Reputable outlets only (Reuters, WSJ, CNBC, Barron's, and peers). More on Google News ↗
What Changed
Risk factors · Feb 11, 2025 → Feb 11, 2026
102 added · 91 removed between the two most recent 10-Ks. The risks a company starts — or stops — disclosing are often the story.
Newly disclosed
Notwithstanding our investments, our products and services may become less marketable or less competitive, or potentially obsolete if either our approach to integrating AI into our products and services fails to gain market acceptance or our approach to protecting our data and intellectual property is ultimately inadequate. • Our competitors are deploying AI in ways that could materially reduce demand for our products and services (for example, by deploying AI in ways that make collection and processing of information relatively inexpensive or free or by leveraging AI to build products and services that compete with our products and services).
For example, our products and services with AI capabilities may contain errors or defects that lead to privacy concerns, accuracy issues, unintended biases or discriminatory outputs.
For example, we routinely face unauthorized use of our indices and price assessments, and our efforts to stop such uses require significant time and expense, and are not always successful. • We have filed for patents in the U.S. and in certain international jurisdictions, but such protections can be expensive and may not be available in all countries in which we operate or in which we seek to enforce such rights, or may be difficult to enforce in practice.
For example, in response to the ongoing military conflict between Russia and Ukraine, governments in the U.S., the EU, the U.K., Canada and others imposed financial and economic sanctions on certain industry segments and various parties in Russia and Belarus. • Additional international trade restraints may be promulgated at any time and may require changes to our operations and increase our risk of noncompliance. • Failure to comply with these laws and regulations can result in significant fines and penalties and related material adverse effects on our reputation, business, financial condition and results of operations.
Additionally, fragmented security tooling could create visibility gaps and increase the risk of missed threats and slower response. • We conduct cyber due diligence during the acquisition process; however, following the completion of acquisitions, we from time to time identify weaknesses and vulnerabilities in acquired entities’ information systems and networks, which expose us to unexpected liabilities or make our own information systems or networks more vulnerable to a cyber attack. • Any of the foregoing could have a material adverse effect on our business, financial condition or results of operations.
While we have established a Company-wide AI strategy to drive our approach to data protection, licensing and AI integration in our processes, products and services, AI creates a number of evolving risks and opportunities and can exacerbate other risks, including those described herein: • In order to remain competitive, we have made significant investments in various AI initiatives.
The continued enhancement of AI within our products, services and processes depends in part on our ability to attract and retain talented employees with critical AI and data science experience, which is dependent on a number of factors, including prevailing market conditions and compensation packages offered by companies competing for the same talent.
If we are less successful in our recruiting efforts, or if we are unable to attract, retain or train key qualified personnel, our ability to develop and deliver on our investments in our various AI initiatives may be adversely affected. • The number of approaches to integrating and commercializing AI is currently large, and many of those approaches may fail to gain market acceptance or become obsolete as AI continues to evolve.
In addition, the development, testing and deployment of AI systems 13 Table of Contents requires continued investment and may materially increase the cost profile of our offerings due to the nature of the computing cost involved in such systems.
The emerging availability of “off-the-shelf” AI models may also increase the ability of new and existing competitors to develop technology and applications which may compete with our products and services. • Our ability to produce and develop products and services with AI capabilities is dependent upon the products and services of other suppliers, including certain data, software and service suppliers.
While such issues have not materially adversely affected us to date, the future occurrence of any such issue could have a material adverse effect on our business, financial condition or results of operations. • AI presents risks and challenges that could affect its adoption, including social and ethical risks.
Any of these social, ethical or operational issues could materially and adversely affect our business, financial condition or results of operations. • AI is being utilized by malign actors to launch increasingly sophisticated cyber attacks against us and our third-party service providers (including our vendors, data partners and distribution partners), which, if successful, could have a material adverse effect on our business, financial condition or results of operations.
No longer disclosed
For instance, new competitors are leveraging AI in their offerings in ways that could materially reduce demand for our products and services (for example, by deploying AI in ways that make processing of information relatively inexpensive or free or by leveraging AI to build indices or ETFs).
For example, the legal landscape with respect to AI is rapidly evolving, and we do not yet know whether intellectual property laws and regulations in the jurisdictions in which we operate will enable us to effectively protect our intellectual property rights from unintended use by AI.
The EU’s comprehensive General Data Privacy Regulation (“GDPR”), for example, is a comprehensive regulation applying across all EU member states, providing for penalties of up to the greater of €20 million or 4% of worldwide revenue, and the average GDPR penalties increased in 2023 compared to prior years. • We devote meaningful time and financial resources to compliance with current and future applicable international and U.S. privacy, cybersecurity, data protection and related laws and regulations.
For example, we acquired Visible Alpha, World Hydrogen Leaders and ProntoNLP on May 1, 2024, May 14, 2024, and December 31, 2024, respectively, and we sold Fincentric and our PrimeOne business on August 15, 2024 and November 1, 2024, respectively.
For example, the AI used in our products could include undetected errors or defects that lead to harmful consequences such as accuracy issues, unintended biases or discriminatory outputs.
Our service providers could experience system breakdowns or failures, outages (such as the 2024 CrowdStrike outage), downtime, cyber attacks, adverse changes to financial condition, bankruptcy or other adverse conditions, which could have a material adverse effect on our business and reputation.
These include, among others, risks relating to: ◦ economic and political conditions around the world, ◦ inflation, ◦ high interest rates or fluctuation in interest rates, currency exchange rates or commodities markets, ◦ limitations that foreign governments may impose on the conversion of currency or the payment of dividends or other remittances to us from our non-U.S. subsidiaries, ◦ differing accounting principles and standards, ◦ increases in taxes or changes in U.S. or foreign tax laws (for example, the Pillar Two international tax framework established by the Organisation for Economic Co-operation and Development, which includes a global minimum tax of 15%), 22 Table of Contents ◦ potential costs and difficulties in complying with a wide variety of foreign laws and regulations (including tax systems) administered by foreign government agencies, some of which may conflict with U.S. or other sources of law, ◦ changes in applicable laws and regulatory requirements, including data localization requirements, ◦ restrictive actions of governmental authorities in the jurisdictions in which we operate affecting trade, cross-border data transfer and foreign investment, especially during periods of heightened tension between governmental authorities in such jurisdictions, including protective measures such as export restrictions and customs duties and tariffs, government intervention favoring local competitors, data localization efforts, and restrictions on the level of foreign ownership, ◦ nationalization, expropriation, price controls, withdrawal of licenses to operate, and unilateral termination of contracts by government entities, ◦ competition with local rating agencies that have greater familiarity, longer operating histories and/or support from local governments or other institutions, and ◦ civil unrest, protests, terrorism, unstable governments, geopolitical uncertainties and legal systems, and other factors.
For example, the use of AI could lead to harmful consequences such as accuracy issues, unintended biases or discriminatory outputs.
For example, in response to the ongoing military conflict between Russia and Ukraine, governments in the U.S., the EU, the U.K., Canada and others imposed financial and economic sanctions on certain industry segments and various parties in Russia and Belarus.
For example, we have faced and could in the future face negative perceptions or publicity with respect to our sustainability and corporate responsibility policies and practices (including DEI) or our ESG products, methodologies, or scores, including as a result of a revision, suspension or withdrawal of, or a failure to meet, our publicly disclosed ESG (including DEI) and climate-related targets, goals or practices, or as a result of misalignment with evolving market standards, ESG regulations and codes of conduct or regulatory expectations.
However, such measures may be circumvented or become obsolete, and additional measures that we take to prevent or mitigate cyber incidents may be expensive or ineffective. • While we conduct cyber due diligence during the acquisition process, following the completion of acquisitions, we have identified weaknesses and vulnerabilities in acquired entities’ information systems and networks, which expose us to unexpected liabilities or make our own information systems or networks more vulnerable to a cyber attack. • Any of the foregoing could have a material adverse effect on our business, financial condition or results of operations.
For instance, we are incorporating AI in internal operations across our Company, which subjects us to a variety of risks, as further described in the risk factor entitled “ Our approach to AI may not be successful, which could materially and adversely affect our business, financial condition or results of operations .” Additionally, certain of our new processes require manual data entry or collection before they can be automated, which subjects them to greater risk of human error.