Microsoft

- Tax risks have intensified due to significant gains from OpenAI investments, contrasting with prior year losses and affecting effective tax rates. - Operational cost pressures persist due to heavy reliance on GPUs and datacenter supply chains for AI infrastructure expansion. - The ongoing IRS audit regarding intercompany transfer pricing for tax years 2004–2013 continues to pose a potential liability of $28.9 billion plus penalties. - Cybersecurity risks remain elevated following the disclosure of a nation-state actor compromising internal systems and source code repositories.

• No new or fundamentally changed risk factors were introduced this quarter compared to prior periods. • However, net losses from investments in OpenAI increased significantly to $4.1 billion, amplifying financial exposure. • The ongoing IRS audit regarding transfer pricing for tax years 2004–2013, seeking an additional $28.9 billion, remains a significant unresolved uncertainty.

- The Federal Trade Commission (FTC) continues to challenge the Activision Blizzard acquisition, posing a risk of deal alteration or unwinding. - The IRS issued Notices of Proposed Adjustment (NOPAs) seeking an additional $28.9 billion regarding intercompany transfer pricing for tax years 2004–2013, representing a significant legal and financial exposure. - The European Commission designated Windows and LinkedIn as core platform services under the Digital Markets Act, imposing restrictions on self-preferencing and data usage. - Ongoing nation-state cyberattacks and zero-day vulnerabilities continue to threaten infrastructure integrity and customer data security.

• Expanded IRS Audit Risk: The IRS is seeking an additional $28.9 billion plus penalties and interest regarding intercompany transfer pricing for tax years 2004–2013, with resolution not expected within 12 months. • Enhanced EU Regulatory Scrutiny: The European Commission has designated Windows and LinkedIn as core platform services under the Digital Markets Act, prohibiting self-preferencing and limiting data usage. • Escalating Cybersecurity Threats: A nation-state actor compromised a legacy test account in late 2023, raising concerns about ongoing exploitation and increased risks from AI-driven attacks and supply chain malware. • AI Regulatory Uncertainty: New regulations like the EU's AI Act and U.S. Executive Orders increase legal risks related to algorithmic bias, copyright infringement, and liability for AI-generated outputs.