The Company’s unconditional obligations are non-cancelable contractual commitments primarily related to the Company’s investments in SI infrastructure and third-party cloud capacity arrangements and other service arrangements. It also includes the Company’s commitments under the Spectrum Transaction, which are payable in cash and in the Company’s Class A common stock.

The Company had outstanding letters of credit of $1,470 million at September 30, 2026 related to various customer contracts, insurance agreements, and facility lease agreements. All of the outstanding letters of credit were collateralized by restricted cash. The Company also had surety bonds of $470 million for self-insured workers’ compensation programs and other governmental licenses at September 30, 2026.

In the normal course of its business, the Company is involved from time to time in various arbitrations, class actions, commercial litigation, investigations and other legal, regulatory or governmental actions, including the significant matters described below that could have a material impact on our results of operations. The Company assesses, in conjunction with its legal counsel, the need to record a liability for litigation and contingencies. With respect to the cases, actions, and inquiries described below, the Company evaluates the associated developments on a regular basis and will accrue a liability when it believes a loss is probable and the amount can be reasonably estimated. In addition, the Company believes there is a reasonable possibility that it may incur a loss in some of these matters and the loss may be material or exceed its estimated ranges of possible loss.

The outcomes of the matters described in this section, such as whether the likelihood of loss is remote, reasonably possible, or probable, or if and when the reasonably possible range of loss is estimable, are inherently uncertain, and unless specified otherwise, possible losses are not reasonably estimable at this time. If one or more of these matters were resolved against the Company for amounts above management’s estimates, the Company’s financial condition and results of operations, including in a particular reporting period in which any such outcome becomes probable and estimable, could be materially adversely affected.

In November 2022, the European Union’s Digital Services Act (“DSA”) came into force as a result of which X has to comply with extensive content moderation and other duties. X published its first Transparency Report under the DSA in November 2023. In December 2023, the European Commission (“EC”) opened a formal investigation into X Corp. and its Irish subsidiary, Twitter International Unlimited Company (“TIUC”), which was later renamed to X Internet Unlimited Company (XIUC). On July 12, 2024, in relation to alleged breaches of Articles 25(1), 39 and 40(12) of the DSA, the EC issued preliminary findings that X’s blue checkmark is deceptive, its advertisement repository does not meet DSA requirements, and it grants inadequate access to data to third-party researchers. On September 26, 2024, XIUC and X submitted their observations challenging the EC’s preliminary findings. On December 5, 2025, the EC delivered a final decision in which it upheld its preliminary findings and imposed a fine of EUR 120 million on XIUC, X Corp., X.AI Holdings Corp., and Elon Musk (together, the “parties”). On February 16, 2026, the parties challenged the EC’s decision in the General Court of the European Union. In July and August 2026, applications for leave to intervene were filed in the case, including by the United States, the Republic of Ireland, Democracy Reporting International gGmbH, Associação Ius Omnibus, NetChoice, Koordinierungsstelle für digitale Dienste, Stichting Article 19, Fundacja Obserwatorium Demokracji Cyfrowej. The parties filed their observations on these applications on September 22, 2026. The case remains pending.

In March 2016, non-practicing entity Youtoo Technologies filed suit against Twitter, Inc. (the predecessor-in-interest to X Corp.) in the United States District Court for the Northern District of Texas alleging its Vine and Periscope products infringe Youtoo’s video-sharing patents (the ‘304, ‘506, and ‘997 patents). On Twitter’s motion, the district court dismissed the ‘304 and ’506 patents as invalid. Twitter filed petitions for Inter Partes Review before the Patent Trial and Appeals Board (PTAB) challenging all three patents-in-suit. The PTAB upheld the ‘304 and ‘506 Patents and invalidated the ‘997 Patent; the Federal Circuit affirmed. On March 16, 2020, Plaintiff (now Vidstream LLC, which allegedly acquired the patents from Youtoo Technologies in a bankruptcy proceeding), moved the Court to reconsider its earlier ruling invalidating the ‘304 and ‘506 patents. On April 1, 2022, the Court reversed its original ruling on the ‘304 and ‘506 patents. On September 27, 2024, Vidstream filed a motion for partial summary judgment, which the Court granted in part. The case went to a jury trial, and on April 16, 2025, the jury rendered a verdict finding (i) that Twitter did not infringe any claim of the ‘506 patent and two out of three claims of the ‘304 patent and that each of those patent claims was invalid, but (ii) that Twitter willfully infringed one claim of the ‘304 patent. The jury awarded Plaintiff $105 million in damages. In November 2025,

In June 2023, music publishing companies that are members of the National Music Publishers’ Association (the “NMPA”) filed a complaint against X Corp. in the U.S. District Court for the Middle District of Tennessee, claiming direct, contributory, and vicarious copyright infringement based on Twitter’s alleged failure to expeditiously take down infringing music posted by users after the music publishers allegedly gave Twitter notice of those infringements. The music publishers also allege that Twitter did not suspend the accounts of “repeat infringers,” so that Twitter is not entitled to a “safe harbor” from liability under the DMCA. In March 2024, the Court dismissed plaintiffs’ direct infringement and vicarious infringement claims, and part of plaintiffs’ claim for contributory infringement. Following the Supreme Court’s decision in Cox Comm’s, Inc. v. Sony Music Entm’t., the Court granted the parties’ joint motion for a stay to allow X Corp. to file a renewed motion to dismiss. On July 16, 2026, the parties stipulated to the dismissal of all the NMPA’s claims, and the matter is now closed.

In September 2023, Dutch foundation Stichting Data Bescherming Nederland (“SDBN”) filed a putative class action lawsuit in the District Court of Amsterdam in the Netherlands against TIUC, Twitter, Inc., X Corp., and Twitter Netherlands B.V. (together, the “Twitter parties”) related to Twitter’s operation of the MoPub platform. SDBN primarily claims that MoPub’s real-time bidding ad exchange violated the GDPR. SDBN claims to represent 11 million Dutch internet users who downloaded and used third-party mobile apps containing the MoPub software development kit during the period 2013-2022 and it seeks a monetary award in the range of €250 to €2,500 per person. On February 4, 2026, the Court declined to allow the case to proceed as a class action and indicated that it is considering staying the proceedings until the Court of Justice of the European Union has ruled in a separate case concerning the applicability of Dutch class action requirements to GDPR claims. The Twitter parties filed a brief in support of the proposed stay, which the plaintiffs opposed, on March 4, 2026.

In August 2024, Dutch foundation Stichting Onderzoek Marktinformatie (SOMI) initiated a collective action in the District Court of Amsterdam in the Netherlands on behalf of approximately 7.8 million Dutch X users. Among other things, SOMI seeks damages against TIUC, X Corp. and Twitter Netherlands B.V. (collectively, the “X entities”) for: (1) alleged data breaches and insufficient security measures; (2) alleged unauthorized microtargeting and lack of transparency; and (3) the alleged failure to moderate hate speech and the obstruction of research, all in violation of the GDPR and/or DSA. The alleged data breaches relate to a Twitter API bug that came to light in 2022 and that had allowed persons who knew the email address or phone number of a user to determine the user’s Twitter ID. SOMI has requested compensation (to be assessed at a later stage) for each member of the class, including symbolic damages of EUR 1 for each member of the class that is allegedly affected by hate speech on the X platform. The X entities filed a procedural defense on March 12, 2025. On May 27, 2026, the court determined that SOMI satisfies most admissibility requirements but held that it was unable to establish that SOMI meets the financial safeguard requirements under Dutch law. SOMI provided the court with further information about its financing arrangements on June 24, 2026. The X entities responded to SOMI's submission on July 29, 2026. The parties are now awaiting the court's decision on whether SOMI meets the financial safeguard requirements under Dutch law.

In September 2025, non-practicing entity Search and Share Technologies, LLC (“SaS”) filed a patent complaint against X Corp. in the Federal District Court for the Western District of Texas. SaS alleges that X Corp. infringed on U.S. Patent Nos. 10,180,952 and 11,106,744, through features in its mobile app and website enabling users to interact with content through dedicated interfaces that directly share what other users see in ranked feeds and search results. SaS filed an Amended Complaint on January 5, 2026. On January 20, 2026, X Corp. moved to dismiss SaS’s willful infringement and induced infringement claims. On February 3, 2026, SaS responded to, but did not oppose, X Corp.’s partial motion to dismiss. On February 10, 2026, X Corp. filed its reply. On February 4, 2026, X Corp. filed an IPR petition challenging the ‘744 Patent and on February 18, 2026, filed an IPR petition challenging the '952 Patent. On July 14, 2026, the Director instituted both IPRs against the SaS patents.

Beginning in January 2026, the Company and certain subsidiaries have been named as defendants in multiple lawsuits arising from Grok’s image-generation and editing features. The complaints generally allege that Grok’s image-generation and editing features enabled the creation and dissemination of nonconsensual explicit images and/or content representing women and/or children in sexualized contexts. The actions include several actions instituted in the U.S. District Court for the Northern District of California beginning on January 23, 2026 against SpaceXAI Corp. and SpaceXAI LLC (together, “SpaceXAI”). These include multiple putative class actions asserting claims including, among other things, strict liability, negligence, nuisance, rights of privacy or publicity, and certain federal statutory claims. Plaintiffs in these actions seek, among other things, compensatory, statutory and punitive damages, restitution, disgorgement, and injunctive relief. On September 28, 2026, in Jane Doe v. X.AI Corp. and X.AI LLC (5:26-cv-00772-PCP), the court denied SpaceXAI’s motion to transfer the action to the Northern District of Texas on the ground that the forum selection clause in the X terms of service was unconscionable, and also denied SpaceXAI’s motion to stay. In addition, certain subsidiaries are facing several individual user actions in the U.S. District Court for the Western District of Arkansas. These cases generally assert federal statutory claims, Arkansas statutory claims, and Arkansas common law claims including product liability, negligence, and invasion of privacy. These plaintiffs seek, among other things, compensatory, statutory and punitive damages,

restitution, disgorgement, and injunctive relief. On October 2, 2026, the plaintiffs in the Western District of Arkansas actions moved the United States Judicial Panel for Multidistrict Litigation for consolidation of these and other allegedly similar actions in the Western District of Arkansas. The Mayor and City Council of Baltimore filed suit against X Corp., SpaceXAI, and the Company in the Baltimore City Circuit Court on March 24, 2026. The suit was subsequently removed to the U.S. District Court for the District of Maryland. Baltimore asserts claims under its Consumer Protection Ordinance and seeks statutory penalties and injunctive relief. Baltimore voluntarily dismissed the Company from the suit, and X Corp. and SpaceXAI have moved to dismiss the suit. Lastly, on October 19, 2026, the Office of the Attorney General of the Commonwealth of Virginia sent a notice of violation pursuant to Va. Code § 59.1-203 to SpaceX, SpaceXAI and X Corp., notifying the companies that it is contemplating bringing suit based on allegations that they misrepresented and omitted Grok’s propensity to generate nonconsensual explicit images and/or content representing women and/or children in sexualized contexts and the limits of related safeguards.

On April 14, 2026, the National Association for the Advancement of Colored People and the NAACP Mississippi State Conference (together, the “NAACP”) filed suit against X.AI Corp. and MZX Tech, LLC (together, the “SpaceXAI entities”) in the U.S. District Court for the Northern District of Mississippi, alleging that the mobile gas turbines powering the COLOSSUS II data center with the permission of the Mississippi Department of Environmental Quality are in violation of the Clean Air Act because they allegedly constitute stationary sources without the proper permits. On May 6, 2026, the NAACP filed a preliminary injunction motion seeking to enjoin the operation of the turbines, which the SpaceXAI entities opposed. The United States has moved to intervene to dismiss the action, and the State of Mississippi has filed an amicus brief opposing the NAACP’s preliminary injunction motion. On September 18, 2026, the United States appealed the District Court’s failure to rule on its intervention motion to the U.S. Court of Appeals for the Fifth Circuit, and on September 22, 2026, the United States asked the District Court to stay all proceedings in the case pending appeal. On October 19, 2026, the Fifth Circuit denied the appeal and stay as premature, and the district court granted the United States’ motion to intervene but declined to allow it to dismiss the case.

On May 14, 2026, SpaceXAI LLC was named in a putative class action filed in the U.S. District Court for the Northern District of California alleging that Grok.com utilized certain tracking technologies owned by Google, Meta, and TikTok in violation of the Electronic Communications Privacy Act, California’s Invasion of Privacy Act, the California Constitution, and common law. The complaint seeks certification as a class, injunctive relief, unspecified damages, attorneys’ fees, costs, and interest. On June 10, 2026, SpaceXAI LLC moved to transfer the action to the U.S. District Court for the Northern District of Texas. On August 10, 2026, SpaceXAI LLC moved to dismiss the complaint. On August 13, 2026, the court denied SpaceXAI LLC’s motion to transfer the action to the U.S. District Court for the Northern District of Texas. SpaceXAI LLC intends to defend itself vigorously in this action.

In August 2026, SpaceXAI LLC and affiliates CTC Property LLC and MZX Tech LLC (together, the “SpaceXAI companies”) filed a complaint in the U.S. District Court for the Western District of Tennessee against Darana Hybrid, Inc., Cuttell Motorsports, LLC (doing business as the International Hot Rod Association), and Darryl Cuttell (together, the “defendants”). A related action has been consolidated. The amended complaint, filed in September 2026, alleges breach of a master services agreement for construction of the plaintiffs’ super intelligence computing facilities in the Memphis area, together with fraud, conversion, unjust enrichment, and trademark claims, and seeks compensatory damages the SpaceXAI companies estimate at more than $500 million. The defendants dispute the claims, have moved to dismiss, and have asserted counterclaims and recorded construction liens seeking approximately $569 million for alleged unpaid work.

The Company has recorded an accrual of $350 million and $399 million for litigation losses that are probable and reasonably estimable in Accrued expenses and other current liabilities and Other liabilities on the consolidated balance sheet as of September 30, 2026 and December 31, 2025, respectively. For other matters, the Company is not currently able to estimate the reasonably possible loss or range of loss.