Arista Networks, Inc. (ANET) Risk Factors

Recent key developments

Concrete developments — dated events, named agreements and instruments, legal proceedings — that Arista Networks, Inc. surfaced in its latest filing.

• In February 2026, the U.S. Supreme Court held tariffs imposed under IEEPA were invalid.February 2026
• Completed the acquisition of VeloCloud in June 2025.June 2025
• January 5, 2026 OECD elective safe harbor package exempting U.S.-parented multinational entities from certain Pillar Two provisions.January 5, 2026
• The Department of Justice issued a final rule that places limitations on access to, or certain transfers of, sensitive personal data to business partners located in China or with other specified links to China.
• Our contract with one of our contract manufacturers permits it to terminate the agreement for convenience, subject to prior notice requirements.
• In two prior investigations brought by Cisco in the International Trade Commission, we were subjected to remedial orders prohibiting import and sale of products found to infringe Cisco’s patents, requiring redesign and U.S. Customs and Border Protection approval before resuming imports.
• The UFLPA, effective June 2022, creates a rebuttable presumption that any goods mined, produced or manufactured wholly or in part in the XUAR of China, or produced by a UFLPA-listed entity, were made with forced labor and are not entitled to entry at any U.S. port.June 2022
• In October 2022, the U.S. expanded controls restricting the ability to send certain products and technology related to semiconductors, semiconductor manufacturing, and supercomputing.October 2022
• In January 2025, new regulations were introduced to further expand controls with a worldwide licensing requirement on certain ICs and computing resources used for training AI models; the administration later announced its intention to rescind and nonenforce these regulations before the scheduled compliance date.January 2025
• The California Consumer Privacy Act (CCPA) became operative on January 1, 2020 and was amended by the California Privacy Rights Act (CPRA) going into effect over time through July 1, 2023.January 1, 2020
• EU courts later invalidated the E.U.-U.S. Privacy Shield and imposed additional obligations in connection with use of the SCCs.
• The European Commission subsequently issued new SCCs, but their continued validity for cross-border data transfer is uncertain.
• The UK has implemented legislation substantially mirroring the GDPR with fines up to the greater of 17.5 million British Pounds or four percent of the previous year’s annual revenue.
• The UK has issued new standard contractual clauses that are required to be implemented.
• India released its Digital Personal Data Protection Act 2023, and finalized Digital Personal Data Protection Rules on November 13, 2025, with phased compliance deadlines between 2025 and 2027.November 13, 2025
• The Network and Information Security Directive II (NIS2) adopted in 2023 expands cybersecurity scope and requires all 27 EU member states to issue implementing legislation by October 2024, though several have not finalized.October 2024
• The Digital Operational Resiliency Act (DORA) became effective in January 2025, establishing a universal framework for managing ICT risks for financial sector entities and their third-party cloud service providers.January 2025
• The Inflation Reduction Act of 2022 imposes a 1% excise tax on the value of certain stock repurchases.2022
• The company is subject to Section 203 of the Delaware General Corporation Law, restricting mergers or combinations with 15% or greater stockholders for a certain period.
• China imposed export controls on critical minerals including rare earths metals in retaliation.
• Since February 2025, the U.S. imposed global, country-specific, and commodity-specific tariffs under executive orders citing IEEPA, Sections 122 and 301 of the Trade Act of 1974, and Section 232 of the Trade Expansion Act of 1962.February 2025
• Enactment of California Senate Bill 122, which extends the $5 million limitation on business tax credits through 2029 and establishes a permanent credit cap starting in 2030.