activities. Anti-corruption laws are interpreted broadly and prohibit companies and their employees, agents, contractors and other collaborators from authorizing, promising, offering or
providing, directly or indirectly, improper payments or anything else of value to recipients in the public or private sector. Aeva can be held liable for the corrupt or other illegal activities of its employees, agents, contractors and other
collaborators, even if Aeva does not explicitly authorize or have actual knowledge of such activities. Any violations of the laws and regulations described above may result in substantial civil and criminal fines and penalties, imprisonment, the
loss of export or import privileges, debarment, tax reassessments, breach of contract and fraud litigation, reputational harm and other consequences.
Aevas business may be adversely affected by changes in automotive, consumer electronics, LiDAR sensor and laser safety regulations or concerns
that drive further regulation of the automobile, consumer electronics, LiDAR sensor and laser markets.
Government product safety
regulations are an important factor for Aevas business. Historically, these regulations have imposed ever-more stringent safety regulations for vehicles and laser products. These safety regulations often require, or customers demand that,
vehicles have more safety features per vehicle and more advanced safety products.
While Aeva believes increasing automotive and laser
safety standards will present a market opportunity for its products, government safety regulations are subject to change based on a number of factors that are not within its control, including, among others, new scientific or technological data,
adverse publicity regarding the industry recalls and safety risks of AD and ADAS, accidents involving its products, domestic and foreign political developments or considerations, and litigation relating to its products and its competitors
products. Changes in automotive, consumer electronics, LiDAR sensor and laser safety government regulations, especially in the AD and ADAS industries, could adversely affect Aevas business. If government priorities shift and Aeva is unable to
adapt to changing regulations, its business may be materially and adversely affected.
Federal and local regulators impose more stringent
compliance and reporting requirements in response to product recalls and safety issues in the automotive and laser industry. As cars that carry Aevas sensors go into production, the obligations of complying with safety regulations and
reporting requirements could increase and it could require increased resources and adversely affect Aevas business.
Autonomous and ADAS
features may be delayed in adoption by OEMs, and Aevas business impacted, as additional emissions and safety requirements are imposed on vehicle manufacturers.
Vehicle regulators globally continue to consider new and enhanced emissions requirements, including electrification, to meet environmental and
economic needs as well as pursue new safety standards to address emerging traffic risks. To control new vehicle prices, among other concerns, OEMs may need to dedicate technology and cost additions to new vehicle designs to meet these emissions and
safety requirements and postpone the consumer cost pressures of new autonomous and ADAS features.
Aevas business may be adversely affected if
it fails to comply with the regulatory requirements under the Federal Food, Drug, and Cosmetic or the Food and Drug Administration (the FDA).
As a LiDAR technology company, Aeva is subject to the Electronic Product Radiation Control Provisions of the Federal Food, Drug, and Cosmetic
Act. These requirements are enforced by the FDA. Electronic product radiation includes laser technology. Regulations governing these products are intended to protect the public from hazardous or unnecessary exposure. Manufacturers are required to
certify in product labeling and reports to the FDA that their products comply with applicable performance standards as well as maintain manufacturing, testing, and distribution records for their products. Failure to comply with these requirements
could result in enforcement action by the FDA, which could require Aeva to cease distribution of its products, recall or remediate products already distributed to customers, or subject Aeva to FDA enforcement.
Failures, or perceived failures, to comply with privacy, data protection, and information security requirements in the variety of jurisdictions in which
Aeva operates may adversely impact its business, and such legal requirements are evolving, uncertain and may require improvements in, or changes to, Aevas policies and operations.
Aevas current and potential future operations and sales subject it to laws and regulations addressing privacy and the collection, use,
storage, disclosure, transfer and protection of a variety of types of data. For example, the European Commission has adopted the General Data Protection Regulation and California recently enacted the California Consumer Privacy Act of 2018, both of
which provide for potentially material penalties for non-compliance. These regimes may, among other things, impose data security requirements, disclosure requirements, and restrictions on data collection,
uses, and sharing that may impact Aevas operations and the development of its business. Aeva has limited access to, collect, store, process, or share certain information collected by its products, and Aevas products may evolve to collect
additional information. Therefore, the full impact of these privacy regimes on Aevas business is rapidly evolving across jurisdictions and remains uncertain at this time.
Aeva may also be affected by cyber-attacks and other means of gaining unauthorized access to its products, systems, and data. For instance,
cybercriminals or insiders may target Aeva or third parties with which it has business relationships to obtain data, or in a manner that disrupts Aevas operations or compromises its products or the systems into which its products are
integrated.
Aeva is assessing the continually evolving privacy and data security regimes and measures it believes are appropriate in
response. Since these data security regimes are evolving, uncertain and complex, especially for a global business like Aevas, it may need to update or enhance its compliance measures as its products, markets and customer demands further
develop, and these updates or enhancements may require implementation costs. In addition, Aeva may not be able to monitor and react to all developments in a timely manner. The compliance measures Aeva does adopt may prove ineffective. Any failure,
or perceived failure, by Aeva to comply with current and future regulatory or customer-driven privacy, data protection, and information security requirements, or to prevent or mitigate security breaches, cyber-attacks, or improper access to, use of,
or disclosure of data, or any security issues or cyber-attacks affecting Aeva, could result in significant liability, costs (including the costs of mitigation and recovery), and a material loss of revenue resulting from the adverse impact on its
reputation and brand, loss of proprietary information
48