Xos (XOS) Risk Factors

Our operations are and will be subject to foreign, federal, state and local environmental laws and regulations, including laws relating to the use, handling, storage and disposal of, and human exposure to, hazardous materials. Environmental and health and safety laws and regulations can be complex, and we have limited experience in compliance. Moreover, we expect that we will be affected by future amendments to such laws or other new environmental and health and safety laws and regulations which may require us to change our operations, potentially resulting in a material adverse effect on our business, prospects, financial condition and operating results. These laws can give rise to liability for administrative oversight costs, cleanup costs, property damage, bodily injury, fines and penalties. Capital and operating expenses needed to comply with environmental laws and regulations can be significant, and violations may result in substantial fines and penalties, third-party damages, suspension of production or a cessation of our operations. Contamination at properties we own or operate, will own or operate, we formerly owned or operated or to which hazardous substances were sent by us, may result in liability for us under environmental laws and regulations, including, but not limited to, the Comprehensive Environmental Response, Compensation and Liability Act, which can impose liability for the full amount of remediation-related costs without regard to fault, for the investigation and cleanup of contaminated soil and ground water, for building contamination and impacts to human health and for damages to natural resources. The costs of complying with environmental laws and regulations and any claims concerning noncompliance, or liability with respect to contamination in the future, could have a material adverse effect on our financial condition or operating results.

In the ordinary course of our business, we (and the third parties upon which we rely) collect, store, receive, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, share and otherwise process (collectively, process or processing) personal information, confidential or proprietary information, sensitive information, intellectual property, trade secrets, and financial information (collectively, sensitive information) from vehicles, customers, employees and others as part of our business and operations. We also work with partners and third-party service providers or vendors that process such data on our behalf and in connection with our vehicles. There can be no assurance that any security measures that we or our third-party service providers or vendors have implemented will be effective against current or future threats to such data. Cyber-attacks, malicious internet-based activity, online and offline fraud, and other similar activities threaten the confidentiality, integrity, and availability of our sensitive information and information technology systems, and those of the third parties upon which we rely. Such threats are prevalent and continue to rise, are increasingly difficult to detect, and come from a variety of sources, including traditional computer "hackers," threat actors, "hacktivists," organized criminal threat actors, personnel (such as through theft or misuse), sophisticated nation states, and nation-state-supported actors. Some actors now engage and are expected to continue to engage in cyber-attacks, including without limitation nation-state actors for geopolitical reasons and in conjunction with military conflicts and defense activities. During times of war and other major conflicts, we, the third parties upon which we rely, and our customers may be vulnerable to a heightened risk of these attacks, including retaliatory cyber-attacks, that could materially disrupt our systems and operations, supply chain, and ability to produce, sell and distribute our goods and services. We and the third parties upon which we rely are subject to a variety of evolving threats, including but not limited to social-engineering attacks (including through deep fakes, which may be increasingly more difficult to identify as fake, and phishing attacks), malicious code (such as viruses and worms), malware (including as a result of advanced persistent threat intrusions), denial-of-service attacks, credential stuffing attacks, credential harvesting, personnel misconduct or error, ransomware attacks, supply-chain attacks, software bugs, server malfunctions, software or hardware failures, loss of data or other information technology assets, adware, telecommunications failures, earthquakes, fires, floods, attacks enhanced or facilitated by AI and other similar threats. In particular, severe ransomware attacks are becoming increasingly prevalent and can lead to significant interruptions in our operations, ability to provide products or services, loss of sensitive information and income, reputational harm, and diversion of funds. Extortion payments may alleviate the negative impact of a ransomware attack, but we may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting such payments. In addition, remote work has become more common and has increased risks to our information technology systems and data, as more of our employees utilize network connections, computers and devices outside our premises or network, including working at home, while in transit and in public locations. Future or past business transactions (such as acquisitions or integrations) could expose us to additional cybersecurity risks and vulnerabilities, as our systems could be negatively affected by vulnerabilities present in acquired or integrated entities' systems and technologies. Furthermore, we may discover security issues that were not found during due diligence of such acquired or integrated entities, and it may be difficult to integrate companies into our information technology environment and security program. We rely on third-party service providers and technologies to operate critical business systems to process sensitive information in a variety of contexts, including, without limitation, cloud-based infrastructure, data center facilities, encryption and authentication technology, employee email, content delivery to customers, and other functions. We also rely on third-party service providers to provide other products, services, vehicle parts, or otherwise to operate our business. Our ability to monitor these third parties' information security practices is limited, and these third parties may not have adequate information security measures in place. If our third-party service providers experience a security incident or other interruption, we could experience adverse consequences. While we may be entitled to damages if our third-party service providers fail to satisfy their privacy or security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such award. In addition, supply-chain attacks have increased in frequency and severity, and we cannot guarantee that third parties' infrastructure in our supply chain or our third-party partners' supply chains have not been compromised. While we have implemented security measures designed to protect against security incidents, there can be no assurance that these measures will be effective. We are also at risk for interruptions, outages and breaches of our: (a) operational systems, including business, financial, accounting, product development, data processing or production processes, owned by us or our third-party vendors or suppliers; (b) facility security systems, owned by us or our third-party vendors or suppliers; (c) transmission control modules or other in-product technology, owned by us or our third-party vendors or suppliers; (d) the integrated software in our products; and (e) customer data and personal information that we process, or our third-party vendors or suppliers, process on our behalf. Our vehicles contain complex information technology systems and built-in data connectivity to accept and install periodic remote updates to improve or update functionality. We utilize in-vehicle services and functionality through the Xosphere™ that utilize data connectivity to monitor performance and timely capture opportunities to enhance on-the-road performance and for safety and cost-saving preventative maintenance. The availability and effectiveness of our Xosphere™ services depend on the continued operation of information technology and communications systems. There are inherent risks associated with developing, improving, expanding and updating our current systems, such as the disruption of our data management, procurement, production execution, finance, supply chain and sales and service processes. For example, software such as our Xosphere™ platform can contain errors, defects, security vulnerabilities or software bugs that are difficult to detect and correct, particularly when such vulnerabilities are first introduced or when new versions or enhancements of our platform are released. Additionally, even if we are able to develop a patch or other fix to address such vulnerabilities, such a fix may be difficult to push out to our customers or otherwise be delayed. Additionally, our business depends upon the appropriate and successful implementation of our Xosphere™ platform by our customers. If our customers fail to use the Xosphere™ platform according to our specifications, our customers may suffer a security incident on their own systems or other adverse consequences. Even if such an incident is unrelated to our security practices, it could result in our incurring significant economic and operational costs in investigating, remediating, and implementing additional measures to further protect our customers from their own vulnerabilities and could result in reputational harm. These risks may affect our ability to manage our data and inventory, procure parts or supplies or manufacture, deploy, deliver and service our products, adequately protect our intellectual property or achieve and maintain compliance with, or realize available benefits under, applicable laws, regulations and contracts. We have designed, implemented and tested security measures intended to prevent unauthorized access to our information technology networks, vehicles and related systems. However, unauthorized actors may attempt to gain access to modify, alter and use such networks, vehicles and systems to gain control of or change our vehicles' functionality, user interface and performance characteristics, or to gain access to data stored in or generated by the vehicle. We have contractual and other legal obligations to notify individuals, regulatory authorities and others of security breaches involving certain types of data. Laws governing data breaches may be inconsistent or change, and new laws may be adopted. In addition, our agreements with certain customers may require us to notify them in the event of a security breach. Such mandatory disclosures are costly, could lead to negative publicity, could divert management's attention, could result in penalties or fines, could result in litigation, may cause our customers to lose confidence in the effectiveness of our security measures and may require us to expend significant capital and other resources to respond to and alleviate problems caused by the actual or perceived security breach. We take steps designed to detect, mitigate and remediate vulnerabilities in our information systems (such as our hardware and/or software, including that of third parties upon which we rely). We may not, however, detect and remediate all such vulnerabilities, including on a timely basis. Further, we may experience delays in developing and deploying remedial measures and patches designed to address vulnerabilities. Vulnerabilities could be exploited and result in a security incident. Any of the previously identified or similar threats could cause a security incident or other interruption that could result in unauthorized, unlawful, or accidental acquisition, modification, destruction, loss, alteration, encryption, disclosure of, or access to our sensitive information or our information technology systems, or those of the third parties upon whom we rely. A security incident or other interruption could disrupt our ability (and that of third parties upon whom we rely) to provide our products. We may expend significant resources or modify our business activities to try to protect against security incidents. Certain data privacy and security obligations may require us to implement and maintain specific security measures or industry-standard or reasonable security measures to protect our information technology systems and sensitive information. Applicable data privacy and security obligations may require us to notify relevant stakeholders, including affected individuals, customers, regulators, and investors, of security incidents. Such disclosures are costly, and the disclosure or the failure (actual or perceived) to comply with such requirements could lead to adverse consequences. If we (or a third party upon whom we rely) experience a security incident or are perceived to have experienced a security incident, we may experience adverse consequences, such as government enforcement actions (for example, investigations, fines, penalties, audits, and inspections); additional reporting requirements and/or oversight; restrictions on processing sensitive information (including personal data); litigation (including class claims); indemnification obligations; negative publicity; reputational harm; monetary fund diversions; diversion of management attention; interruptions in our operations (including availability of data); financial loss; and other similar harms. Security incidents and attendant consequences may prevent or cause customers to stop using our products, deter new customers from using our products, and negatively impact our ability to grow and operate our business. Our contracts may not contain limitations of liability, and even where they do, there can be no assurance that limitations of liability in our contracts are sufficient to protect us from liabilities, damages, or claims related to our data privacy and security obligations. We cannot be sure that our insurance coverage will be adequate or sufficient to protect us from or to mitigate liabilities arising out of our privacy and security practices, that such coverage will continue to be available on commercially reasonable terms or at all, or that such coverage will pay future claims. In addition to experiencing a security incident, third parties may gather, collect, or infer sensitive information about us from public sources, data brokers, or other means that reveals competitively sensitive details about our organization and could be used to undermine our competitive advantage or market position.

Our products rely on software and hardware that is highly technical and complex and will require modification and updates over the life of the vehicle, powertrain or battery pack. In addition, our products depend on the ability of such software and hardware to store, retrieve, process and manage immense amounts of data. Our software and hardware may contain errors, bugs, design defects or vulnerabilities, and our systems are subject to certain technical limitations that may compromise our ability to meet our objectives. Some errors, bugs or vulnerabilities inherently may be difficult to detect and may only be discovered after the code has been released for external or internal use. Although we attempt to remedy any issues we observe in our products as effectively and rapidly as possible, such efforts may not be timely, may hamper production or may not be to the satisfaction of our customers. Additionally, if we are able to address any software issues but our over-the-air update procedures fail, such software updates may have to be installed locally, which could hamper our efforts to remedy issues in a timely fashion. If we are unable to prevent or effectively remedy errors, bugs, vulnerabilities or defects in our software and hardware, we may suffer damage to our reputation, loss of customers, loss of revenue or liability for damages, any of which could adversely affect our business and financial results.

We face intense competition in bringing our products to market. We face competition from many different sources in the commercial vehicle market for medium- and heavy-duty last-mile and return-to-base segments, including existing major commercial vehicle OEMs, such as Daimler, Ford, General Motors, Navistar, Paccar, and Volvo, as well as new companies that are developing alternative fuel and electric commercial vehicles. Many of our current and potential competitors, including Nikola, Rivian, Workhorse, Harbinger, The Lion Electric Company and Motiv Power Systems, may have significantly greater financial, technical, manufacturing, marketing and other resources than we do and may be able to devote greater resources to the design, development, manufacturing, distribution, promotion, sale and support of their products, including their vehicles. Additionally, our competitors may also have greater name recognition, longer operating histories, larger sales forces, broader customer and industry relationships and greater resources than we do. These competitors also compete with us in recruiting and retaining qualified research and development, sales, marketing and management personnel, as well as in acquiring technologies complementary to, or necessary for, our products. Future mergers and acquisitions activity may result in even more resources being concentrated on our competitors. In addition, we also compete with manufacturers of vehicles with internal combustion engines. There are no assurances that customers will choose our vehicles over those of our competitors, or over internal combustion engine vehicles. We expect additional competitors to enter the industry as well. We expect competition in our industry to intensify from our existing and future competitors as consumer demand for electric and alternative fuel vehicles increases and regulatory scrutiny on the motor vehicle industry intensifies.

We have entered and may continue to enter into agreements, purchase orders, letters of intent and memorandums of understanding or similar agreements for the sale of our products that include various cancellation rights in favor of the customer. For example, we have entered into binding distribution and purchase agreements for the purchase of vehicles; however, they are subject to the further entry into a definitive agreement with final pricing, warranty coverage and other terms. These purchase obligations may also be canceled by the customer with six months' written notice. As a result, we cannot assure that we will be able to enter into a definitive agreement or that our customers will not exercise their cancellation rights. In addition, we have entered and may continue to enter into purchase orders, letters of intent and memorandums of understanding or similar agreements that are not binding on our customer and may also be subject to modification and cancellation provisions. Any of these adverse actions related to these agreements, purchase orders, letters of intent, memorandums of understanding or any future customer contracts could harm our business, prospects, financial condition and operating results.

In recent years, the United States and other significant markets have experienced cyclical downturns and worldwide economic conditions remain uncertain. Economic uncertainty and associated macroeconomic conditions, including high volatility and uncertainty in the capital markets including as a result of inflation and interest rate spikes and potential future disruptions in access to bank deposits or lending commitments due to bank failures, supply chain disruption and geopolitical events, such as the war between Russia and Ukraine and in Israel, make it difficult for our customers and us to accurately forecast and plan future business activities, and could cause our customers to slow spending on our products and services. Furthermore, during uncertain economic times our customers may face issues gaining timely access to sufficient funding, which could result in an impairment of their ability to make timely payments to us. If that were to occur, we may be required to increase our allowance for doubtful accounts and our results could be negatively impacted. A weak or declining economy could also strain our suppliers, possibly resulting in supply disruption. In addition, there is a risk that our current or future suppliers, service providers, manufacturers or other partners may not survive such difficult economic times, which would directly affect our ability to attain our operating goals on schedule and on budget. A significant downturn in economic activity, or general spending on transit or commercial vehicle electrification technologies, may cause our current or potential customers to react by reducing their capital and operating expenditures in general or by specifically reducing their spending on electric commercial vehicles and related technologies. In addition, our customers may delay or cancel projects to upgrade or replace existing vehicles in their fleets, or other projects to electrify commercial vehicle fleets, with our products or seek to lower their costs by renegotiating contracts. Moreover, competitors may respond to challenging market conditions by lowering prices and attempting to lure away our customers. Given the global nature of our supply chain and customer base, global political, economic, and other conditions, including geopolitical risks such as the current conflicts between Russia and Ukraine and in Israel and related sanctions, may adversely affect our business and results of operations in ways we cannot foresee at the outset or at this point. War and economic dislocations may spur recessions, economic downturns, slowing economic growth and social and political instability; commodity shortages, supply chain risks and price increases; instability in U.S. and global capital and credit markets which could impact us, our suppliers and customers; and currency exchange rate fluctuations among other impacts that adversely affect our business or results of operations. We cannot predict the timing, strength, or duration of any economic slowdown or any subsequent recovery generally, or in any industry. If the conditions in the general economy and the markets in which we operate worsen from present levels, our business, financial condition, and operating results could be adversely affected.

If we expand our operations internationally, we may face risks associated with our future international operations, including possible unfavorable regulatory, political, tax and labor conditions, which could harm our business. We anticipate having international operations which would subject us to the legal, political, regulatory and social requirements and economic conditions in any future jurisdictions. However, we have limited experience to date selling and servicing our products internationally and such expansion would require us to make significant expenditures, including the hiring of local employees and establishing facilities, in advance of generating any revenue. We are subject to a number of risks associated with international business activities that may increase our costs, impact our ability to sell and lease our products and require significant management attention. These risks include (i) conforming our products to various international regulatory requirements where our products are sold; (ii) difficulties in obtaining or complying with various licenses, approvals, certifications and other authorizations necessary to manufacture, sell, lease or service our products in any of these jurisdictions; (iii) difficulty in staffing and managing foreign operations; and (iv) difficulties attracting customers in new jurisdictions. If we fail to successfully address these risks, our future business, prospects, financial condition and operating results could be materially and adversely affected.

The U.S. government has previously imposed tariffs on certain foreign goods, including steel and certain vehicle parts, which have resulted in increased costs for goods imported into the United States. In response to these tariffs, a number of U.S. trading partners have imposed retaliatory tariffs on a wide range of U.S. products, which makes it more costly for us to export our products to those countries. Recent events, including new policy introductions following the 2020 U.S presidential election, may result in substantial regulatory uncertainty regarding international trade and trade policy. United States policies have called for substantial changes to trade agreements, have increased tariffs on certain goods imported into the U.S. and have raised the possibility of imposing significant additional tariff increases. If we are unable to pass price increases on to our customer base or otherwise mitigate the costs, or if demand for our exported products decreases due to the higher cost, our operating results could be materially and adversely affected. While we cannot predict the extent to which the United States or other countries will impose quotas, duties, tariffs, taxes or other similar restrictions upon the import or export of our products in the future, a "trade war" of this nature or other governmental action related to tariffs or international trade agreements could have an adverse impact on demand for our services, sales and clients and affect the economies of the United States and various countries, having an adverse effect on our business, financial condition and results of operations.