International Business Machines (IBM) risk factors, FY2025 10-K

International Business Machines's FY2025 10-K, filed Feb 24, 2026, lists 26 risk factors in 5 groups. Against the prior year's 27: 1 dropped, 2 substantially reworded.

Open IBM in Gloom →
International Business Machines' chart, financials and news, free in your browser.Open IBM in Gloom →
Risk factors listed
265 groups
New this year
0vs 27 last year
Dropped
1since the prior 10-K
Substantially reworded
2of those kept
Section length
5k wordsItem 1A

What the changes say

  • AI risk now emphasizes technologies producing unexpected outcomes, alongside IBM’s AI development, governance and management offerings.
  • Cybersecurity wording broadens third-party exposure to open-source contributors and acquired companies, and focuses on data protection.
  • IBM dropped the separate warning that cybersecurity, privacy, AI and data-protection regulation increases costs and compliance obligations.

What changed since the prior 10-K

Dropped

  • DroppedRisks Related to Cybersecurity and Data Privacy

    Although the company continuously takes significant steps to mitigate cybersecurity risk across a range of functions, such measures can never eliminate the risk entirely or provide absolute security

Reworded

  • 44% rewrittenRisks Related to Our Business

    The Development and Use of AI, including the Company’s Increased AI Solutions and Use of AI Technologies, Could Impact the Long-Term Success of the Company and its Reputation or Give Rise to Legal or Regulatory Action

    Adds the risk that AI technologies may not work as intended or produce unexpected outcomes, potentially harming IBM’s market share, margins, reputation and competitiveness.

    Was: The Development and Use of AI and Generative AI, including the Company’s Increased Offerings and Use of AI-based Technologies, Could Impact the Long-Term Success of the Company and its Reputation or Give Rise to Legal or Regulatory Action

  • 34% rewrittenRisks Related to Cybersecurity and Data Protection

    Cybersecurity and Data Protection Considerations Could Impact the Company’s Business

    Replaces privacy with data protection and adds risks from third-party practices and investments, the open-source community, and acquired companies.

    Was: Cybersecurity, Privacy, and AI Considerations Could Impact the Company’s Business

All 26 risk factors

Headings as the filing states them, in filing order.

Risks Related to Our Business

  1. 01Downturn in Economic Environment and Client Spending Budgets Could Impact the Company’s Business
  2. 02Failure of Innovation Initiatives Could Impact the Long-Term Success of the Company
  3. 03Damage to IBM’s Reputation Could Impact the Company’s Business
  4. 04Risks from Investing in Growth Opportunities Could Impact the Company’s Business
  5. 05IBM’s Intellectual Property Portfolio May Not Prevent Competitive Offerings, and IBM May Not Be Able to Obtain Necessary Licenses
  6. 06Risks to the Company from Acquisitions, Alliances and Divestitures Include Integration Challenges, Failure to Achieve Objectives, the Assumption or Retention of Liabilities and Higher Debt Levels
  7. 07The Company’s Financial Results for Particular Periods Are Difficult to Predict
  8. 08Due to the Company’s Global Presence, Its Business and Operations Could Be Impacted by Local Legal, Economic, Political, Health and Other Conditions
  9. 09The Company May Not Meet Its Growth and Productivity Objectives
  10. 10Ineffective Internal Controls Could Impact the Company’s Business and Operating Results
  11. 11The Company’s Use of Accounting Estimates Involves Judgment and Could Impact the Company’s Financial Results
  12. 12The Company’s Goodwill or Amortizable Intangible Assets May Become Impaired
  13. 13The Company Depends on Skilled Employees and Could Be Impacted by a Shortage of Critical Skills
  14. 14The Company’s Business Could Be Impacted by Its Relationships with Critical Suppliers
  15. 15Product and Service Quality Issues Could Impact the Company’s Business and Operating Results
  16. 16The Development and Use of AI, including the Company’s Increased AI Solutions and Use of AI Technologies, Could Impact the Long-Term Success of the Company and its Reputation or Give Rise to Legal or Regulatory Action44% rewritten
  17. 17The Company Could Be Impacted by Its Business with Government Clients
  18. 18The Company’s Reliance on Third-Party Distribution Channels and Ecosystems Could Impact Its Business

Risks Related to Cybersecurity and Data Protection

  1. 19Cybersecurity and Data Protection Considerations Could Impact the Company’s Business34% rewritten

Risks Related to Laws and Regulations

  1. 20The Company Could Incur Substantial Costs Related to Climate Change and Other Environmental Matters
  2. 21Tax Matters Could Impact the Company’s Results of Operations and Financial Condition
  3. 22The Company Is Subject to Legal Proceedings and Investigatory Risks

Risks Related to Financing and Capital Markets Activities

  1. 23The Company’s Results of Operations and Financial Condition Could Be Negatively Impacted by Its U.S. and non-U.S. Pension Plans
  2. 24The Company Is Exposed to Currency and Financing Risks That Could Impact Its Revenue and Business
  3. 25The Company’s Financial Performance Could Be Impacted by Changes in Market Liquidity Conditions and by Customer Credit Risk on Receivables

Risks Related to Ownership of IBM Securities

  1. 26Risk Factors Related to IBM Securities

Other International Business Machines 10-Ks

  • FY2024 10-K risk factors
    27 risks

    AI and generative AI are central: IBM is investing, embedding them, and facing uncertain adoption, competition, legal, and reputational consequences.

    Filed Feb 25, 2025

About this page

The headings are the filing's own. The one-line readings and the overview are automated and can be wrong: read Item 1A of the 10-K for the exact wording.