INTU · CIK 896878
What Intuit Inc. told the SEC could break it.
Intuit's disclosures center on the accuracy of its products and the infrastructure it runs them on. Customers rely on its offerings being correct, and all of its tax products (and many non-tax ones) run on rigid development timetables that raise the risk of errors and launch delays — potentially bringing legal liability, regulatory action or brand harm. Delivering those products depends heavily on third parties: it relies on outside facilities, power and cloud-computing systems, in some cases through sole- or limited-source relationships that are hard to replace given how deeply integrated they are, and it does not have redundancy for all of its systems. It also flags rising compliance costs from emerging AI and data-protection rules, including the EU AI Act (in force February 2025) and new state frameworks in Utah, Colorado and California.
4 self-disclosed vulnerabilities, pulled from its own filings, each in the company’s words, with the source. This is the risk register almost nobody reads.
In its own words
What could break it.
Regulatory & policy
- tax-product accuracy and rigid development timetables increasing error/launch-delay riskmedium
Customers rely on the accuracy of Intuit's offerings; all of its tax products and many non-tax products have rigid development timetables that increase the risk of errors and launch delays, which could result in legal liability, regulatory action, or brand harm.
“Our customers rely on the accuracy of our offerings. All of our tax products and many of our non-tax products have rigid development timetables that increase the risk of errors in our products and the risk of launch delays.”
SEC filing →As of 2025 - evolving AI regulation (EU AI Act, Utah/Colorado/California) and data/consumer-protection lawslow
The EU AI Act went into force in February 2025, and countries/states (Utah, Colorado, California) are applying data/consumer-protection laws to AI or enacting AI frameworks; compliance with these emerging laws may add significant costs to Intuit's business.
“in February 2025, the European Union's Artificial Intelligence Act (AI Act) went into force regulating AI systems that affect individuals located in the EU. Additionally, countries and states are applying their data and consumer protection laws to AI and/or enacting or considering legal frameworks on AI, including Utah, Colorado, and California.”
Sole-source dependency
- sole/limited-source third-party relationships for infrastructure and integrated products/servicesmedium
Intuit relies on third parties to maintain physical facilities, equipment, power systems and infrastructure; in certain instances these are sole- or limited-source relationships that are difficult to replace given integration depth, and there may be few or no alternative vendors.
“In certain instances, these third-party relationships are sole source or limited source relationships and can be difficult to replace or substitute depending on the level of integration of the third party's products or services into, or with, our offerings and/or the general availability of such third party's products and services. In addition, there may be few or no alternative third-party providers or vendors in the market.”
SEC filing →As of 2025
Supplier concentration
- dependence on third-party cloud/IT infrastructure with incomplete redundancymedium
As Intuit grows its online services it depends increasingly on the continuing operation and availability of its IT/communications systems and external providers' systems, including third-party cloud computing services, and does not have redundancy for all of its systems.
“we become more dependent on the continuing operation and availability of our information technology and communications systems and those of our external service providers, including, for example, third-party Internet-based or cloud computing services. We do not have redundancy for all of our systems, and our disaster recovery planning may not account for”
SEC filing →As of 2025
In the MyPRIA app, this is checked against the companies you actually own.
← World Watch