Expensify Inc

Item 1A. Risk Factors

There haExcept to the extent updated below or previously updated, or to the extent additional factual information disclosed elsewhere in this Quarterly Report on Form 10-Q relates to such risk factors (including, without limitation, the matters discussed in Part I, Item 2 Managements Discussion and Analysis of Financial Condition and Results of Operation), there have been no material changes to the risk factors set forth in Part I, Item IA. "Risk Factors" of our 2023 Annual Report. You should carefully read and consider the risks and uncertainties, together with all of the other information included in the 2023 Annual Report and this Quarterly Report on Form 10-Q, including the section titled Managements Discussion and Analysis of Financial Condition and Results of Operations and our condensed consolidated financial statements and related notes, and other documents that we file with the SEC.

We use third-party artificial intelligence technologies in our business, and the deployment, use, and maintenance of these technologies involve technological and legal risks.

We use third-party artificial intelligence (AI), machine learning, and automated decision-making technologies (collectively, AI Technologies) throughout our business, and are making significant investments in this area.

For example we use AI Technologies to optimize our internal processes, including analyzing and processing receipts and drafting personalized marketing communications.

We expect that increased investment will be required in the future to continuously improve our use of AI Technologies. As with many technological innovations, there are significant risks involved in developing, maintaining and deploying these technologies and there can be no assurance that the usage of or our investments in such technologies will always enhance our products or services or be beneficial to our business, including our efficiency or profitability.

In particular, if the models underlying our AI Technologies are: incorrectly implemented; reliant on incomplete, inadequate, inaccurate, biased or otherwise poor quality data; used without sufficient oversight and governance to ensure their responsible use; and/or adversely impacted by unforeseen defects, technical challenges, cybersecurity threats or material performance issues, the performance of our products, services and business, as well as our reputation, could suffer or we could incur liability resulting from the violation of laws or contracts to which we are a party or civil claims.

We use third-party AI Technologies and infrastructure which may pose operational and data security risks.

We use AI Technologies licensed from third parties, such as OpenAI, in our technologies and our ability to continue to use such technologies at the scale we need may be dependent on access to OpenAIs software and infrastructure. While we believe that there are alternative third-party AI Technologies which would be suitable, we cannot control the availability or pricing of such third-party AI Technologies, especially in a highly competitive environment, and we may be unable to negotiate favorable economic terms with the applicable providers. If any such third-party AI Technologies become incompatible with our solutions or unavailable for use, or if the providers of such models unfavorably change the terms on which their AI Technologies are offered or terminate their relationship with us, our solutions may become less appealing to our customers and our business will be harmed. In addition, to the extent any third-party AI Technologies are used as a hosted service, any disruption, outage, or loss of information through such hosted services could disrupt our operations or solutions, damage our reputation, cause a loss of confidence in our solutions, or result in legal claims or proceedings, for which we may be unable to recover damages from the affected provider.

Additionally, our reliance on third-party AI Technologies, such as those licensed from OpenAI, involves certain data and security risks. While we seek to obtain contractual commitments from the applicable providers that prohibit the use of our data to train or refine their AI models, we may not be able to implement technical measures to prevent such providers from doing so in contravention to their contractual obligations.

The use of generative AI Technologies may produce inaccurate or infringing content, leading to reputational damage and legal challenges.

There is a risk that generative AI Technologies could produce inaccurate or misleading content or other discriminatory or unexpected results or behaviors, such as hallucinatory behavior that can generate irrelevant, nonsensical, or factually incorrect results, all of which could harm our reputation, business, or customer relationships. While we take measures designed to ensure the accuracy of such AI generated content and to monitor for potential inaccuracies, those measures may not always be successful, and in some cases, we may need to rely on end users to report such inaccuracies.\

The regulatory framework governing the use of AI Technologies is rapidly evolving, and we cannot predict how future legislation and regulation will impact our ability to offer products or services that we develop which leverage AI Technologies.

The regulatory framework for AI Technologies is rapidly evolving as many federal, state and foreign government bodies and agencies have introduced or are currently considering additional laws and regulations. Additionally, existing laws and regulations may be interpreted in ways that would affect the operation of our AI Technologies. As a result, implementation standards and enforcement practices are likely to remain uncertain for the foreseeable future, and we cannot yet determine the impact future laws, regulations, standards, or market perception of their requirements may have on our business and may not always be able to anticipate how to respond to these laws or regulations.

Already, certain existing legal regimes (e.g., relating to data privacy) regulate certain aspects of AI Technologies, and new laws regulating AI Technologies have been enacted in China and are expected to enter into force in the United States and the EU in 2024. In the United States, the Biden administration issued a broad Executive Order on the Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence (the 2023 AI Order), that sets out principles intended to guide AI design and deployment for the public and private sector and signals the increase in governmental involvement and regulation over AI Technologies. The 2023 AI Order instructed several other federal agencies to promulgate additional regulations within specific timeframes regarding the use and development of AI Technologies. Already agencies such as the Department of Commerce and the Federal Trade Commission have issued proposed rules governing the use and development of AI Technologies. Additional legislation related to AI Technologies has also been introduced at the federal level and is advancing at the state level. In September 2024, California enacted seventeen new bills that further regulate use of AI Technologies and provide consumers with additional protections around companies use of AI Technologies, such as requiring companies to disclose certain uses of generative AI. These new bills may affect how we use AI Technologies in our business. For example, AB 1008 amends the CCPA to clarify that AI Technologies can generate output that is considered personal information, which would mean that California consumers have a right to request that such personal information generated by AI Technologies be deleted or corrected, pursuant to their rights under the CCPA. Such additional regulations may impact our ability to develop, use and commercialize AI Technologies in the future.

In Europe, on August 1, 2024, the EU Artificial Intelligence Act (the EU AI Act) entered into force, and establishes a comprehensive, risk-based governance framework for AI in the EU market. The majority of the substantive requirements will apply from August 2, 2026. The EU AI Act applies to companies that develop, use and/or provide AI in the EU and includes requirements around transparency, conformity assessments and monitoring, risk assessments, human oversight, security, accuracy, general purpose AI and foundation models, and fines for breach of up to 7% of worldwide annual turnover. In addition, on September 28, 2022, the European Commission proposed two Directives seeking to establish a harmonized civil liability regime for AI in the EU. Once fully applicable, the EU AI Act and the Liability Directives will have a material impact on the way AI is regulated in the EU. Further, in Europe we are subject to the European Union General Data Protection Regulation (the GDPR), which regulates our use of personal data for automated decision making that results in a legal or similarly significant effect on an individual, and provides rights to individuals in respect of that automated decision making. Recent case law from the Court of Justice of the European Union (CJEU) has taken an expansive view of the scope of the GDPRs requirements around automated decision making and introduced uncertainty in the interpretation of these rules. The EU AI Act, together with developing guidance and/or decisions in this area, may affect our use of AI Technologies and our ability to provide, improve or commercialize our services, require additional compliance measures and changes to our operations and processes, result in increased compliance costs and potential increases in civil claims against us, and could adversely affect our business, operations and financial condition.

It is possible that further new laws and regulations will be adopted in the United States and in other non-U.S. jurisdictions, or that existing laws and regulations, including competition and antitrust laws, may be interpreted in ways that would limit our ability to use AI Technologies for our business, or require us to

change the way we use AI Technologies in a manner that negatively affects the performance of our products, services, and business and the way in which we use AI Technologies. We may need to expend resources to adjust our products or services in certain jurisdictions if the laws, regulations, or decisions are not consistent across jurisdictions. Further, the cost to comply with such laws, regulations, or decisions and/or guidance interpreting existing laws, could be significant and would increase our operating expenses (such as by imposing additional reporting obligations regarding our use of AI Technologies). Such an increase in operating expenses, as well as any actual or perceived failure to comply with such laws and regulations, could adversely affect our business, financial condition and results of operations.