costly and time-consuming and divert the attention of our management and key personnel from our business operations. Furthermore, from time to time we may introduce or acquire new products, including in areas where we historically have not competed, which could increase our exposure to patent and other intellectual property claims. Our applications utilize open source software, including open source AI models and platforms, and our strategy of investing in and acquiring such technologies introduces new and heightened risks. Any failure to comply with the terms of one or more of these open source licenses, or to manage the unique risks of open source AI, could negatively affect our business. Our applications include software covered by open source licenses, which may include, by way of example, the GNU General Public License and the Apache License. Furthermore, our strategy includes acquiring and investing in open-source AI platforms and utilizing AI models that may be governed by novel or untested licenses with ambiguous terms, use-based restrictions, or uncertain legal interpretation. Few terms used in either traditional or new AI-focused open source licenses have been interpreted by U.S. courts, and there is a risk that such licenses could be construed in a manner that imposes unanticipated conditions or restrictions on our ability to market our applications. We attempt to comply with all open source licensing conditions that apply to our use of open source software. By the terms of certain open source licenses, we could be required to release the source code of our proprietary software, and to make our proprietary software available under open source licenses, if we combine our proprietary software with open source software in a certain manner. Our increasing integration of proprietary AI agents and platforms with open source components may heighten this “copyleft” risk. In addition, the license terms for certain previously open source software or models that we use have changed and the license terms for future versions of open source software that we use might change, requiring us to pay for a commercial license or re-engineer all or a portion of our technologies. In addition to risks related to open source license requirements, usage of open source software can lead to greater risks than use of third-party commercial software, as open source licensors generally do not provide warranties or controls on the origin of the software. Many of the risks associated with usage of open source software cannot be eliminated and could negatively affect our business. Beyond licensing compliance, our use of and investment in open source AI models and platforms create distinct and significant risks. Open source AI models may be trained on data of unknown or uncertain provenance, which could include copyrighted or otherwise proprietary, confidential, or private information. If our applications or the agents our customers build using our platforms incorporate such models, we could face claims for copyright infringement and other violations. Open source AI components may also be subject to “data poisoning” and other security vulnerabilities. Many of the risks associated with usage of open source software, particularly in the rapidly evolving field of AI, cannot be eliminated and could negatively affect our business. Risks Related to Legal and Regulatory Matters Unfavorable laws, regulations, interpretive positions, or standards governing new and evolving technologies that we incorporate into our products and services, including those involving AI uses, could result in significant cost and compliance challenges and adversely affect our business and operating results. Many of our products and services currently utilize or will utilize new and evolving technologies such as AI. The overall regulatory environment governing these types of technologies is likely to evolve as government interest in these technologies increases. Regulation of these technologies, as well as other technologies that we utilize in our products and services, also varies greatly among international, federal, state, and local jurisdictions and is subject to significant uncertainty. Governments and agencies domestic and abroad may in the future change or amend existing laws, or adopt new laws, regulations, or guidance, or take other actions which may severely impact the permitted uses of our technologies. New and changing laws, regulations, executive orders, directives, and enforcement priorities can also create uncertainty about how such laws and regulations will be interpreted and applied to Workday. 55 Table of Contents For example, the technologies underlying AI and its uses are subject to a variety of laws and regulations, including those governing intellectual property, privacy, data protection, cybersecurity, consumer protection, competition, and equal opportunity, and are expected to be subject to new laws and regulations or new applications of existing laws and regulations. AI is the subject of ongoing review by various U.S. and international governmental and regulatory agencies, and various U.S. states and other foreign jurisdictions are applying, or are considering applying, their cybersecurity, data protection, and product safety laws to AI and its uses or are considering general legal frameworks for AI and its uses, such as the EU AI Act. Any failure by us to comply with applicable laws, regulations, guidance, or other rules could result in costly litigation, penalties, or fines. In addition, these regulations and any related enforcement actions could establish and further expand our obligations to customers, individuals, and other third parties with respect to our products and services, limit the countries in which such products and services may be used, restrict the way we structure and operate our business, require us to divert development and other resources, and reduce the types of customers and individuals who can use our products and services. Furthermore, our customers may operate in foreign jurisdictions, including countries in which we don’t operate, and may be subject to additional laws and regulations outside the scope of our products. Increased regulation and oversight of products or services which utilize or rely on these technologies may result in costly compliance burdens or otherwise increase our operating costs, detrimentally affecting our business. These new technologies could subject us to additional litigation brought by private parties, which could be costly, time-consuming, and distracting to management and could result in substantial expenses and losses. We are subject to risks related to government contracts and related procurement regulations, which may adversely impact our business and operating results. Our contracts with federal, state, local, and foreign government entities are subject to various procurement regulations and other requirements relating to their formation, award, administration, and performance, which present certain risks and challenges not present in private commercial agreements. These risks and challenges include varying governmental budgeting processes and appropriations, contracting policies and requirements, changes in governmental administrations and policies, fluctuations due to government spending cuts and shutdowns, pressure to reduce deficits through spending reductions, highly competitive and lengthy bidding processes, and adherence to complex regulatory requirements and executive orders, and may impact government spending or result in termination of government contracts or delays in contract awards, which could adversely affect our business and operating results. Further, we have experienced and may in the future experience challenges by third parties to contracts awarded with government entities, and our contracting with certain government entities may result in negative publicity or reputational harm. Laws and regulations provide public sector customers with various rights, many of which are not typically found in commercial contracts. For example, some governmental contracts provide for termination by the government at any time, with or without cause, which can adversely affect our business and operating results and impact other existing or prospective government contracts. U.S. federal, state, and local government and foreign government contracts are generally subject to government funding authorizations and appropriations, and contracts may also be terminated due to a lack of government funds. Changes in government procurement policies, priorities, regulations, or technology initiatives may negatively impact our potential for growth in the government sector. We have made, and may continue to make, significant investments to support our efforts to sell to government entities, including obtaining various authorizations and certifications. For example, we have obtained authorization under FedRAMP, which allows us to participate in the U.S. federal government market. Such authorization is subject to rigorous compliance and if we were to lose our authorization, it could inhibit or preclude our ability to contract with certain U.S. federal and state government customers. If we fail to maintain FedRAMP authorization, we may fail to retain existing customers or attract new customers that rely on our authorization under FedRAMP, which could subject us to liability, result in reputational harm, and adversely impact our financial condition or operating results. Government certification requirements applicable to our products and services may change, which could restrict our ability to sell into the public sector until we have received a certification or until we can account for these changes in our service or corporate controls. We may be subject to additional audits and investigations relating to our government contracts, and any violations could result in various civil and criminal penalties and administrative sanctions, including termination of contracts, suspension of payments, payment of fines, and suspension or debarment from future government business, as well as harm to our reputation and financial results. 56 Table of Contents Adverse litigation results could have a material adverse impact on our business. We are regularly involved with claims, suits, purported class or representative actions, and may be involved in regulatory and government investigations and other proceedings, involving competition, intellectual property, data security and privacy, bankruptcy, tax and related compliance, labor and employment, commercial disputes, and other matters. Such claims, suits, actions, regulatory and government investigations, and other proceedings can impose a significant burden on management and employees, could prevent us from offering one or more of our applications, services, or features to others, could require us to change our technology or business practices, or could result in monetary damages, fines, civil or criminal penalties, and have and could continue to cause reputational harm or other adverse consequences. Adverse outcomes in some or all of these claims may result in significant monetary damages or injunctive relief that could adversely affect our ability to conduct our business. The litigation and other claims are subject to inherent uncertainties and management’s view of these matters may change in the future. A material adverse impact in our condensed consolidated financial statements could occur for the period in which the effect of an unfavorable outcome becomes probable and reasonably estimable. Unanticipated tax laws or any change in the application of existing tax laws to us or our customers and unanticipated changes in our effective tax rate may adversely impact our profitability and financial results. We operate and are subject to taxes in the U.S. and numerous other jurisdictions throughout the world. Changes to federal, state, local, or international tax laws on income, sales, use, indirect, or other tax laws, statutes, rules, regulations, or ordinances on multinational corporations have recently been enacted or are currently being considered by the U.S. and other countries where we do business. Contemplated legislative initiatives include, but are not limited to, changes to transfer pricing policies and definitional changes to permanent establishment that could be applied solely or disproportionately to services provided over the internet. These contemplated tax initiatives, if finalized and adopted by countries, may ultimately impact our effective tax rate and could adversely affect our sales activity resulting in a negative impact on our operating results and cash flows. In addition, existing tax laws, statutes, rules, regulations, or ordinances could be interpreted, changed, modified, or applied adversely to us (possibly with retroactive effect), which could require us to pay additional tax amounts, fines or penalties, and interest for past amounts. Existing tax laws, statutes, rules, regulations, or ordinances could also be interpreted, changed, modified, or applied adversely to our customers (possibly with retroactive effect), which could require our customers to pay additional tax amounts with respect to services we have provided, fines or penalties, and interest for past amounts. If we are unsuccessful in collecting such taxes from our customers, we could be held liable for such costs, thereby adversely impacting our operating results and cash flows. If our customers must pay additional fines or penalties, it could adversely affect demand for our services. Significant judgment is often required in the determination of our worldwide provision for income taxes. Our effective tax rate could be impacted by changes in the valuation of deferred tax assets and liabilities and our ability to utilize them. We are also subject to tax examinations and it is possible that the final determination of any examinations will have an adverse effect on our operating results or financial position. Risks Related to Financial Matters Because we encounter long sales cycles when selling to large customers and we recognize subscription services revenues over the term of the contract, downturns or upturns in new sales will not be immediately reflected in our operating results and may be difficult to discern. We generally recognize subscription services revenues over time as services are delivered to the customer, which typically occurs over a period of three years or longer. As a result, most of the subscription services revenues we report in each quarter are derived from the recognition of unearned revenue relating to subscriptions entered into during previous quarters. Consequently, a decline in new or renewed subscription contracts in any single quarter may not be reflected in our revenue results for that quarter but will negatively impact our revenue in future quarters. Additionally, because much of our sales efforts are targeted at large enterprise customers, we face greater costs, longer sales cycles, less predictability in completing some of our sales, and varying deployment timeframes. 57 Table of Contents Our typical sales cycles for many new customers are six to twelve months but can extend for eighteen months or more, and we expect that this lengthy sales cycle may continue or expand as customers increasingly adopt applications across our platform. We have seen and may continue to see instances of increased scrutiny from existing and prospective customers and the lengthening of certain sales cycles. For example, we have recently experienced lengthening of certain sales cycles, particularly within net new opportunities. The extended sales cycles are particularly evident in the government, higher education, and healthcare industries which are tied to federal funding. Longer sales cycles could cause our operating and financial results to suffer in a given period. Accordingly, the effect of significant downturns in sales and market acceptance of new applications, as well as potential changes in our pricing policies or rate of renewals, may not be fully reflected in our operating results until future periods. Additionally, we may be unable to adjust our cost structure to reflect any such changes in revenues. As a result, increased growth in the number of our customers could result in our recognition of more costs than revenues in the earlier periods of the terms of our agreements. Our subscription model also makes it difficult for us to rapidly increase our revenues through additional sales in any period, as subscription services revenues from new customers generally are recognized over the applicable subscription term. Furthermore, our subscription-based model is largely based on the size of our customers’ employee headcount. Therefore, the addition or loss of employees by our customers, including any significant reductions in force by our customers, or customer insolvencies resulting from severe economic hardship, can and has had an impact on our subscription services revenues. Prolonged decreases in our customers’ headcounts can materially impact our business and operating results in any given period. Our current and future indebtedness may adversely affect our financial condition and operating results. In fiscal 2023, we issued $3.0 billion aggregate principal amount of senior notes (“Senior Notes”), consisting of $1.0 billion aggregate principal amount of 3.500% notes due April 1, 2027, $750 million aggregate principal amount of 3.700% notes due April 1, 2029, and $1.25 billion aggregate principal amount of 3.800% notes due April 1, 2032. Additionally, in fiscal 2023, we entered into a credit agreement (“2022 Credit Agreement”) which provides for a revolving credit facility in an aggregate principal amount of $1.0 billion. As of July 31, 2026, we had no outstanding revolving loans under the 2022 Credit Agreement. We may incur substantial additional debt in the future, some of which may be secured debt. It is possible that we will not be able to repay this indebtedness when due or refinance this indebtedness on acceptable terms or at all. In addition, our indebtedness could, among other things: •make it difficult for us to pay other obligations; •make it difficult to obtain favorable terms for any necessary future financing for working capital, capital expenditures, debt service requirements, or other purposes; •adversely affect our liquidity and result in a material adverse effect on our financial condition upon repayment of the indebtedness; •require us to dedicate a substantial portion of our cash flow from operations to service and repay the indebtedness, reducing the amount of cash flow available for other purposes; •limit our flexibility in planning for and reacting to changes in our business; •increase our vulnerability to the impact of adverse economic conditions, including rising interest rates (which can make refinancing existing indebtedness more difficult or costly); and •negatively impact our credit rating, which could limit our ability to obtain additional financing in the future and adversely affect our business. Our Senior Notes and 2022 Credit Agreement also impose restrictions on us and require us to maintain compliance with specified covenants. For example, our 2022 Credit Agreement includes a financial covenant that requires us to maintain a specific leverage ratio. Our ability to comply with these covenants may be affected by events beyond our control. If we breach any of the covenants and do not obtain a waiver from the lenders, then, subject to applicable cure periods, any outstanding indebtedness may be declared immediately due and payable. Any required repayment of our debt as a result of a fundamental change or other acceleration would lower our current cash on hand such that we would not have those funds available for use in our business. 58 Table of Contents We are subject to risks associated with our equity investments, including partial or complete loss of invested capital, and significant changes in the fair value of this portfolio could adversely impact our financial results. We invest in early to late-stage companies for strategic reasons and to support key business initiatives, and we may not realize a return on our equity investments. Many such companies generate net losses and the market for their products, services, or technologies may be slow to develop or never materialize. These companies are often dependent on the availability of later rounds of financing from banks or investors on favorable terms to continue their operations. The financial success of our investment in any company is typically dependent on a liquidity event, such as a public offering, acquisition, or other favorable market event reflecting appreciation to the cost of our initial investment. The capital markets for public offerings and acquisitions are dynamic and the likelihood of liquidity events for the companies we have invested in has and could further deteriorate, which could result in a loss of all or a substantial part of our investment in these companies. Additionally, instability in the global banking system has created bank-specific and broader financial institution liquidity risks and concerns, which may have an adverse impact on the companies we have invested or may invest in. Further, valuations of non-marketable equity investments are inherently complex due to the lack of readily available market data and the anticipated valuation at the time of our investment may not meet our expectations. In addition, we may experience additional volatility to our results of operations due to changes in market prices of our marketable equity investments and the valuation and timing of observable price changes or impairments of our non-marketable equity investments. Volatility in the global market conditions, including recent economic disruptions, inflation, and ongoing volatility in the public equity markets, may impact our equity investments. This volatility could be material to our results in any given quarter and may cause our stock price to decline. In addition, our ability to mitigate this volatility and realize gains on investments may be impacted by our contractual obligations to hold securities for a set period of time. For example, to the extent a company we have invested in undergoes an initial public offering (“IPO”), we may be subject to a lock-up agreement that restricts our ability to sell our securities for a period of time after the public offering or otherwise impedes our ability to mitigate market volatility in such securities. We may discover weaknesses in our internal controls over financial reporting, which may adversely affect investor confidence in the accuracy and completeness of our financial reports and consequently the market price of our securities. As a public company, we are required to design and maintain proper and effective internal controls over financial reporting and to report any material weaknesses in such internal controls. Section 404 of the Sarbanes-Oxley Act of 2002 requires that we evaluate and determine the effectiveness of our internal controls over financial reporting and provide a management report on the internal controls over financial reporting, which must be attested to by our independent registered public accounting firm. If we have a material weakness in our internal controls over financial reporting, we may not detect errors on a timely basis and our financial statements may be materially misstated. The process of compiling the system and processing documentation necessary to perform the evaluation needed to comply with Section 404 is challenging and costly. As we grow our operations and personnel, we will need to continue to improve our operational, financial, and management controls as well as our reporting systems and procedures. In the future, we may not be able to complete our evaluation, testing, and any required remediation in a timely fashion. If we identify material weaknesses in our internal controls over financial reporting, if we are unable to comply with the requirements of Section 404 in a timely manner, if we are unable to assert that our internal controls over financial reporting are effective, or if our independent registered public accounting firm is unable to express an opinion as to the effectiveness of our internal controls over financial reporting, investors may lose confidence in the accuracy and completeness of our financial reports and the market price of our securities could be negatively affected, and we could become subject to investigations by the Financial Industry Regulatory Authority, the SEC, or other regulatory authorities, which could require additional financial and management resources. In addition, because we use Workday’s financial management application, any problems that we experience with financial reporting and compliance could be negatively perceived by prospective or current customers, and negatively impact demand for our applications. 59 Table of Contents Risks Related to Ownership of Our Class A Common Stock Our Co-Founders have control over key decision making as a result of their control of a majority of our voting stock. As of July 31, 2026, our Co-Founder and CEO Emeritus, David Duffield, together with his affiliates, held voting rights with respect to approximately 36 million shares of Class B common stock and 0.1 million shares of Class A common stock. As of July 31, 2026, our Co-Founder, CEO, and Chair of our Board of Directors, Aneel Bhusri, together with his affiliates, held voting rights with respect to approximately 8 million shares of Class B common stock and 0.5 million shares of Class A common stock. In addition, Mr. Bhusri held unvested equity awards representing approximately 1.1 million shares of Class A common stock. Further, Messrs. Duffield and Bhusri have entered into a voting agreement under which each has granted a voting proxy with respect to certain Class B common stock beneficially owned by him effective upon his death or incapacity as described in our registration statement on Form S-1 filed in connection with our IPO. Messrs. Duffield and Bhusri have each initially designated the other as their respective proxies. Accordingly, upon the death or incapacity of either Mr. Duffield or Mr. Bhusri, the other would individually continue to control the voting of shares subject to the voting proxy. Collectively, the shares described above represent a substantial majority of the voting power of our outstanding capital stock. As a result, Messrs. Duffield and Bhusri have the ability to control the outcome of matters submitted to our stockholders for approval, including the election of directors and any merger, consolidation, or sale of all or substantially all of our assets. As stockholders, even as controlling stockholders, they are entitled to vote their shares in their own interests, which may not always be in the interests of our stockholders generally. In addition, Mr. Bhusri has the ability to significantly influence the management and affairs of our company as a result of his position as a member of our Board of Directors and an officer of Workday. Mr. Bhusri, in his capacity as a board member and officer, however, owes a fiduciary duty to our stockholders and must act in good faith in a manner he reasonably believes to be in the best interests of our stockholders. The dual class structure of our common stock has the effect of concentrating voting control with our Co-Founders, as well as with other executive officers, directors, and affiliates, which limits or precludes the ability of non-affiliates to influence corporate matters. Our Class B common stock has 10 votes per share and our Class A common stock, which is the stock that is publicly traded, has one vote per share. Stockholders who hold shares of Class B common stock, including our executive officers, directors, and other affiliates, together hold a substantial majority of the voting power of our outstanding capital stock as of July 31, 2026. Because of the ten-to-one voting ratio between our Class B and Class A common stock, the holders of our Class B common stock collectively will continue to control a majority of the combined voting power of our common stock and therefore be able to control all matters submitted to our stockholders for approval until the conversion of all shares of all Class A and Class B shares to a single class of common stock on the date that is the first to occur of (i) October 17, 2032, (ii) such time as the shares of Class B common stock represent less than 9% of the outstanding Class A and Class B common stock, (iii) nine months following the death of both Mr. Duffield and Mr. Bhusri, or (iv) the date on which the holders of a majority of the shares of Class B common stock elect to convert all shares of Class A common stock and Class B common stock into a single class of common stock. This concentrated control will limit or preclude the ability of non-affiliates to influence corporate matters for the foreseeable future. Future transfers by holders of Class B common stock will generally result in those shares converting to Class A common stock, subject to limited exceptions, such as certain transfers effected for estate planning purposes. The conversion of Class B common stock to Class A common stock will have the effect, over time, of increasing the relative voting power of those holders of Class B common stock who retain their shares in the long term. If, for example, Mr. Duffield and Mr. Bhusri retain a significant portion of their holdings of Class B common stock for an extended period of time, they could, in the future, continue to control a majority of the combined voting power of our Class A common stock and Class B common stock. Our stock price has been volatile in the past and may be subject to volatility in the future. The trading price of our Class A common stock has historically been volatile and could be subject to wide fluctuations in response to the risks described in this “Risk Factors” section, and other risks which are beyond our control. The factors that have and may in the future affect the trading price of our securities include, but are not limited to: •guidance regarding our operating results and other financial metrics that we provide to the public, differences between our guidance and market expectations, our failure to meet our guidance, any withdrawal of previous guidance or changes from our historical guidance; •changes in investor and analyst valuation models for our Class A common stock; •the economy as a whole, political and regulatory uncertainty, and market conditions in our industry and the industries of our customers; •announcements of technological innovations, new applications or enhancements to services, acquisitions, strategic alliances, or significant agreements by us or by our competitors; 60 Table of Contents •disruptions in our services due to computer hardware, software, or network problems or any announcements related to security incidents; •announcements of customer additions and customer cancellations or delays in customer purchases; •recruitment or departure of key personnel; •trading activity by directors, executive officers, and significant stockholders, or the perception in the market that the holders of a large number of shares intend to sell their shares; •actions instituted by activist shareholders or others, and our response to such actions; •any future issuances of our securities; and •changes in the amounts or frequency of stock repurchases. Additionally, the stock markets have at times experienced extreme price and volume fluctuations that have affected and may in the future affect the market prices of equity securities of many companies. These fluctuations have, in some cases, been unrelated or disproportionate to the operating performance of these companies. Further, the trading prices of publicly traded shares of companies in our industry have been particularly volatile and may be very volatile in the future. In the past, some companies that have experienced volatility in the market price of their stock have been subject to securities class action litigation. We may be the target of this type of litigation in the future. Securities litigation against us could result in substantial costs and divert our management’s attention from other business concerns, which could harm our business. We may not realize the anticipated long-term stockholder value of our share repurchase programs. We have share repurchase programs under which we are authorized to repurchase shares of our Class A common stock. Such repurchases may be made through open market transactions, including through the use of trading plans intended to qualify under Rule 10b5-1, through privately negotiated transactions, or by other means, in each case in accordance with applicable securities laws and other restrictions. The share repurchase programs do not have an expiration date, may be suspended or discontinued at any time, and do not obligate us to acquire any amount of our Class A common stock. Any failure to repurchase stock after we have announced our intention to do so may negatively impact our reputation and investor confidence in us and may negatively impact our stock price. Since first authorizing a share repurchase program, there have been periods of time during which we have been unable to repurchase shares, for example, due to the possession of material nonpublic information. The existence of our share repurchase programs could cause our stock price to trade higher than it otherwise would and could potentially reduce the market liquidity for our stock. Our share repurchase programs may not enhance long-term stockholder value because the market price of our common stock may decline below the levels at which we repurchased shares and short-term stock price fluctuations could reduce the effectiveness of this program. Repurchasing our common stock will reduce the amount of cash we have available to fund working capital, repayment of debt, capital expenditures, strategic acquisitions or business opportunities, and other general corporate purposes, and we may fail to realize the anticipated long-term stockholder value of our share repurchase programs. Furthermore, the timing and amount of any repurchases, if any, will be subject to liquidity, market and economic conditions, compliance with applicable legal requirements such as Delaware surplus and solvency tests, and other relevant factors. Delaware law and provisions in our restated certificate of incorporation and amended and restated bylaws could make a merger, tender offer, or proxy contest difficult, thereby depressing the market price of our Class A common stock. Our status as a Delaware corporation and the anti-takeover provisions of the Delaware General Corporation Law (“DGCL”) may discourage, delay, or prevent a change in control by prohibiting us from engaging in a business combination with an interested stockholder for a period of three years after the person becomes an interested stockholder, even if a change of control would be beneficial to our existing stockholders. In addition, our restated certificate of incorporation and amended and restated bylaws contain provisions that may make the acquisition of Workday more difficult, including the following: •any transaction that would result in a change in control of our company requires the approval of a majority of our outstanding Class B common stock voting as a separate class; •our dual class common stock structure, which provides our Co-Founders with the ability to control the outcome of matters requiring stockholder approval, even if they own significantly less than a majority of the shares of our outstanding Class A and Class B common stock; •our Board of Directors is classified into three classes of directors with staggered three-year terms and directors are only able to be removed from office for cause; 61 Table of Contents •when the outstanding shares of our Class B common stock represent less than a majority of the combined voting power of common stock: ◦certain amendments to our restated certificate of incorporation or amended and restated bylaws will require the approval of two-thirds of the combined vote of our then-outstanding shares of Class A and Class B common stock; ◦our stockholders will only be able to take action at a meeting of stockholders and not by written consent; and ◦vacancies on our Board of Directors will be able to be filled only by our Board of Directors and not by stockholders; •only our chair of the board, lead independent director of the board, chief executive officer, presidents, or a majority of our Board of Directors are authorized to call a special meeting of stockholders; •certain litigation against us can only be brought in Delaware; •we will have two classes of common stock until the date that is the first to occur of (i) October 17, 2032, (ii) such time as the shares of Class B common stock represent less than 9% of the outstanding Class A and Class B common stock, (iii) nine months following the death of both Mr. Duffield and Mr. Bhusri, or (iv) the date on which the holders of a majority of the shares of Class B common stock elect to convert all shares of Class A common stock and Class B common stock into a single class of common stock; •our restated certificate of incorporation authorizes undesignated preferred stock, the terms of which may be established, and shares of which may be issued, without the approval of the holders of Class A common stock; and •advance notice procedures apply for stockholders to nominate candidates for election as directors or to bring matters before an annual meeting of stockholders. In addition, Section 203 of the DGCL imposes certain restrictions on mergers, business combinations, and other transactions between us and holders of 15% or more of our common stock, which may discourage, delay, or prevent a change in control of our company. Furthermore, the change in control repurchase event provisions of our Senior Notes may delay or prevent a change in control of our company, because those provisions allow note holders to require us to repurchase such notes upon the occurrence of a fundamental change or change in control repurchase event. These anti-takeover defenses could discourage, delay, or prevent a transaction involving a change in control of our company. These provisions could also discourage proxy contests and make it more difficult for stockholders to elect directors of their choosing and to cause us to take other corporate actions they desire, any of which, under certain circumstances, could depress the market price of our securities. The exclusive forum provision in our organizational documents may limit a stockholder’s ability to bring a claim in a judicial forum that it finds favorable for disputes with us or any of our directors, officers, or other employees, which may discourage lawsuits with respect to such claims. Our restated certificate of incorporation and our bylaws, to the fullest extent permitted by law, provide that the Court of Chancery of the State of Delaware is the exclusive forum for: any derivative action or proceeding brought on our behalf; any action asserting a breach of fiduciary duty; any action asserting a claim against us arising pursuant to the DGCL, our restated certificate of incorporation, or our amended and restated bylaws; or any action asserting a claim against us that is governed by the internal affairs doctrine. There is uncertainty as to whether a court would enforce this exclusive forum provision with respect to claims under the Securities Act. If a court were to find the choice of forum provisions contained in our restated certificate of incorporation to be inapplicable or unenforceable in an action, we may incur additional costs associated with resolving such action in other jurisdictions, which could harm our business, financial condition, and operating results. Our bylaws include a provision providing that the federal district courts of the U.S. will, to the fullest extent permitted by law, be the exclusive forum for resolving any complaint asserting a cause of action arising under the Securities Act (“Federal Forum Provision”). Our decision to adopt a Federal Forum Provision followed a decision by the Supreme Court of the State of Delaware holding that such provisions are facially valid under Delaware law. Application of the Federal Forum Provision means that suits brought by our stockholders to enforce any duty or liability created by the Securities Act must be brought in federal court and cannot be brought in state court. In addition, neither the exclusive forum provision in our restated certificate of incorporation nor the Federal Forum Provision applies to suits brought to enforce any duty or liability created by the Exchange Act. Accordingly, actions by our stockholders to enforce any duty or liability created by the Exchange Act or the rules and regulations thereunder must be brought in federal court, and our stockholders will not be deemed to have waived our compliance with the federal securities laws and the regulations promulgated thereunder. 62 Table of Contents Any person or entity purchasing or otherwise acquiring or holding any interest in any of our securities shall be deemed to have notice of and consented to our exclusive forum provisions, including the Federal Forum Provision. These provisions may limit a stockholders’ ability to bring a claim in a judicial forum of their choosing for disputes with us or our directors, officers, or other employees, which may discourage lawsuits against us and our directors, officers, and other employees. We do not intend to pay dividends for the foreseeable future. We have never declared nor paid cash dividends on our capital stock. We currently intend to retain any future earnings to finance the operation and expansion of our business, and we do not expect to declare or pay any dividends in the foreseeable future. Consequently, stockholders must rely on sales of their common stock after price appreciation as the only way to realize any future gains on their investment. 63 Table of Contents