Morningstar Inc

Item 1A.Risk Factors

In addition to the other information set forth in this Quarterly Report, you should carefully consider the risk factors in Part I, Item 1A. Risk Factors in our Annual Report and in this Report when deciding whether to invest in our common stock or otherwise evaluating our business. If any of those risks or uncertainties materialize, our business, financial condition, and/or operating results could suffer. In that case, the trading price of our common stock could decline, and you may lose all or part of your investment. Our operations could also be affected by other risks and uncertainties that are not presently known to us or that we currently consider immaterial to our operations.

There have been no material changes to the risk factors we have disclosed in the Risk Factors section of our Annual Report other than as provided herein.

The adoption and use of AI technologies, whether incorporated into or accessing our products and tools or implemented by third parties, may present business, legal, compliance, and reputational risks.

We use, and may expand our use of, AI technologies across our products, internal tools, and thirdparty SaaS platforms. While AI offers opportunities to improve efficiency and innovation, it also introduces risks. If we fail to keep pace with AI advancements, or if competitors adopt AI more effectively, our competitive position may be harmed. Slow internal adoption could reduce operational effectiveness, while AIgenerated errors may be incorporated into our processes or products. Our use of AI technologies may require investment of resources and costs to develop, test, and maintain related products and services, and there is no assurance that these investments will be successful. The rapid evolution and adoption of AI may create risks that may be difficult to anticipate or control, particularly where we rely on thirdparty platforms or where our data, analytics or insights are delivered to end users through third-party AI tools or other intermediaries. These risks could lead to operational inefficiencies, reputational harm, or compliance challenges. Inconsistent or decentralized adoption of AI tools across business units, or use of AI tools outside of established governance framework, could increase operational, legal, regulatory and reputational risk.

The pace of adoption and use of AI technologies, including generative AI, in our products and processes and by our clients and end users may increase compliance obligations, regulatory scrutiny, litigation exposure, ethical concerns, and confidentiality or security risks. For example, AI systems may generate content that appears correct but is inaccurate, misleading, biased, or discriminatory, which, if relied upon and attributed to us, could harm our reputation and expose us to liability. We may also face risks relating to data privacy or cybersecurity incidents stemming from our use of AI technologies. Emerging laws and regulations governing AI - such as the EU Artificial Intelligence Act and other evolving global frameworks - may impose burdensome requirements or restrict the deployment of certain AI capabilities in our offerings, and regulations on AI are developing at varying paces, meaning the global regulatory landscape is uncertain, potentially divergent, overlapping and conflicting and could require meaningful compliance efforts and adjustment to our business practices at significant costs. Failure to timely or adequately address these evolving obligations could result in liabilities or fines. Because AI is complex and rapidly developing, it is not possible to predict all of the legal, operational, or technological risks that may arise relating to our use of AI.

AI technologies may use or incorporate data from third-party sources, which may expose us to risks associated with data rights and protection and may also lead to the unintended consequences of using AI discussed above. Also licensing permissions, permitted-use restrictions, ownership of outputs or redistribution rights of third-party data may be uncertain, which could expose us to vendor claims, audits, restrictions on use, remediation obligations, additional fees or litigation. Current laws and court decisions governing intellectual property ownership and license rights may not address new questions relating to AI technologies, which may negatively affect our ability to safeguard our intellectual property, as well as increase the compliance costs associated with navigating an uncertain legal and regulatory environment. In addition, increased use of AI technologies may affect our workforce needs, including our ability to recruit, attract, or retain employees with the skills necessary to support AI-enabled products and processes. We may also face challenges if portions of our existing workforce do not possess, or cannot efficiently develop, the rapidly evolving skill sets required to meet changing business demands, which could adversely impact our operations and competitiveness.

45

In addition, the implementation of AI technologies by competitors and disruptors presents risks to our business. The value of our products and services may be negatively affected by the increasing amount of information and external tools that are available online for free, or at low cost, that use AI to scrape data including our own content from the Internet. These technologies integrate machine learning abilities and other AI systems to process and organize large data sets aggregated from products that previously were paid for, posing an external risk to our product suite. Third-party AI systems may also ingest, train on, reproduce, summarize, simulate or otherwise use our proprietary data, research, ratings, methodologies, content or other intellectual property without permission in ways that are difficult to detect or enforce against.

Several of our businesses are highly regulated throughout the world, and the regulatory environment is increasingly complicated and rapidly evolving.

The expansion of our business, including through acquisitions, has increased our exposure to government regulation across our product lines. Some areas require extensive and ongoing interactions with regulators, which is an increasingly costly and resource intensive process and could result in a finding of noncompliance, which could expose us to fines, sanctions, penalties and reputational risk.

Morningstar DBRS, our credit ratings business, operates in highly regulated environments in Canada, the US, the UK, Australia, and the EU, with substantial ongoing compliance obligations. The scope and interpretation of these regulations can be uncertain and inconsistent across jurisdictions, making compliance challenging and costly. Adhering to any current or expanded requirements that may arise under these frameworks can be complex, resource-intensive, and time-consuming. In addition, Morningstar DBRS is subject to regular regulatory examinations and occasional investigations, which can be time consuming and impact day to day operations.

In the US, Morningstar Investment Management LLC (MIM), is a registered investment adviser under the Investment Advisers Act of 1940 (the 40 Act), and is subject to SEC requirements for record-keeping, reporting, standards of care, and fiduciary obligations. The Morningstar Funds Trust, an open-end mutual fund advised by MIM, subjects MIM to additional 40 Act requirements and the Commodity Exchange Act. These entities face SEC examinations and, when advising retirement plans, may act as Employee Retirement Income Security Act of 1974 (ERISA) fiduciaries, which would require compliance with strict obligations. Breaches, actual or alleged, could result in liability, particularly in retirement advice and managed accounts. Some contracts designate us as ERISA fiduciaries, including selecting and monitoring plan options, and we offer managed account services for plan participants. Such activities have been and may again be subject to class action litigation, including one current case. Many asset management and financial advisor clients are similarly regulated. The failure of our licensed products to meet their regulatory requirements could lead to loss of business.

Our regulated investment services operations are subject to regulation in markets outside the US. Post Brexit, we made a strategic decision to no longer engage new EU domiciled clients for regulated investment management activity, in part to reduce regulatory risk. The UK-based Morningstar Wealth Platform (Platform) has regulatory compliance obligations related to, among other things, the safeguarding and administration of client monies and assets, due to the offering of regulated products and services in the UK. The Platform business has offices in Jersey, South Africa, and the United Arab Emirates, all of which are or have been subject to the Financial Action Task Force (FATF) grey list. Increased regulatory scrutiny in Jersey, which was recently removed from the FATF grey list, and South Africa, which is currently on the FATF grey list, increase compliance costs and exposes us to potential reputational harm.

Our Indexes business, Morningstar Indexes, is subject to the EU Benchmarks Regulation, which mandates certain governance requirements, conflict management, and controls over the benchmark process and require administrators to improve the quality of input data and methodologies. We also closely monitor US regulatory developments, as the SEC has sought comment on whether index providers, model portfolio providers, and pricing services should be regulated as investment advisers or outsourced service providers. If adopted, these changes could significantly increase our regulatory exposure and compliance costs. In addition, the UK is currently consulting on a proposed new Specified Authorized Benchmark Regulation. We do not currently expect our Morningstar Indexes business in the UK to be in scope of the new regulation if adopted, and continue to engage with the relevant authorities as part of the consultation.

46

Morningstar Sustainalytics may face increased regulation of its research, ratings, and data activities. EU rules for ESG ratings providers, which became effective in 2026, and ongoing compliance with EU rules may require significant incremental investment in governance, internal controls, and compliance processes. Many jurisdictions have already established regulations regarding the provision and distribution of ESG data and ratings that are currently in effect or will take effect in the near future. Others are developing, similar frameworks, which may differ from EU requirements in material respects. The final form of any new or modified regulations could impose substantial compliance burdens and risk of inadvertent noncompliance. As Morningstar Sustainalytics operates globally, future regulations may be inconsistent across markets. Conversely, deregulation could reduce demand for our products. Failure to address this evolving landscape adequately and promptly could adversely affect our business, operating results, and financial condition.

Our indebtedness could adversely affect our cash flow and financial flexibility. Our variable rate indebtedness could subject us to interest rate risk, which could cause our debt service obligations to increase significantly.

For an overview of our current outstanding indebtedness, refer to Item 7 - Management's Discussion and Analysis of Financial Condition and Results of Operations - Liquidity and Capital Resources below. Our long-term debt was $1,713.3 million as of June 30, 2025. While our business has historically generated strong cash flow and we are in compliance with all of our debt covenants, borrowings under our current credit facilities are floating rate. As a result, our annual debt service requirements are affected by rising interest rates, and we cannot provide assurance that we will generate and maintain cash flows sufficient to permit us to service our indebtedness. Our ability to make payments on our indebtedness and to fund expected capital expenditures depends on our ability to generate and access cash in the future, which, in turn, is subject to general economic, financial, competitive, regulatory, tax and other factors, many of which are beyond our control. If we cannot refinance or otherwise pay our obligations as they mature and fund our liquidity needs, our business, financial condition, results of operations, cash flows, liquidity, ability to obtain financing, and ability to compete in our industry could be materially adversely affected.

In addition, any borrowings under our current credit facilities bear interest in fluctuating interest rates based on the Secured Overnight Financing Rate (SOFR), which replaced London Interbank Offered Rate (LIBOR) as the reference rate under our credit facilities. There can be no assurance that SOFR will perform in the same way as LIBOR would have at any time, which may result in increased volatility in the interest rates payable under our credit facilities and potentially increase our funding costs.

Furthermore, the terms of our debt agreements include restrictive covenants that limit, among other things, our and our subsidiaries financial flexibility and ability to implement certain transactions. If we are unable to comply with the restrictions and covenants in our debt agreements, there could be a default that, in some cases, if continuing, could result in the accelerated payment of our debt obligations or the termination of borrowing commitments on the part of the lenders under our Credit Agreement. Additionally, our current credit facilities mature in October 2028 and October 2030. We may not be able to renegotiate or obtain additional or new financing on a timely basis or on terms favorable or acceptable to us. If we are unable to refinance or otherwise fund our liquidity needs, our business, financial condition, results of operations, cash flows, liquidity, and ability to compete in our industry could be materially adversely affected. Refer to Item 7Management's Discussion and Analysis of Financial Condition and Results of OperationsLiquidity and Capital Resources for a description of the restrictive covenants in our debt agreements.

47