AI · CIK 0001577526
What C3.ai, Inc. told the SEC could break it.
C3.ai's disclosures pair persistent customer concentration with regulation aimed squarely at its product category. A few anonymized customers carry an outsized share of its $389.1M revenue base — two were 19% and 12% in fiscal 2025, and a single customer was 35% in fiscal 2023, with the long-running Baker Hughes alliance winding down — so a pullback from the top relationships would materially impair revenue. As an enterprise-AI vendor, it is directly exposed to the EU AI Act's obligations on high-risk and general-purpose AI systems, which carry fines up to €35 million or 7% of global turnover and could delay deployments, and to the U.S. DOJ data-security rule restricting data transactions involving countries of concern such as China, Russia and Iran.
3 self-disclosed vulnerabilities, pulled from its own filings, each in the company’s words, with the source. This is the risk register almost nobody reads.
In its own words
What could break it.
Regulatory & policy
- EU AI Act — restrictions/obligations on high-risk and general-purpose AI models; fines up to €35M or 7% of global turnovermedium
As an enterprise-AI software vendor, C3.ai is directly exposed to the EU AI Act, which imposes restrictions and obligations on developers and users of 'high-risk' AI systems and general-purpose AI models (including those with systemic risk), with administrative fines up to €35 million or 7% of global annual turnover for non-compliance. It warns the Act could increase costs and burdens for it and its customers, delay or halt deployment of new products/services, and reduce new-customer additions. A specific, named, quantified AI-regulatory exposure that strikes at the core product category — a structural policy risk distinctive to AI-platform companies.
“the EU AI Act could impose more restrictions and obligations. This could increase the costs and burdens to us and our customers, delay or halt deployment of new products and services, and may reduce the number of new customers, negatively impacting our business and financial results.”
SEC filing →As of 2025 - DOJ 'countries of concern' data-security rule — restrictions on data transactions involving China, Russia, Iran and covered personslow
C3.ai is subject to the U.S. data-security rule restricting certain bulk/sensitive data transactions involving countries of concern (e.g., China, Russia, Iran) and covered persons (individuals/entities located in or controlled from those jurisdictions), which can constrain vendor engagements, data sale/sharing, employment of certain individuals, and investor agreements, with significant civil and criminal penalties for violations. As a data- and AI-platform company with a global workforce (Bengaluru, Singapore, etc.) and government/defense customers, this national-security data-transfer regime is a specific, named compliance and operational exposure. A bounded but distinct data-sovereignty/policy risk.
“places additional restriction on certain data transactions involving countries of concern (e.g., China, Russia, Iran)”
SEC filing →As of 2025
Customer concentration
- Customer concentration — two (unnamed) Customer-Entities = 19% and 12% of FY2025 revenue; one was 35% in FY2023medium
C3.ai discloses heavy revenue concentration in a few anonymized 'Customer-Entities': two accounted for 19% and 12% of revenue in FY2025 (ended April 30, 2025), 27% and 14% in FY2024, and a single Customer-Entity was 35% of revenue in FY2023. On a $389.1M revenue base, losing or seeing a pullback from the top one or two relationships (historically anchored by the Baker Hughes alliance, which has been winding down) would materially impair revenue. The names are withheld in the filing, so this is captured as a concentration risk rather than a named edge. A high, persistent customer-concentration exposure.
“Two separate Customer-Entities accounted for 19 % and 12 % of revenue for the fiscal year ended April 30, 2025.”
SEC filing →As of 2025
In the MyPRIA app, this is checked against the companies you actually own.
← World Watch