Failure to protect our brands or a failure by our company to uphold the Thomson Reuters Trust Principles may also adversely impact our credibility as a trusted supplier of content and may have a negative impact on our information and news business.
There is a focus from some stakeholders on corporate responsibility, specifically relating to ESG initiatives and corporate sustainability reporting. We pursue ESG initiatives because they contribute to value creation for our customers, employees, shareholders and other stakeholders. In 2025, we completed our second ESG double materiality assessment to comply with new global regulations. We have set a number of targets related to these initiatives and identified and prioritized ESG issues, risks and opportunities. Standards for tracking and reporting ESG matters continue to evolve and we may not be able to implement new and changing standards in ways that meet the expectations of all of our stakeholders. If we fail to satisfy the expectations of investors, customers, vendors, employees, regulators and other stakeholders related to our ESG performance and in our corporate sustainability reporting or our ESG initiatives are not executed as planned, it could adversely affect our reputation, business, share price, financial condition or results of operations. Due to the shifting legal and policy landscape, as well as changing stakeholder expectations, our reputation also may be harmed by negative perceptions that our customers, employees and other stakeholders may have about our action or inaction on social, ethical, or political issues.
Social and ethical issues relating to the use of new and evolving technologies, such as AI, in our products and services could adversely affect our business, financial condition or results of operations.
Many of our products and services use new and evolving technologies, such as AI. These often present social and ethical risks and challenges that could affect their adoption and therefore our business. For example, the use of AI in our products may give rise to risks related to harmful content, inaccuracy, misinformation, bias, discrimination, IP infringement or misappropriation, defamation, data privacy and cybersecurity, among others. We may not have insight into, or control over, the practices of third parties who utilize AI technologies. As such, we cannot guarantee that third parties will not use AI technologies for improper purposes. If we enable or offer AI solutions, or enter into partnerships with third parties or engage third party vendors in respect of AI technologies, that result in any of the foregoing or otherwise draw controversy due to their perceived or actual impact on society, we may experience brand or reputational harm, competitive harm or legal liability and regulatory scrutiny.
Evolving government regulation related to AI use and ethics, or requirements from third-party groups, such as local bar associations or tax licensing boards, may also increase the burden and cost of research and development in this area and failure to properly remediate AI usage or ethics issues may cause public confidence in AI to be undermined, which could slow adoption of AI in our products and services. The rapid evolution of AI will require the application of resources to develop, test and maintain our products and services to help ensure that AI is implemented ethically in order to minimize unintended, harmful impacts. If we do not maintain ethical and transparent policies and procedures related to AI, this could result in reputational harm and legal liability, which could adversely affect our business, financial condition or results of operations.
Technology and Data Risks
We and our third-party providers face risks related to cybersecurity threats and incidents that could adversely affect our reputation, business, results of operations, and financial condition.
In connection with our business, we rely extensively on our own and third-party information technology systems and infrastructure to provide our products and services and operate our business. Further, we rely on our own and third-party content and other data and information published as part of our products and services. Our company has been subject to and is increasingly likely to continue to be the target of, cyber-attacks and incidents that could negatively impact our systems, information and data. Cyber-threats and cyber-attacks vary in technique and sources, are persistent, frequently change and are increasingly becoming more sophisticated and targeted. Especially with the use of emerging technologies, such as advanced forms of AI, cyber-attacks and incidents have become increasingly more difficult to detect and prevent. The occurrence of these attacks and incidents may also increase due to the increased reliance on information technology, growing number of integrations and network connections with third-party services, customers, or partners, remote access from hybrid and remote workers, heightened geopolitical tensions and the prominence of our Reuters business.
While we and third-party information services that we use have information security programs and security measures in place designed to protect our information technology systems and infrastructure, these programs and these measures may not prevent all material breaches caused by cyber-attacks and incidents, including without limitation:
•Cyber-attacks on our own and third-party information technology systems and infrastructure that we rely upon, including without limitation attacks using and incidents arising from computer viruses or other malware, distributed denial of service attacks, ransomware, data theft, phishing, social engineering, destructive attacks against information systems and other attacks or incidents. This also includes those cyber-attacks and incidents that have in the past resulted in and could in the future result in the unauthorized access to, loss, manipulation, destruction of, or disclosure of personal and business information and/or the temporary or sustained unavailability of personal and business information, content, or information technology systems and infrastructure. As technologies like AI develop rapidly, malicious third parties are using these technologies to create new
