violation of these laws, including: (i) seeking to proactively classify its platforms and obtain authorizations for the export and/or import of its platforms where appropriate, (ii) implementing certain technical controls and screening practices to reduce the risk of violations, and (iii) requiring compliance with U.S. export control and sanctions obligations in customer and vendor contracts. However, Arqit cannot guarantee the precautions it takes will prevent violations of export control and sanctions laws.
As discussed above, if Arqit misclassifies a product or service, export or provides access to a product or service in violation of applicable restrictions, or otherwise fails to comply with export regulations, Arqit may be denied export privileges or subjected to significant per violation fines or other penalties, and its platforms may be denied entry into other countries. Any decreased use of its platforms or limitation on its ability to export or sell its platforms would likely adversely affect its business, results of operations and financial condition. Violations of sanctions or export control laws can result in fines or penalties, including both civil and criminal penalties.
Arqit also notes that if it or its business partners or counterparties, including licensors and licensees, prime contractors, subcontractors, sublicensors, vendors, customers, or contractors, fail to obtain appropriate import, export, or re-export licenses or permits, notwithstanding regulatory requirements or contractual commitments to do so, or if Arqit fails to secure such contractual commitments where necessary, Arqit may also face reputational harm as well as other negative consequences, including government investigations and penalties.
Negative consequences for violations or apparent violations of trade control requirements may include the absolute loss of the right to sell Arqit’s platforms or services to the government of the U.S., or to other public bodies, or a reduction in its ability to compete for such sales opportunities. Further, complying with export control and sanctions regulations for a particular sale may be time-consuming and may result in the delay or loss of sales opportunities.
Other countries in addition to the U.S. and U.K. also regulate the import and export of certain encryption and other technology, including import and export licensing requirements, and have enacted laws that could limit Arqit’s ability to distribute its products or could limit its end-customers’ ability to implement its products in those countries. Changes in Arqit’s products or future changes in export and import regulations may create delays in the introduction of its platform in international markets, prevent its end- customers with international operations from deploying its platform globally or, in some cases, prevent the export or import of its products to certain countries, governments, or persons altogether. From time to time, various governmental agencies have proposed additional regulation of encryption technology. Any change in export or import regulations, economic sanctions or related legislation, increased export and import controls, or change in the countries, governments, persons, or technologies targeted by such regulations, could result in decreased use of Arqit’s platform by, or in its decreased ability to export or sell its products to, existing or potential end-customers with international operations. If there is any limitation on its ability to export or sell its products, Arqit’s business, financial condition and results of operations could be materially adversely affected.
Failures, or perceived failures, to comply with privacy, data protection, and information security requirements in the jurisdictions in which Arqit operates may adversely impact its business, and such legal requirements are evolving and may require improvements in, or changes to, its policies and operations.
Arqit’s current and potential future operations and sales are subject to laws and regulations addressing privacy and the collection, use, storage, disclosure, transfer and protection of a variety of types of data. The primary data privacy laws applicable to Arqit include U.K. General Data Protection Regulation and the U.K. Data Protection Act of 2018. These regimes may, among other things, impose data security requirements, disclosure requirements, and restrictions on data collection, uses, and sharing that may impact its operations and the development of its business. Arqit’s products collect, store and process certain information and its products may evolve to collect additional information. Therefore, the full impact of these privacy regimes on its business is rapidly evolving across jurisdictions and remains uncertain at this time.
Arqit may also be affected by cyber-attacks and other means of gaining unauthorized access to its products, systems, and data. For instance, cyber criminals or insiders may target it or third parties with which Arqit has business relationships to obtain data, or in a manner that disrupts its operations or compromises its products or the systems into which its products are integrated.
Arqit continually assesses the evolving privacy and data security regimes and implements measures that Arqit believes are appropriate in response. Since these data security regimes are evolving, uncertain and complex, especially for a global business like Arqit’s, it may need to update or enhance its compliance measures as its products, markets and customer demands further develop, and these updates or enhancements may require implementation costs. In addition, Arqit may not be able to monitor and react to all developments in a timely manner and the compliance measures that Arqit adopts may prove ineffective.
Any failure, or perceived failure, to comply with current and future regulatory or customer-driven privacy, data protection, and information security requirements, or to prevent or mitigate security breaches, cyber-attacks, or improper access to, use of, or disclosure of data, or any security issues or cyber-attacks affecting Arqit, could result in significant liability, costs (including the costs of mitigation