PATH · CIK 1734722
What UiPath, Inc. told the SEC could break it.
UiPath leans on others to sell: it relies on channel partners and strategic alliances to generate a substantial amount of its revenue and to deploy and support its platform, so a failure to expand and manage those distribution channels could cause revenue to decline. Regulation lands squarely in its domain — as a provider of AI-driven agentic automation, it is directly exposed to the EU AI Act's onerous obligations for AI providers and deployers, alongside the EU Data Act and other EU security rules, raising compliance costs and constraining product practices in Europe. Its revenue is also concentrated in big accounts: it derives a substantial portion from its top 10% of customers — 357 customers with at least $1 million in ARR were about 52% of fiscal-2026 revenue — so large-customer decisions can move results, even though no single customer reaches 10%.
3 self-disclosed vulnerabilities, pulled from its own filings, each in the company’s words, with the source. This is the risk register almost nobody reads.
In its own words
What could break it.
Other disclosures
- channel-partner revenue dependencemedium
UiPath relies on its channel partners and strategic alliances to generate a substantial amount of its revenue and to deploy and support its platform; failure to expand and manage these distribution channels could cause revenue to decline.
“We rely on our channel partners, including our strategic alliances, to generate a substantial amount of our revenue, and if we fail to expand and manage our distribution channels or fulfill our future service obligations, our revenue could decline and our growth prospects could suffer.”
SEC filing →As of 2026
Regulatory & policy
- EU AI Act compliance burden on AI/automation providermedium
As a provider of AI-driven agentic-automation systems, UiPath is directly exposed to the EU AI Act, which imposes onerous obligations on providers and deployers of AI systems (alongside the EU Data Act and other EU security regulations), raising its compliance costs and constraining product practices in the EEA.
“Furthermore, the EU AI Act imposes onerous obligations for providers and deployers of AI-related systems, the EU Data Act imposes obligations on providers of data processing services, and other EU security regulations are shaping cybersecurity obligations of cloud service providers.”
SEC filing →As of 2026
Customer concentration
- large-customer concentration — top 10% of customers = substantial portion of revenue/ARRlow
A limited number of customers represent a substantial portion of UiPath's revenue and ARR — it derives a substantial portion from its top 10% of customers (357 customers with ≥$1M ARR accounted for ~52% of fiscal 2026 revenue) — so large-customer purchasing decisions can move results materially, though no single customer is disclosed at ≥10%.
“We derive a substantial portion of our revenue and ARR from sales to our top 10% of customers.”
SEC filing →As of 2026
In the MyPRIA app, this is checked against the companies you actually own.
← World Watch