United Rentals (URI) Risk Factors

Our 1,357 branch locations in the United States are located in 49 states, and Puerto Rico, which exposes us to a host of different state and local regulations, in addition to federal law and regulatory and contractual requirements we face as a government contractor. These laws and requirements address multiple aspects of our operations, such as employee safety, consumer rights, privacy, employee benefits and more. In addition, there are often different and potentially conflicting requirements in different jurisdictions. Changes in these requirements, or any material failure by our branches to comply with them, can increase our costs, affect our reputation, limit our business, drain management time and attention and otherwise impact our operations in adverse ways.

In the ordinary course of our business operations, we are exposed to a variety of potential claims. These claims include those relating to personal injuries or property damage arising from: (i) the use and/or operation of our rented or sold equipment, (ii) motor vehicle accidents involving our vehicles and our employees and (iii) employment-related claims. Currently, we carry a broad range of insurance for the protection of our assets and operations. However, such insurance may not fully cover these claims for a number of reasons, including: - our insurance policies, reflecting a program structure that we believe reflects market conditions for companies of our size, are often subject to significant deductibles or self-insured retentions;- our director and officer liability insurance policy has no deductible for individual non-indemnifiable loss, but is subject to a deductible for company reimbursement coverage;- we do not currently maintain Company-wide stand-alone first party coverage for environmental liability (other than legally required and third party site pollution coverage), since we believe the cost for such coverage is high relative to the benefit it provides; and - certain types of claims, such as claims for punitive damages or for damages arising from intentional misconduct, which are often alleged in third party lawsuits, might not be covered by our insurance. We establish and evaluate our loss reserves on a semi-annual basis to address casualty claims, or portions thereof, not covered by our insurance policies. To the extent that we are subject to a higher frequency of claims, are subject to more serious claims or insurance coverage is not available, we could have to significantly increase our reserves, and our liquidity and operating results could be materially and adversely affected. It is also possible that some or all of the insurance that is currently available to us will not be available in the future on economically reasonable terms or at all.

Our specialty reportable segment has accounted for an increasing portion of our business and revenues in recent years. Specialty segment revenues constituted 25.4 percent of our revenues for the year ended December 31, 2023, as compared to 7.3 percent of our revenues for the year ended December 31, 2013. In connection with the expansion of the specialty segment, we have expanded the scope of services we provide to clients; for example, we advise clients on the compatibility of our equipment with various applications, collaborate and consult with clients on certain aspects of civil construction projects, design and erect scaffolding, and design electrical pump systems. To the extent we engage in those and other similar activities, we have faced, and will continue to face, increased legal, reputational and operational risks. These new or expanded business activities also expose us to new or different types of risks, including risks related to spills, unauthorized use of equipment, system failure, ineffectiveness of the solutions and products we provide, and hazardous material issues and interference. We have been, and may in the future be, subject to various claims in connection with these activities and services, and the associated risks may be difficult to assess or quantify and their existence and magnitude may remain unknown for substantial periods of time, particularly as we engage in new business activities where we do not have historical experience. Although we have insurance to protect ourselves against claims in connection with these activities, we cannot guarantee that any insurance coverage will be sufficient or that we will continue to be able to obtain such coverage at reasonable rates or at all. See also "We are exposed to a variety of claims relating to our business, and our insurance may not fully cover them."

We rely on our information technology systems to be able to monitor and control our operations, adjust to changing market conditions, implement strategic initiatives and support our online ordering system. Any disruptions in these systems or the failure of these systems to operate as expected have in the past adversely affected, and could in the future adversely affect, our ability to access and use certain applications and could, depending on the nature and magnitude of the problem, adversely affect our operating results by limiting our ability to effectively monitor and control our operations, adjust to changing market conditions, implement strategic initiatives and service online orders. Although such disruptions and failures have not been material to date, we cannot guarantee that they will not be material in the future. In addition, the security measures we employ to protect our systems have in the past not detected or prevented, and may in the future not detect or prevent, all attempts to hack our systems, denial-of-service attacks, viruses, malicious software (malware), employee error or malfeasance, phishing attacks, security breaches, disruptions during the process of upgrading or replacing computer software or hardware or integrating systems of acquired businesses or assets or other attacks and similar disruptions that may jeopardize the security of information stored in or transmitted by the sites, networks and systems that we otherwise maintain, which include cloud-based networks and data center storage. We have, from time to time, experienced threats to and breaches of our data and systems, including malware and computer virus attacks. We are continuously developing and enhancing our controls, processes and practices designed to protect our systems, computers, software, data and networks from attack, damage, or unauthorized access. This continued development and enhancement requires us to expend significant resources. However, we may not anticipate or combat all types of future attacks until after they have been launched. If any of these breaches of security occur or are anticipated in the future, we could be required to expend additional capital and other resources, including costs to deploy additional personnel and protection technologies, train employees and engage third-party experts and consultants. Our response to attacks, and our investments in our technology and our controls, processes and practices, may not be sufficient to shield us from significant losses or liability. Further, given the increasing sophistication of bad actors and complexity of the techniques used to obtain unauthorized access or disable systems, a breach or attack could potentially persist for an extended period of time before being detected. As a result, we may not be able to anticipate the attack or respond adequately or timely, and the extent of a particular incident, and the steps that we may need to take to investigate the incident, may not be immediately clear. It could take a significant amount of time before an investigation can be completed and full, reliable information about the incident becomes known. During an investigation, it is possible we may not necessarily know the extent of the harm or how to remediate it, which could further adversely impact us, and new regulations could result in us being required to disclose information about a material cybersecurity incident before it has been mitigated or resolved, or even fully investigated. We also face cybersecurity risks due to our reliance on internet technology and hybrid work arrangements, which could strain our technology resources or create additional opportunities for cybercriminals to exploit vulnerabilities. In addition, because our systems sometimes contain information about individuals and businesses, our failure to appropriately maintain the security of the data we hold, whether as a result of our own error or the malfeasance or errors of others, have led, and could in the future lead, to disruptions in our online ordering system or other data systems, and could lead to unauthorized release of confidential or otherwise protected information or corruption of data. Our failure to appropriately maintain the security of the data we hold could also violate applicable privacy, data security and other laws and subject us to lawsuits, fines and other means of regulatory enforcement. Regulators have been imposing new data privacy and security requirements, including new and greater monetary fines for privacy violations. For example, the European Union's ("EU") General Data Protection Regulation (Regulation (EU) 2016/679) (the "GDPR") has stringent data protection requirements and provides for significant penalties. Non-compliance with the GDPR could lead to lower revenues, increased costs (including fines, which could be significant) and other material adverse effects on our results of operations. In addition, countries such as the United Kingdom (the "UK") have implemented the GDPR through their own legislation. Other countries, including the U.S., have proposed or adopted their own data protection legislation. These laws and regulations are broad in scope and subject to evolving interpretations and increasing enforcement, and we have incurred costs to monitor compliance and have altered our practices, and may have to do so again in the future. Moreover, certain new and existing data privacy laws and regulations could diverge and conflict with each other in certain respects, which makes compliance increasingly difficult. Complying with new regulatory requirements has in the past required, and could in the future require, us to incur substantial expenses or require us to change our business practices, either of which could harm our business. As regulators have become increasingly focused on information security, data collection and use and privacy, we may be required to devote significant additional resources to modify and enhance our information security controls and to identify and remediate vulnerabilities, which could adversely impact our results of operations and profitability. Any compromise or breach of our systems could result in adverse publicity, harm our reputation, lead to claims against us and affect our relationships with our customers and employees, any of which could have a material adverse effect on our business. Certain of our software applications are also utilized by third parties who provide outsourced administrative functions, which may increase the risk of a cybersecurity incident. Although we maintain insurance coverage for various cybersecurity risks, there can be no guarantee that all costs or losses incurred will be fully insured.

The equipment rental industry is highly fragmented and competitive. Our competitors include small, independent businesses with one or two rental locations, regional competitors that operate in one or more states, national and global companies or divisions of national and global companies, and equipment vendors and dealers who both sell and rent equipment directly to customers. We may in the future encounter increased competition from our existing competitors or from new competitors. Competitive pressures have in the past adversely affected, and could again in the future adversely affect, our revenues and operating results by, among other things, decreasing our rental volumes, depressing the prices that we can charge or increasing our costs to retain employees.

One of the reasons some of our customers find it more attractive to rent equipment than own that equipment is the need to deploy their capital elsewhere. However, some of our customers may have liquidity issues and ultimately may not be able to fulfill the terms of their rental agreements with us. If we are unable to manage credit risk issues adequately, or if a large number of customers have financial difficulties at the same time, our credit losses could increase above historical levels and our operating results would be adversely affected. Further, a worsening of economic conditions would be expected to result in increased delinquencies and credit losses, which could exacerbate adverse impacts on our business and operating results.

Our business has been and may in the future be adversely affected by economic conditions in the United States and globally. A worsening of economic conditions, in particular with respect to North American construction and industrial activities, could cause weakness in our end-markets and adversely affect our revenues and operating results. Our general rental equipment and specialty equipment are used in connection with private non-residential construction and industrial activities. In the past, weakness in our end-markets has led to a decrease in the demand for our equipment and in the rates we realized. Such decreases have adversely affected our operating results by causing our revenues to decline and, because certain of our costs are fixed, our operating margins to be reduced. In addition, the following factors, among others, could adversely impact us, our customers or our suppliers and in turn adversely affect our revenues and operating results: - a decrease in expected levels of infrastructure spending;- a lack of availability of credit;- excess fleet in the equipment rental industry;- a decrease in the level of exploration, development, production activity and capital spending by oil and natural gas companies;- an increase in costs, including the cost of construction materials, as a result of inflation or other factors;- an increase in interest rates;- instability in macroeconomic conditions;- adverse weather conditions, which may temporarily affect a particular region;- a prolonged shutdown of the U.S. government;- public health crises and epidemics (or concerns over the possibility of such a health crisis or epidemic), such as COVID-19;- supply chain disruptions;- terrorism or hostilities involving the United States, Canada, Europe, Australia or New Zealand;- geopolitical conflicts, such as Russia's invasion of Ukraine and the conflict in the Middle East, and the resultant sanctions and other measures imposed in response; or - other unforeseen or catastrophic events. These factors have in the past, and could in the future, among other things, cause weakness in our end-markets and impact customer demand for equipment rentals, reduce the availability and productivity of our employees, increase our costs, result in delayed payments from our customers and uncollectible accounts, impact previously announced strategic plans or impact our ability to access funds from financial institutions and capital markets on terms favorable to us, or at all.

Our operations in Canada, Europe, Australia and New Zealand are subject to the risks normally associated with international operations. These include (i) the need to convert currencies, which could result in a gain or loss depending on fluctuations in exchange rates and (ii) the need to comply with foreign laws and regulations, as well as U.S. laws and regulations, applicable to our operations in foreign jurisdictions. Changes in such laws or regulations, or any material failure to comply with any applicable laws or regulations, can increase our costs, affect our reputation, limit our business, drain management time and attention and otherwise impact our operations in adverse ways. In addition, laws or regulations or the interpretations thereof can conflict among jurisdictions, and compliance in one jurisdiction could result in legal or reputational risks in another jurisdiction. See Item 7A-Quantitative and Qualitative Disclosures About Market Risk for additional information related to currency exchange risk.