59 added · 21 removed between the two most recent 10-Ks. The risks a company starts — or stops — disclosing are often the story.
Newly disclosed
For example, severe weather events that damage or force closures of our maintenance facilities, or that impact our employees or their working conditions, could negatively affect our ability to complete required railcar repairs in a timely or cost-efficient manner.
For example, while some policymakers (such as California and the European Union) have adopted requirements for various disclosures or actions on environmental and social matters, policymakers in other jurisdictions have sought to constrain companies’ consideration of such matters in some circumstances.
For example, restrictions on GHG emissions could significantly increase costs for our customers whose production processes require significant amounts of energy, which could reduce demand for the lease of our assets.
A successful cyberattack or other security incident could result in business interruptions, financial losses, theft, destruction, unavailability, or unauthorized disclosure of Confidential Information, reputational harm, loss of customers, significant remediation costs, or exposure to litigation, regulatory investigations, or penalties.
Conversely, innovations driven by AI may positively impact industries that utilize transportation assets going forward, and if we do not successfully implement them, we may fail to increase operational efficiency, lose competitive advantage, or face diminished customer demand.
We could incur substantial costs related to ongoing compliance with these requirements, and any failure to comply with applicable laws and regulations could lead to significant fines, penalties, litigation, or reputational damage.
On January 1, 2026, we closed on the acquisition of Wells Fargo’s rail operating lease portfolio.
We may increasingly use AI in our business going forward, and challenges with its implementation or use could result in operational issues, reputational or financial harm, or legal liability.
In addition, we are subject to an evolving and increasingly complex set of federal, state, and foreign laws and regulations governing data privacy, data protection, cybersecurity, and AI.
We and our third-party providers are regularly subject to attempted cyber intrusions, some of which have been successful, and we expect these incidents to continue to evolve.
Furthermore, our competitors may be less exposed to tariff impacts or in a better position to mitigate increased costs, which could adversely affect our competitiveness.
We hold a series of annual call options that, if exercised in full over time, may result in GATX acquiring 100% ownership of GABX; however, there can be no assurance that we will exercise these options on the anticipated schedule or at all, that required regulatory approvals will be obtained when needed, or that we will have access to financing on acceptable terms to fund any of these option exercises.
No longer disclosed
We and our third-party providers are regularly subject to attempted cyber intrusions, hacks and ransomware attacks, and we expect these incidents to accelerate and become increasingly sophisticated in using techniques and tools, including artificial intelligence, that circumvent security controls, evade detection and remove forensic evidence.
We also are subject to an evolving body of federal, state and foreign laws, regulations, guidelines and principles regarding data privacy, data protection, data security, and artificial intelligence.
We could incur substantial costs related to ongoing compliance with, and substantial penalties or litigation or reputational damage related to violations of, such laws and regulations.
In addition, demand for transportation assets used to transport certain commodities, including ethanol and other renewable fuels, may be affected by government subsidies and mandates, which may be enacted, changed, or eliminated from time to time, while demand for transportation assets used to transport fossil fuels or that directly or indirectly require consumption of fossil fuels for operation may be affected by government policies and mandates with respect to climate matters and carbon emissions.
We own and manage certain aspects of our IT infrastructure, but we also rely on third parties for a range of IT systems and related products and services, including but not limited to, cloud computing services (such third-party systems and our IT infrastructure, collectively, our “IT Infrastructure”).
We and certain of our third-party providers collect, maintain and process data about customers, employees, business partners and others, including personally identifiable information, as well as confidential and proprietary information belonging to our business, including trade secrets (such data and information, collectively, “Confidential Information”).
All IT systems are vulnerable to cybersecurity threats and other unlawful attempts to disrupt or gain access to these systems, and these vulnerabilities may be increased by remote computing assets and additional security vulnerabilities that are present in many public, non-corporate and home networks.
Breaches of our IT Infrastructure could lead to disruptions in our business, potentially including the theft, destruction, loss, misappropriation, or release of Confidential Information stored on our IT Infrastructure and subject us to potential lawsuits, including class actions, other material legal liabilities, reputational damage, lost customers or significant costs associated with incident response, system restoration or remediation, applicable filings and notifications, and future compliance.
Many jurisdictions in which we conduct business have passed or proposed laws and regulations dealing with the collection, processing, storage, transfer and/or use of personal information, some of which include potential fines and penalties based on worldwide revenue.
We are subject to the risks associated with natural disasters and the physical effects of climate matters, which may increase in frequency and severity over time and may have a material adverse effect on our assets, operations and business.
Any of these factors, individually or in operation with one or more of the other factors, or other unforeseen impacts of climate matters, could reduce the demand for and value of our assets, and could have an adverse effect on our financial position, results of operations, and cash flows. 18 Economic and Credit Risks United States and global political conditions and increased geopolitical tension, civil unrest and armed conflict could adversely affect our business, financial condition and results of operations.
Such a crisis could also result in operational and labor disruptions, employee attrition and difficulty securing future labor needs, as well as impacts the broader employment market and supply chains, our suppliers, and our customers.