Gorilla Technology - 20-F annual report

FREQUENTLY USED TERMS

Unless otherwise stated or unless the context otherwise requires, the terms “Company,” “the registrant,” “our company,” “the company,” “we,” “us,” “our,” “ours,” “Gorilla,” and “Group” refer to Gorilla Technology Group Inc. and its subsidiaries. In this annual report:

PRESENTATION OF FINANCIAL AND OTHER INFORMATION

This Annual Report includes the audited consolidated financial statements of the Company as of December 31, 2025 and 2024, and for each of the three years ended December 31, 2025, 2024 and 2023, prepared in accordance with IFRS, as issued by the IASB, and presented in U.S. dollars.

Our fiscal year ends on December 31 of each year. References to fiscal year 2023 and 2023 are references to the fiscal year ended December 31, 2023, references to fiscal year 2024 and 2024 are references to the fiscal year ended December 31, 2024, and references to fiscal year 2025 and 2025 are references to the fiscal year ended December 31, 2025.

TRADEMARKS

We or our licensors have proprietary rights to trademarks, copyrights, trade names or service marks used in this Annual Report that are important to our business, many of which are registered under the applicable intellectual property laws. Solely for convenience, the trademarks, trade names and service marks referred to in this Annual Report may appear without the “®” or “™” symbols, but such references are not intended to indicate, in any way, that we will not assert, to the fullest extent possible under applicable law, our rights or the rights of the applicable licensor to these trademarks, trade names and service marks. This Annual Report also contains trademarks, copyrights, tradenames and service marks of other companies, which are the property of their respective owners. We do not intend our use or display of other companies’ trademarks, copyrights, trade names or service marks to imply a relationship with, or endorsement or sponsorship of us by, any other companies. Each trademark, copyright, trade name or service mark of any other company appearing in this Annual Report is the property of its respective holder.

MARKET INFORMATION

Unless otherwise indicated, information in this Annual Report concerning economic conditions, our industry, our markets and our competitive position is based on a variety of sources, including information from independent industry analysts and publications, as well as our own estimates and research.

Our estimates are derived from publicly available information released by third-party sources, as well as data from our internal research, which we believe to be reasonable.

Certain estimates of market opportunity and forecasts of market growth included in this Annual Report may prove to be inaccurate. The estimates and forecasts in this Annual Report relating to the size of our target market, market demand and adoption, capacity to address this demand and pricing may prove to be inaccurate. The addressable market we estimate may not materialize for many years, if ever, and even if the markets in which we compete meet the size estimates in this Annual Report, our business could fail to grow at similar rates, if at all.

Forecasts and other forward-looking information obtained from these sources are subject to the same qualifications and uncertainties as the other forward-looking statements in this Annual Report. See Item 3. “Key Information – 3.D. Risk Factors.” and below “Special Note Regarding Forward-Looking Statements.”

SPECIAL NOTE REGARDING FORWARD-LOOKING STATEMENTS

This Annual Report contains certain estimates and “forward-looking statements” within the meaning of the Private Securities Litigation Reform Act of 1995, the provisions of Section 27A of the Securities Act and Section 21E of the Exchange Act. Forward-looking statements include financial projections, statements of plans and objectives for future operations, statements of future economic performance, estimates, and statements of assumptions relating thereto, including, but not limited to statements regarding: market opportunity; forecasts; market growth and growth strategy; demand; dependence on third parties such as advertisers, publishers and third-party data providers; our technology investment decisions; industry conditions; changes in technology and regulation and the impact thereof; plans with respect to our intellectual property rights; our competition; global and local economic and geopolitical forces; our ability to foster productive relationships with foreign governments; seasonality; dependence on our sales and support team; our positioning and strategy; digital advertising trends overall; our solutions and platform; customers; our dividend policy and our buyback program; working capital and the sufficiency thereof; financial metrics such as revenue, costs and expenses, including capital expenditures; legal proceedings and tax. Forward-looking statements may appear throughout this report, including without limitation, in Item 3. “Key Information – 3.D. Risk Factors,” Item 4. “Information on the Company,” Item 5. “Operating and Financial Review and Prospects.” In some cases, these forward-looking statements can be identified by words or phrases such as “may,” “might,” “will,” “could,” “would,” “should,” “expect,” “plan,” “anticipate,” “intend,” “seek,” “believe,” “estimate,” “predict,” “potential,” “continue,” “contemplate,” “possible” or the negative of these terms or similar expressions. We have based these forward-looking statements largely on our current expectations and projections about future events and financial trends that we believe may affect our business, financial condition and results of operations.

Forward-looking statements involve a number of risks, uncertainties and assumptions, and actual results or events may differ materially from those projected or implied in those statements. Important factors that could cause such differences include, but are not limited to:

These and other risk factors are discussed in more detail in this Annual Report, including under Item 3. “Key Information – 3.D. Risk Factors.” The forward-looking statements in this Annual Report are only predictions. These statements are inherently uncertain, subject to risks and uncertainties, some of which cannot be predicted or quantified, and investors are cautioned not to unduly rely upon these statements. The events and circumstances reflected in our forward-looking statements may not be achieved or occur and actual results could differ materially from those projected in the forward-looking statements.

In addition, statements that “we believe” and similar statements reflect our beliefs and opinions on the relevant subject. These statements are based upon information available to us as of the date of this Annual Report, and while we believe such information forms a reasonable basis for such statements, such information may be limited or incomplete, and our statements should not be read to indicate that we have conducted an exhaustive inquiry into, or review of, all potentially available relevant information.

You should read this Annual Report and the documents that we reference in this Annual Report and have been filed as exhibits to this Annual Report with the understanding that our actual future results, levels of activity, performance and achievements may be materially different from what we expect. We qualify all of our forward-looking statements by these cautionary statements.

The estimates and forward-looking statements contained in this Annual Report speak only as of the date of this Annual Report. Except as required by applicable law, we undertake no obligation to publicly update or revise any estimates or forward-looking statements whether as a result of new information, future events or otherwise, or to reflect the occurrence of unanticipated events.

PART I

ITEM 1: IDENTITY OF DIRECTORS, SENIOR MANAGEMENT AND ADVISERS

Not applicable.

ITEM 2: OFFER STATISTICS AND EXPECTED TIMETABLE

Not applicable.

ITEM 3: KEY INFORMATION

3.A. [RESERVED]

3.B. CAPITALIZATION AND INDEBTEDNESS

Not applicable.

3.C. REASONS FOR THE OFFER AND USE OF PROCEEDS

Not applicable.

3.D. RISK FACTORS

An investment in our securities involves risks. You should carefully consider the risks described below, together with all of the other information included in this Annual Report, in evaluating us and our securities, before making an investment decision. Our business, prospects, financial condition, or operating results could be harmed by any of these risks, as well as other risks not known to us or that we consider immaterial as of the date of this Annual Report. The trading price of our securities could decline due to any of these risks, and, you may lose all or part of your investment. This Annual Report also contains forward-looking statements that involve risks and uncertainties. Our actual results could differ materially from those anticipated in these forward-looking statements as a result of certain factors, including the risks faced by us described below and elsewhere in this Annual Report.

Additional risks not presently known to us or that we currently deem immaterial may also impair our business operations.

Risks Related to Gorilla’s Business and Industry

We earn a substantial portion of our revenues from a limited number of clients.

Gorilla derives and expects to continue to derive a significant portion of its revenues from a select group of key clients, including government entities such as the Government of the Arab Republic of Egypt (“GoE”), the Criminal Investigation Bureau of Taiwan, Taoyuan Airport and private companies such as Freyr Technology AI Pte. Ltd. (“Freyr”).

Reliance on a concentrated client base poses risks of fluctuations in demand, which may have a material adverse effect on our business, results of operations, financial condition and cash flows. Moreover, the loss of a major client could also impact our reputation in the market, making it more difficult to attract and retain clients more generally.

Certain large customer engagements may require us to commit significant resources and infrastructure in advance of, or without assurance of, corresponding revenue. The loss of, or a significant reduction in, business from one or more of our key clients could result in excess capacity, reduced utilization of resources, lower margins and could have a material adverse effect on our business, results of operations and financial condition.

Global macroeconomic and geopolitical conditions affect us, our clients, our partners and the markets they serve. Volatile, negative and uncertain economic and geopolitical conditions could in the future undermine business confidence in the markets in which we operate, which are increasingly interdependent. This may cause our clients to reduce or defer their spending on new initiatives and technologies, and negatively affect our business.

Gorilla seeks to diversify its client portfolio by expanding into new markets to enhance revenue stability but may not succeed in doing so.

If Gorilla is unable to enhance its services, integrate new technologies in its offerings, and invest effectively in research and development, its growth, business, results of operations and financial condition could be adversely affected.

Gorilla’s ability to maintain and grow demand for its services and solutions requires that it continues to develop and implement offerings that keep pace with changes in the industry, anticipate rapid technological changes, and respond to its clients’ needs in areas such as intelligent video surveillance, facial recognition, license plate recognition, edge computing, post-event analytics and advanced cybersecurity technologies. As part of these efforts, Gorilla has invested and expects to continue investing substantially in research and development to develop new technologies, enhance existing services and commercialize new services.

The success of any enhancements or new services depends on several factors, including timely completion, adequate quality testing, actual performance quality, market accepted pricing levels and overall market acceptance. Enhancements, such as additional technology features, and new services, such as software licenses and data services, that Gorilla develops may not be introduced in a timely or cost-effective manner, may contain errors or defects, may have interoperability difficulties with its platform or other services or may not achieve the broad market acceptance necessary to generate significant revenue.

If Gorilla is unable to successfully enhance its existing services to meet evolving consumer requirements, develop new technologies and services or if there are delays in the availability or adoption of its new technologies and services, then Gorilla may not be able to grow its business as quickly as anticipated, if at all.

In addition, Gorilla’s ability to increase usage of its services depends, in part, on the development of new uses for its services, which may be outside its control, and may require increasingly sophisticated and more costly sales efforts and result in a longer sales cycle. Although Gorilla anticipates continued growth in video intelligence, Internet of Things (“IoT”) technologies and cybersecurity markets, such growth may occur more slowly or not at all, and Gorilla may not benefit from its investments.

Any of the foregoing could adversely affect our business, results of operations and financial condition.

We may experience fluctuations in our results of operations, cash flows and position due to various factors, including seasonality and the timing of material capital spending in long-term contracts.

Historically, the first quarter of Gorilla’s fiscal year generally has relatively lower sales, and sales generally increase in each subsequent quarter with substantial increases during the fourth quarter. Gorilla believes that this seasonality results from a number of factors, including:

This seasonality has historically caused and may continue to cause variability in the timing of recognition of revenue and its collections.

Given the historical seasonal pattern of sales, Gorilla believes that its customers’ required timing for certain new government or commercial programs requiring new services may not follow seasonal purchasing and evaluation decisions by its customers, which may outweigh the nature or magnitude of seasonality that has prevailed in our business to date. Additionally, increased government spending on technology aimed at surveillance or cybersecurity and new sizable business wins may drive customer demand at different times throughout Gorilla’s fiscal year, the timing of which Gorilla may not be able to anticipate, however it may dilute the seasonality in its results of operations and cash flows, for instance, the material size of multi-year project in Egypt started in 2023 outweighed the seasonality trends.

However, in the short-term, we expect that seasonality will continue to materially impact Gorilla’s business if our expectations on prospective customer contracts with uniform revenues are not realized. The seasonality of Gorilla’s business may cause continued or increased fluctuations in its results of operations and cash flows.

In addition, certain elements of Gorilla’s cost structure do not fluctuate proportionately with revenue, such as employee compensation expenses, research and development costs, sales and marketing expenses, and other administrative costs, which are relatively fixed in the short term and may not decline during periods of lower revenue. Such costs, together with fluctuations in the mix of services and products sold in a given period, including shifts between higher-margin and lower-margin offerings, and potential delays in customers’ purchasing cycles or deferments of purchases, may adversely impact Gorilla’s operating margins and cash flows during historically weaker quarters and cause fluctuations in its quarterly results.

Gorilla may need to raise additional funds in the future in order to execute its business plan, and these funds may not be available to Gorilla when it needs them or on favorable terms. If Gorilla cannot raise additional funds when it needs them, its business, financial condition and results of operations could be adversely affected.

Gorilla may require additional capital in the future in order to fund its growth strategy or to respond to technological advancements, competitive dynamics or technologies, data consumer demands, business opportunities, challenges, acquisitions or unforeseen circumstances. While Gorilla plans to fund growth opportunities with cash from operations or from future financings, there can be no assurance that sufficient amounts will be available when needed.

Our growth initiatives and certain customer deployments may require significant capital expenditures, including investments in infrastructure, technology and long-term operational commitments. These investments may not generate expected returns, particularly if customer demand or usage does not materialize as anticipated and could increase our reliance on external financing.

Gorilla may not be able to timely secure debt or equity financing on favorable terms, or at all. Gorilla’s decision to issue debt or equity in the future may depend on market conditions and factors beyond its control. Accordingly, Gorilla cannot predict or estimate the amount, timing, nature or success of its future capital raising efforts. If Gorilla raises additional funds through the issuance of equity or convertible debt or other equity-linked securities, its existing shareholders could experience significant dilution. In addition, any debt financing obtained by Gorilla in the future, whether in the form of a credit facility or otherwise, could involve restrictive covenants relating to its capital raising activities and other financial and operational matters, which may make it more difficult for Gorilla to obtain additional capital. If Gorilla is unable to obtain adequate financing or financing on terms satisfactory to Gorilla when required, Gorilla’s ability to continue to grow or support its business and to respond to business challenges could be significantly limited.

Gorilla relies, in part, on partnerships with industry-leading technology companies to grow its business. The partnerships may not produce the financial or operating results that Gorilla anticipates. In addition, if Gorilla is unable to enter into partnerships, or successfully maintain them, its growth may be adversely impacted.

Gorilla believes that its continued growth depends, in part, on developing and expanding strategic relationships and working as partners with technology companies, including cloud infrastructure providers, telecoms, chipset vendors, artificial intelligence companies, data centers and storage manufacturers. Such partnerships enable increasing Gorilla’s customer base without the need to address the customers directly. We believe it is important that our Edge AI integrate seamlessly with a potential client’s existing IT infrastructure, which often utilizes hardware manufactured or software developed by other technology companies.

Partnerships that Gorilla enters into may not lead to expected benefits and intended growth as planned. Gorilla may also have difficulty assimilating new partnerships and their services, technologies, IT systems and personnel into its operations. IT and data security profiles of partners may not meet its technological standards and may take longer to integrate and remediate than expected, resulting in higher costs or causing Gorilla to forego certain partnerships altogether. If Gorilla fails to develop or expand strategic relationships and partnerships with other technology, AI and data center companies, or if it is unable to effectively integrate and manage new partnerships, it may be unable to grow its business or meet customer needs, which could disrupt its operations, increase expenses and adversely affect its business, results of operations and financial condition.

We may not succeed in managing or expanding our business across the expansive and diverse markets in which we operate and / or intend to operate.

Our business has become increasingly complex given the scale of our operations, product offerings, technological advancements and the diverse markets in which we operate and / or intend to operate. It is costly to establish, develop and maintain international operations, adapt our business model to new and / or diverse regulatory environments and to promote our brand internationally. Consequently, such operations may not become or remain profitable on a sustainable basis. As our operations expand, our technology infrastructure systems and corporate, legal and compliance functions will need to be scaled to support our operations, and if they fail to do so, our business, financial condition and results of operations may be negatively affected.

As our business has grown, we have experienced increases in data usage and customer demands on our platform and infrastructure. This has placed and may continue to place additional demands on Gorilla’s operational infrastructure and management. Managing our growth also requires us to preserve key aspects of our corporate culture and maintain our ability to attract and retain qualified personnel, and failure to do so could adversely affect our ability to execute our business strategy.

In managing large-scale projects, Gorilla prioritizes meeting performance obligations, securing necessary financing, and ensuring timely delivery of goods and services that meet or exceed required standards. Effective management of these commitments supports continued client confidence and reinforces Gorilla’s position as a reliable partner.

Gorilla’s involvement in government contracts, such as the Firm-Fixed Price Contract for building a secure governmental air-gapped network (the “Egypt Contract”) with the GoE, requires adherence to strict regulatory and compliance standards. If Gorilla fails to maintain robust governance frameworks to ensure compliance with procurement integrity, labor laws, supply chain security, and other public sector requirements, such failure could have a material adverse effect on our results of operations and financial condition. External factors such as political shifts, policy changes, or payment delays can introduce operational challenges.

Gorilla continues to strengthen its compliance programs, including those related to data protection, privacy, cybersecurity and anti-corruption, and may not be able to implement improvements in an efficient or timely manner and may discover deficiencies in existing controls, programs, systems and procedures, any of which could have an adverse effect on its business, reputation, results of operations or financial condition.

The markets where we operate or expand to are diverse and unique, with varying levels of economic and infrastructure development and distinct legal and regulatory systems, and do not operate seamlessly across borders as a single or common market. From time to time, we may evaluate prospective businesses in new markets where we believe there may be an opportunity to use our experience in highly diverse environments to reach underserved buyers and sellers. We may also exit from certain markets or cease certain operations in certain markets due to a variety of factors.

Our operations and expansions in new markets may become subject to risks associated with:

Any of the foregoing could adversely affect our business, financial condition and results of operations.

The security convergence and Video IoT businesses may be relatively new in certain markets, the relevant regulations might be evolving. We may be regularly subject to formal and informal reviews, inquiries and investigations by governments and regulatory authorities. Unfavorable regulations, laws, decisions or enforcement actions could cause us to incur substantial costs, expose us to unanticipated civil and criminal liability or penalties, diminish the demand for, or availability of, our products and services, increase our cost of doing business, require us to change our business practices in a manner materially adverse to our business, damage our reputation, impede our growth or monetization strategy, or otherwise have a material adverse effect on our operations.

Existing or future investments or acquisitions may not be successful.

We have in the past and may in the future invest in and / or acquire businesses, services, rights in intangible assets, capabilities or technologies from time to time. We may fail to identify appropriate investments and / or acquisition targets, or we may not be able to negotiate optimal arrangements, including arrangements to finance such investments or acquisitions. Investments and acquisitions entail uncertainties and risks, such as:

There may be failure or delay in obtaining any required approvals and licenses from relevant government authorities. We may become subject to new governmental regulations in connection with our investments and acquisitions, which could result in increased costs and new strategic risks. Any of these risks may materially and adversely affect our business, financial condition and results of operations.

Gorilla’s business depends on expanding its client base and on clients increasing their use of its services, and its inability to expand its client base, a loss of its significant clients, a decline in use of its services or an inability to maintain client relationships due to inadequate customer support, could adversely affect its business, results of operations and financial condition.

Gorilla’s ability to grow and generate revenue depends, in part, on its ability to expand its client base, maintain and grow relationships with existing clients leading to an increase in the use of its services. Failing which Gorilla’s revenue growth may decline, and its financial condition and results of operations may be adversely affected. Many of Gorilla’s clients do not have long-term contractual commitments and may reduce or cease the use of its services at any time without penalty or termination charges. Any inability to attract new clients, retain existing clients or reductions in their usage levels may adversely impact Gorilla’s business, financial condition and results of operations. Gorilla cannot accurately predict its clients’ usage patterns, and if a significant number of clients reduce or cease their usage of our services, then Gorilla may be required to increase its sales and marketing expenditure to maintain or grow its revenue, which could adversely affect its business, results of operations and financial condition.

In certain cases, Gorilla may commit to infrastructure, compute capacity or other resources in advance to support anticipated customer demand. If actual usage levels are lower than expected, or if demand declines, Gorilla may experience underutilization of such resources, which could adversely affect its margins and results of operations.

Gorilla’s ability to retain clients and expand their usage of its services also depends on providing high quality customer support to assist them with implementing its services effectively, resolving post-implementation issues quickly and providing ongoing technological support. If Gorilla does not devote sufficient resources to customer support or is otherwise unsuccessful in assisting clients effectively, its ability to retain existing clients, maintain its reputation or win new clients may be adversely affected. Gorilla may also be unable to respond quickly to increases in support demand or adapt its support model to remain competitive, which could increase costs without corresponding revenue.

Our expansion into the production of AI ready data centers in conjunction with our existing partners is relatively new, and could lead to an adverse effect in our business if the market fails to maintain its current momentum or if we are unable to provide our services on commercially competitive terms, including are prospects with prospective partners.

Gorilla has been entering into partnerships to develop a network of AI-powered data centers across Southeast Asia. Operating AI-ready data centers requires vast amounts of electricity and water for power and cooling. As demand for AI computing accelerates, our facilities may experience growing strain on available energy infrastructure. We rely and expect to rely on third parties (including utilities, landlords and infrastructure providers) for the provision and continuity of power. We therefore have limited control over power availability, outage remediation, infrastructure upgrades or the timing and cost of obtaining additional capacity. While we employ, and expect to continue to enhance, backup and redundancy measures in connection with our infrastructure and data center plans, these safeguards may not prevent service interruptions, particularly during large-scale or prolonged outages. In addition, any increase in electricity or water costs, supply shortages, planned or unplanned power outages, or governmental restrictions on energy use or emissions could materially increase our operating expenses or limit our ability to expand. If we are unable to secure sustainable or affordable energy sources, our margins, competitiveness, and ability to scale may be adversely affected.

Our ability to operate and expand AI data centers depends on timely access to advanced computing hardware, including GPUs and other accelerators. Supply chain constraints, limited vendor availability, or export controls could restrict access to these critical components. Furthermore, the pace of innovation in AI hardware is rapid, and infrastructure investments we make today may become obsolete more quickly than expected. If we cannot procure next-generation hardware on favorable terms, or if competitors deploy superior technologies, our services may become less competitive, and our growth prospects could be materially affected.

The construction and operation of AI-optimized data centers require substantial upfront capital investments. Our ability to generate returns from these investments depends on sustained demand for AI computing services. If demand for AI workloads slows, or if key customers reduce their reliance on our services, seek alternative providers, or renegotiate contracts on unfavorable terms, our revenue and margins could be adversely affected. In addition, competition for AI data center services is intense, and new entrants or existing hyperscale providers with greater resources may erode our market position. As a result, there is no assurance that our significant anticipated capital expenditures will yield the expected benefits, and we may not achieve the anticipated financial returns.

The market for Gorilla’s Smart City AI & Cybersecurity services and products is relatively new, and may decline or experience limited growth, and its business is dependent on its clients’ continuing adoption and use its services and products.

The market for smart city services and products is emerging and may face decline or limited growth, with our business hinging on our clients’ ongoing adoption and utilization of these offerings. We have developed a video management system, IVAR® (Intelligent Video Analytics Recorder), which supports smart city functionalities. Through IVAR®, we provide our smart city services to a diverse client base that includes managed service providers, distributors, system integrators, and hardware manufacturers across various sectors such as healthcare, transportation, manufacturing, and retail. Our future success is closely linked to the expansion of the smart city market and the adoption of our services and products, including the real-time analytics capabilities of IVAR®.

The utilization of smart city technologies is still in its infancy, and there may be a lack of consumer awareness regarding the advantages of our offerings. If potential users do not recognize the benefits, they might turn to alternative solutions to meet their business needs. The competitive edge of our platforms also partly relies on compatibility with third-party products. To scale our business and strengthen our market position, we are building awareness for our potential customers on the utility of our offerings, broaden our service range, and introduce new technologies to enhance market acceptance and utilization of our platform. The expansion of our market reach depends on various factors such as cost, performance, and perceived value of our offerings. Public sector engagements occasionally attract scrutiny or public commentary, including from activists or media sources. While we seek to uphold a commitment to ethical business practices and responsible innovation, ensuring that our operations align with regulatory and societal expectations, the public may have a negative view on our products specifically or the smart city market generally. If the smart city market does not grow substantially or if there is a fall in demand for our services or products due to lack of acceptability, technological hurdles, competing solutions, reduced budgets by current and prospective clients, economic downturns, or other factors, our business, financial condition, and operational results could be adversely affected.

Gorilla’s competitive position depends, in part, on our ability to adapt to rapid technological changes and evolving industry standards, and on our platforms operating effectively along with third-party products and services. Because our platforms are complex and may require lengthy implementation process, any failure to maintain such compatibility or to satisfy our customers’ requirements or perform as desired could harm our business, results of operations, and financial condition.

The markets in which we operate, including video intelligence, IoT technologies and cybersecurity, are subject to rapid technological change, evolving industry standards and shifting customer needs, requiring us to continually update and enhance our platforms and services to remain competitive. The success of Gorilla’s business will depend, in part, on its ability to adapt and respond effectively to these changes on a timely basis.

Our platforms depend, in part, on their ability to operate with products and services of third parties, software services and infrastructure, including but not limited to, in connection with our sales relationships, platform partnerships, strategic alliances, and other similar arrangements, where applicable. We must continuously modify and enhance our platforms to adapt to changes in, or to be integrated or otherwise compatible with, evolving hardware, software, networking, mobile applications, browser and database technologies. If new technologies emerge or industry standards shift in ways that require more significant updates than we can deliver on a timely basis, or we are unable to develop enhancements that keep pace with rapid industry changes or offer services at competitive prices with improved efficiency, convenience or security, then our services may become less competitive or obsolete. Third parties may elect not to support their hardware, software or infrastructure in a manner compatible with our platforms and may develop competing technologies without maintaining interoperability with us. If we are not successful in maintaining and expanding such compatibility, our business, financial condition and results of operations could be adversely impacted.

Our platforms and services are complex due to the nature of the needs of our customers, and rapid technological changes in the industry where we operate. Implementing our platforms can be a complex and lengthy process since we often configure our existing platforms for a customer’s unique environment. An inability to meet the unique needs of our customers may result in customer dissatisfaction and/or damage to our reputation, which could materially harm our business. Further, the proper use of our platforms often requires trainings for our customers and the initial or ongoing services of our technical personnel as well as operations and maintenance services over the contract term. If training and/or ongoing services require more of our expenditures than we originally estimated, our margins will be lower than projected.

In addition, if our customers do not use our platforms as prescribed or as intended, then it may lead to subpar performance or outcomes. It is possible that our platforms may also be intentionally misused or abused by customers or their employees or third parties who obtain access and use of our platforms. Similarly, our platforms may sometimes be used by customers with smaller or less sophisticated IT departments and / or customer personnel who are not well trained in the use of our platforms. This may result in sub-optimal performance at a level lower than anticipated by the customer, customers deferring the deployment of our platforms and services, deployment in a more limited manner than originally anticipated, or customers not deploying it at all. Additionally, our platforms may go unused or be adopted less broadly, and our ability to make additional sales may be substantially limited, which could adversely impact our business, results of operations and growth prospects. Our customers rely on our platforms and services to address important business goals and challenges. Accordingly any improper use or configuration of our platforms and maintenance services, failure to properly train customers on how to efficiently and effectively use our platforms, or failure to properly provide implementation, analytical or maintenance services to our customers may result in contract terminations or non-renewals, reduced revenues, negative publicity and / or legal claims against us. Additionally, as we continue to expand our customer base, any failure by us to properly provide these services may result in lost opportunities for follow-on expansion sales of our platforms and services.

We face intense competition in our markets, and we may lack sufficient financial or other resources to maintain or improve our competitive position.

The markets for our platforms are very competitive, and we expect such competition to continue or increase in the future. A significant number of companies are developing products that currently, or in the future may, compete with some or all aspects of our proprietary platforms. We may not be successful in convincing the management teams of our potential customers to deploy our platforms in lieu of existing software solutions or in-house software development projects often favored by internal IT departments or other competitive products and services. In addition, our competitors include large enterprise software companies, government contractors and system integrators, and we may face competition from emerging companies as well as established companies who have not previously entered this market. Additionally, we may be required to make substantial additional investments in our research, development, services, marketing and sales functions in order to respond to competition, and there can be no assurance that we will be able to compete successfully in the future.

Many of our existing competitors have, and some of our potential competitors could have, substantial competitive advantages such as:

In addition, some of our larger competitors have substantially broader and more diverse product and service offerings and may be able to leverage their relationships with distribution partners and customers based on other products to gain business in a manner that discourages customers from purchasing our platforms. They may do so by selling at zero or negative margins, product bundling or offering closed technology platforms. Potential customers may also prefer to purchase from their existing provider rather than a new provider regardless of platform performance or features. As a result, even if the features of our platforms offer advantages that others do not, customers may not purchase our platforms. These larger competitors often have broader product lines and market focus or greater resources and may therefore not be as susceptible to economic downturns or other significant reductions in capital spending by customers. If we are unable to sufficiently differentiate our platforms from the integrated or bundled products of our competitors, such as by offering enhanced functionality, performance, or value, we may see a decrease in demand for those platforms, which could adversely affect our business, financial condition, and results of operations.

In addition, new, innovative start-up companies and larger companies that are making significant investments in research and development may introduce products that have greater performance or functionality, are easier to implement or use, incorporate technological advances that we have not yet developed, or implemented or may invent similar or superior platforms and technologies that compete with our platforms. Our current and potential competitors may also establish cooperative relationships among themselves or with third parties that may further enhance their resources.

Some of our competitors have made or could make acquisitions of businesses that allow them to offer more competitive and comprehensive solutions. As a result of such acquisitions, our current or potential competitors may be able to accelerate the adoption of new technologies that better address customer needs, devote greater resources to bring these products and services to market, initiate or withstand substantial price competition, or develop and expand their product and service offerings more quickly than we do. These competitive pressures in our market, or our failure to compete effectively, may result in fewer orders, reduced revenue and margins, and loss of market share. In addition, it is possible that industry consolidation may impact customers’ perceptions of the viability of smaller or even mid-size software firms and consequently customers’ willingness to purchase from such firms.

We may not compete successfully against our current or potential competitors. If we are unable to compete successfully, or if competing successfully requires us to take costly actions in response to the actions of our competitors, our business, financial condition and results of operations could be adversely affected. In addition, companies competing with us may have an entirely different pricing or distribution model. Increased competition could result in fewer customer orders, price reductions, reduced margins, and loss of market share, any of which could harm our business and the results of operations.

We do not work with the Chinese Communist Party and have chosen not to host our platforms in China, which may limit our growth prospects.

We generally do not enter into business with customers or governments whose positions or actions we consider inconsistent with our mission and values to support Western liberal democracy and its strategic allies. Our leadership believes that working with the Chinese Communist Party is inconsistent with our culture and mission. Accordingly, we do not pursue any sales opportunities with the Chinese Communist Party, do not host our platforms in China, and impose limitations on access to our platforms in China in order to protect our intellectual property, to promote respect for and defend privacy and civil liberties protections and to promote data security. Our decision to avoid this large potential market, and more broadly to not enter into relationships with customers or governments, which can otherwise lead to divergence from our culture and mission, may limit our growth prospects and could adversely impact our business, results of operations, and financial condition, and we may not compete successfully against our current or potential competitors who choose to operate in China or engage with such customers or governments.

We may fail to attract and retain sufficiently trained highly skilled employees, including members of our senior management team and professionals with sufficient leadership capabilities, to support our operations, which could harm our business and impair our ability to successfully implement our business strategy.

To execute our growth plan, Gorilla must attract, hire, motivate, develop, and retain a sufficient number of highly skilled personnel, across various functions, including engineering, finance, marketing, sales, and technology and support. Competition is intense, especially for engineers skilled in software design and development, as well as experienced sales professionals. Gorilla has experienced, and may continue to experience, difficulty in hiring and retaining employees with the necessary qualifications. Many of our competitors have greater resources and may attempt to recruit our skilled employees. In addition, certain domestic immigration laws, including those in Taiwan, the United Kingdom, Egypt or the United States, restrict or limit our ability to recruit internationally. Additionally, job candidates and existing employees often consider the value of the equity awards they receive in connection with their employment, and a decline in the perceived value of Gorilla’s equity awards may harm our recruitment and retention efforts.

If we are unable to invest in reskilling and upskilling our employees in the areas and skills that strategically important to our business, our ability to effectively lead our current projects and develop new business could be jeopardized, and our business, results of operations and financial condition could be adversely affected.

Our future success also depends substantially on the continued services of our senior management team and other key employees in leadership positions who possess technical and business capabilities, including industry expertise, and are difficult to replace. The loss of any one or more members of our senior management team, for any reason, including resignation or retirement, could impair our ability to execute our business strategy and harm our business, financial condition and results of operations.

Our financial condition could be negatively affected if governments in the countries we operate in introduce new unfavorable tax legislation.

We are subject to taxes in the countries we operate in. Our future tax liabilities could be adversely affected by any new unfavorable tax legislative changes in the countries we operate in. We continuously monitor such changes to assess and quantify the potential impacts on our consolidated financial statements.

Also, failure to comply with transfer pricing regulations in the countries we operate in could result in additional tax, interest and penalties levied on us by tax authorities, thereby impacting our profitability and cash flows.

We may not be fully insured for all losses we may incur.

We maintain cybersecurity insurance and other types of insurance, subject to applicable deductibles and policy limits, but our insurance may not be sufficient to cover all costs associated with a potential data security or other incident. We also cannot be sure that our existing general liability insurance coverage and coverage for cyber liability or errors or omissions will continue to be available on acceptable terms or will be available in sufficient amounts to cover one or more large claims or that the insurer will not deny coverage as to any future claim. The successful assertion of one or more large claims against us that exceed available insurance coverage, or the occurrence of changes in our insurance policies, including premium increases or the imposition of large deductible or co-insurance requirements, could harm our financial condition.

Risks Related to Gorilla’s Intellectual Property, Information Technology, Data Privacy and Security

Gorilla may not be able to adequately protect or enforce its intellectual property rights or prevent unauthorized parties from copying or reverse engineering its solutions. Gorilla’s efforts to protect and enforce its intellectual property rights, prevent third parties from violating its rights, and address infringement claims may be costly.

The success of Gorilla’s services and its business depends, in part, on its ability to obtain patents and other intellectual property rights and maintain adequate legal protection for its products in the United States, Taiwan, Egypt, and other international jurisdictions. Gorilla has filed for patents in the United States and in certain international jurisdictions, but such protections may not be available or applied for in all countries where it operates or seeks to enforce its intellectual property rights. Additionally, enforcement of these rights may be difficult in practice, particularly in jurisdictions with weak enforcement mechanisms or high rates of counterfeiting. Gorilla relies on a combination of patent, copyright, service mark, and trade secret laws, as well as confidentiality procedures and contractual obligations, to establish and protect its proprietary rights. These measures, while important, only provide limited protection, and the risk of breaches, misappropriation, reverse engineering, or infringement remains significant, especially in the context of the evolving cyber threat landscape, where Gorilla’s technologies may be vulnerable to cyberattacks and unauthorized access.

Gorilla’s intellectual property consists of proprietary methods and technologies developed under a combination of patents, pending patent applications, methodologies, know-how, trade secrets, copyrights, trademarks, and other intellectual property rights. Gorilla seeks to protect these assets through confidentiality agreements that contain non-disclosure and non-use provisions with its employees, consultants, contractors, and third parties, along with robust security measures and employee policies. Many business processes and implementation methodologies are considered trade secrets or proprietary know-how. Clients and business partners typically agree in writing to the confidential treatment of Gorilla’s information. Additionally, employees and independent contractors are required to sign work-for-hire and confidentiality covenants as conditions of employment or engagement. Gorilla also has policies requiring employees, consultants, contractors, and third parties to respect the intellectual property rights of others, including obtaining appropriate licenses when using, selling, or distributing third-party materials.

Gorilla’s reliance on third-party vendors, manufacturing partners, and suppliers introduces additional vulnerabilities, as these external parties may mishandle or misuse its trade secrets. Furthermore, Gorilla may not succeed in obtaining or maintaining patents, trademarks, or other protections for which it has applied or may apply in the future. Failure to protect intellectual property effectively may allow competitors to duplicate Gorilla’s technology and products, adversely impacting its competitive position. Additionally, unauthorized use or misappropriation of intellectual property by others, including former employees, may occur, and Gorilla may not always detect or successfully address these violations. Competitors may also independently develop similar technologies or leverage their own IP portfolios to challenge Gorilla’s operations. The risk of reverse engineering, where competitors gain unauthorized access to and replicate Gorilla’s technology, further complicates this issue.

Gorilla also faces significant risks related to intellectual property litigation, which is common in the technology industry. Competitors, former employees, or other entities may allege that Gorilla’s systems, processes, marketing, data usage, or technologies infringe on their intellectual property rights. Non-practicing entities may bring baseless but costly infringement claims. Gorilla could be required to indemnify clients for intellectual property infringement claims related to materials provided in its services and solutions, which could involve substantial expenses, including damages, attorneys’ fees, and indemnification obligations. Even if such claims are without merit, they may lead to reputational damage and harm customer relationships, deter future sales, and materially impact Gorilla’s business operations, financial condition, and cash flows.

The evolving and competitive technological environment adds complexity to these risks. Intellectual property-related disputes or claims, even if unfounded, could force Gorilla to alter business practices, incur significant license, royalty, or technology development expenses, or pay substantial damages or legal fees. These risks are compounded by the uncertainties of global IP systems and differing enforcement mechanisms

If any of the systems of any third parties upon which we rely, our customers’ cloud or on-premises environments, or our internal systems, are breached or if unauthorized access to customer or third-party data is otherwise obtained, public perception of our platforms and operations and maintenance services may be harmed, and we may lose business and incur losses or liabilities.

Our success depends, in part, on our ability to provide effective data security protection in connection with our platforms and services, and we rely on information technology networks and systems to securely store, transmit, index, and otherwise process electronic information. Because our platforms and services are used by our customers to store, transmit, index or otherwise process and analyze large data sets that often contain proprietary, confidential and/or sensitive information (including in some instances personal or identifying information), our software is perceived as an attractive target for attacks by computer hackers or others seeking unauthorized access, and our software faces threats of unintended exposure, exfiltration, alteration, deletion or loss of data. Additionally, because many of our customers use our platforms to store, transmit, and otherwise process proprietary, confidential, or sensitive information, and complete mission critical tasks, they have a lower risk tolerance for security vulnerabilities in our platforms and services than for vulnerabilities in other, less critical, software products and services.

We, and the third-party vendors upon which we rely, have experienced, and may in the future experience, cybersecurity threats, including threats or attempts to disrupt our information technology infrastructure and unauthorized attempts to gain access to sensitive or confidential information. Our and our third-party vendors’ technology systems may be damaged or compromised by malicious events, such as cyberattacks (including computer viruses, malicious and destructive code, phishing attacks and denial of service attacks), physical or electronic security breaches, natural disasters, fire, power loss, telecommunications failures, personnel misconduct and human error. Such attacks or security breaches may be perpetrated by internal bad actors, such as employees or contractors, or by third parties (including traditional computer hackers, persons involved with organized crime or foreign state or foreign state-supported actors). Cybersecurity threats can employ a wide variety of techniques, which may include the use of social engineering techniques, are constantly evolving, and have become increasingly complex and sophisticated; all of which increase the difficulty of detecting and successfully defending against them. Furthermore, because the techniques used to obtain unauthorized access or sabotage systems change frequently and generally are not identified until after they are launched against a target, we and our third-party vendors may be unable to anticipate these techniques or implement adequate preventative measures. Although prior cyberattacks directed at us have not had a material impact on our financial results, and we are continuing to bolster our threat detection and mitigation processes and procedures, we cannot guarantee that future cyberattacks, if successful, will not have a material impact on our business or financial results. While we have security measures in place to protect our information and our customers’ information and to prevent data loss and other security breaches, we have not always been able to do so and there can be no assurance that in the future we will be able to anticipate or prevent security breaches or unauthorized access of our information technology systems or the information technology systems of the third-party vendors upon which we rely. Despite our implementation of network security measures and internal information security policies, data stored on personnel computer systems is also vulnerable to similar security breaches, unauthorized tampering or human error.

Many governments have enacted laws requiring companies to provide notice of data security incidents involving certain types of data, including personal data. In addition, most of our customers, including U.S. government customers, contractually require us to notify them of data security breaches. Compliance with such legal and contractual obligations may increase our costs and expose us to additional liability in the event of a breach.

Further, unauthorized access to our or our third-party vendors’ information technology systems or data or other security breaches could result in the loss of information; significant remediation costs; litigation, disputes, regulatory action or investigations that could result in damages, material fines and penalties; indemnity obligations; interruptions in the operation of our business, including our ability to provide new product features, new platforms or services to our customers; damage to our operation technology networks and information technology systems; and other liabilities. Moreover, our remediation efforts may not be successful. Any or all of these issues, or the perception that any of them have occurred, could negatively affect our ability to attract new customers, cause existing customers to terminate or not renew their agreements, hinder our ability to obtain and maintain required or desirable cybersecurity certifications, and result in reputational damage, any of which could materially adversely affect our results of operations, financial condition, and future prospects. There can be no assurance that any limitations of liability provisions in our license arrangements with customers or in our agreements with vendors, partners, or others would be enforceable, applicable, or adequate or would otherwise protect us from any such liabilities or damages with respect to any particular claim.

Issues in the use of artificial intelligence (including machine learning) in our platforms, along with the evolving regulatory framework for these technologies, may result in reputational harm or liability, and adversely affect our business, and results of operations.

AI is enabled by or integrated into many of our platforms and is a significant and potentially growing element of our business. However, as with many developing technologies, AI presents risks and challenges that could affect its further development, adoption, and use, and therefore our business. AI algorithms may be flawed, datasets may be insufficient or contain biased, and inappropriate data practices by data scientists, engineers, and end-users of our systems could impair the acceptance of AI solutions. If AI-generated recommendations, forecasts, or analyzes are deficient or inaccurate, we could be subjected to competitive harm, potential legal liability or reputational harm. Additionally, the regulatory framework for AI and machine learning is evolving and remains uncertain. It is possible that new laws and regulations will be adopted globally, or existing laws and regulations may be interpreted in new ways, that would affect the operation of our platform and the way in which we use these technologies. Further, the cost to comply with such laws or regulations could be significant and may increase our operating expenses, which could adversely affect us. Ethical concerns, such as those related to human rights, privacy, employment, or other social issues, could also lead to brand or reputational harm for us.

We depend on computing infrastructure operated by Amazon Web Services (“AWS”), and other third parties to support some of our customers and any errors, disruption, performance problems, or failure in their or our operational infrastructure could adversely affect our business, financial condition, and results of operations.

We rely on the technology, infrastructure, and software applications, including software-as-a-service offerings, of certain third parties, such as AWS, in order to host or operate some or all of certain key platform features or functions of our business, including our cloud-based services (including IVAR®), customer relationship management activities, billing and order management, and financial accounting services. Additionally, we rely on computer hardware purchased in order to deliver our platforms and services. We do not have control over the operations of the facilities of the third parties that we use. If any of these third-party services experience errors, disruptions, security issues or other performance deficiencies; if they are updated such that our platforms become incompatible; if these services, software or hardware fail or become unavailable due to extended outages, interruptions, defects, or otherwise; or if they are no longer available on commercially reasonable terms or prices (or at all), these issues could result in errors or defects in our platforms, cause our platforms to fail, our revenue and margins could decline, or our reputation and brand to be damaged, we could be exposed to legal or contractual liability, our expenses could increase, our ability to manage our operations could be interrupted and our processes for managing our sales and servicing our customers could be impaired until equivalent services or technology, if available, are identified, procured and implemented, all of which may take significant time and resources, increase our costs, and could adversely affect our business. Many of these third-party providers attempt to impose limitations on their liability for such errors, disruptions, defects, performance deficiencies, or failures, and if enforceable, we may have additional liability to our customers or third-party providers.

Our business depends, and will increasingly depend, on the availability of critical components used to support our AI, video intelligence and cybersecurity platforms. We do not manufacture these components and instead rely on third-party suppliers. Any disruption in the availability of these components, including due to supply chain constraints, manufacturing limitations, allocation decisions by suppliers, increased demand, geopolitical events or regulatory developments, could delay our ability to deploy, expand or maintain our platforms. If we are unable to obtain sufficient quantities of these components on a timely basis and on acceptable terms, our business, results of operations and financial condition could be adversely affected.

We have experienced, and may in the future experience, disruptions, failures, data loss, outages, and other performance problems with our infrastructure and cloud-based offerings due to a variety of factors, including infrastructure changes, introductions of new functionality, human or software errors, employee misconduct, capacity constraints, denial of service attacks, phishing attacks, computer viruses, malicious or destructive code, or other security-related incidents, and our disaster recovery planning may not be sufficient for all situations. If we experience disruptions, failures, data loss, outages, or other performance problems, our business, financial condition, and results of operations could be adversely affected. Because our platforms are complex, undetected errors, defects or bugs may occur, particularly in connection with new releases or updates. Such defects could delay product launches, require redesign efforts, result in warranty or service level credit obligations, damage our reputation, or adversely affect market acceptance of our platforms.

Our systems and the third-party systems upon which we and our customers rely are also vulnerable to damage or interruption from catastrophic occurrences such as earthquakes, floods, fires, power loss, telecommunication failures, cybersecurity threats, terrorist attacks, natural disasters, public health crises, geopolitical and similar events, or acts of misconduct. In addition, our ability to conduct normal business operations could be severely affected.

Furthermore, our platforms are in many cases important or essential to our customers’ operations, including in some cases, their cybersecurity or oversight and compliance programs, and subject to service level agreements (“SLAs”). Any interruption in our service, whether as a result of an internal or third-party issue, could damage our brand and reputation, cause our customers to terminate or not renew their contracts with us or decrease use of our platforms and services, require us to indemnify our customers against certain losses, result in our issuing credit or paying penalties or fines, subject us to other losses or liabilities, cause our platforms to be perceived as unreliable or unsecure, and prevent us from gaining new or additional business from current or future customers, any of which could harm our business, financial condition, and results of operations.

Moreover, to the extent that we do not effectively address capacity constraints, upgrade our systems as needed, and continually develop our technology and network architecture to accommodate actual and anticipated changes in technology, our business, financial condition, and results of operations could be adversely affected. The provisioning of additional cloud hosting capacity requires lead time. AWS and other third parties have no obligation to renew their agreements with us on commercially reasonable terms, or at all. If AWS or other third parties increase pricing terms, terminate or seek to terminate our contractual relationship, establish more favorable relationships with our competitors, or change or interpret their terms of service or policies in a manner that is unfavorable with respect to us, we may be required to transfer to other cloud providers or invest in a private cloud. If we are required to transfer to other cloud providers or invest in a private cloud, we could incur significant costs and experience possible service interruption in connection with doing so, or risk loss of customer contracts if they are unwilling to accept such a change.

Legal and Regulatory Risks Related to Gorilla’s Business

Gorilla’s operations are subject to a variety of United States and international laws and regulations, including those regarding privacy, data protection and information security, and its data consumers may be subject to regulations related to the handling and transfer of certain types of sensitive and confidential information. Non-compliance with these applicable laws and regulations could damage our reputation, lead to costly litigation, and harm our business.

Privacy is at the core of Gorilla’s technology. Gorilla and its data providers and data consumers may be subject to privacy and data protection-related laws and regulations that impose obligations in connection with the collection, processing, and use of personal data. We process and, in some cases, collect and/or store sensitive data in connection with our services. This data may include our clients’ information, such as names, addresses, payment details, and account history. In addition, we collect and store data regarding our employees. In the United States, several states have enacted or are considering enacting privacy regulations, including the California Consumer Privacy Act, as amended; and there are several privacy regulations in other jurisdictions, such as the General Data Protection Regulation in the European Union, the International Data Transfer Agreement in the United Kingdom, the Digital Personal Data Protection Act, 2023 in India, the Protection of Personal Data Law (Law No. 151 of 2020) in Egypt, and the Personal Data Protection Act, B.E. 2562 (2019) in Thailand. These privacy regulations impose privacy and data security compliance obligations and significant penalties for noncompliance. Other countries have enacted or are considering enacting data localization laws that require certain data to stay within their borders. We may also face audits or investigations by one or more domestic or foreign government agencies or our clients pursuant to our contractual obligations relating to our compliance with these regulations. Complying with changing regulatory requirements requires us to incur substantial costs, exposes us to potential regulatory action or litigation, and may require changes to our business practices in certain jurisdictions. As a result, we are subject to various data protection and privacy laws in the countries where we operate, and the failure to comply with such laws could result in significant fines and penalties. In addition, we may not be able to limit our liability to our clients with respect to breaches of our obligation to keep the information we receive from them confidential.

Government entities may seek our assistance with obtaining information about our customers or could request that we modify our platforms in a manner to permit access or monitoring. To the extent that we do not provide assistance to or comply with requests from government entities, or if we challenge those requests publicly or in court, we may experience adverse political, regulatory, legal, business, and reputational consequences, including among certain customers or portions of the public. Conversely, to the extent that we do provide such assistance, or do not challenge those requests publicly or in court, we may experience adverse political, business, and reputational consequences from other customers or portions of the public arising from concerns over privacy or the government’s activities.

Gorilla continues to invest significant time and resources, including ongoing reviews of its technology and systems, to ensure compliance with applicable data privacy laws. Despite these efforts, any network infrastructure remains vulnerable to evolving cyberattacks, employee errors, or intentional malfeasance. Customers and government entities are increasingly focused on the security of Gorilla’s products, and we have implemented robust policies, including background screening of personnel, non-disclosure agreements, access controls, encryption, and other security measures. However, these efforts cannot safeguard against all risks at all times. Outside parties may attempt to deceive employees, users, or clients into disclosing sensitive information, potentially gaining unauthorized access to Gorilla’s, its clients’, or users’ data. An actual or perceived breach of security, whether within Gorilla’s systems or a client’s system attributed to Gorilla, could expose us to a risk of loss of sensitive information, lawsuits from our employees, clients, or their customers for breaching contractual confidentiality provisions or privacy laws, investigations or penalties from regulators, reputational harm, and significant financial losses.

Gorilla is subject to complex, evolving regulatory requirements that may be difficult and expensive to comply with and that could negatively impact its business.

Gorilla’s business and operations are subject to a variety of complex and evolving regulatory requirements globally, including, among other things, with respect to labor, tax, import and export, anti-corruption, data privacy and protection and communications monitoring and interception. Compliance with these regulatory requirements may be onerous and expensive, especially where these requirements are inconsistent from jurisdiction to jurisdiction, or where the jurisdictional reach of certain requirements is not clearly defined or seeks to extend across national borders. Regulatory requirements in one jurisdiction may make it difficult or impossible to do business in another jurisdiction and may also influence market demand for many of Gorilla’s products and/or customer requirements for specific functionality and performance or technical standards. Gorilla may also be unsuccessful in obtaining permits, licenses or other authorizations required to operate its business, such as for the import or export of its products. While we have implemented policies and procedures designed to achieve compliance with the applicable laws and regulations, we cannot guarantee that we or our personnel will fully comply with them at all times. Noncompliance with applicable regulations or requirements, including those related to anticorruption, export controls, data privacy, employment, procurement, and cybersecurity, could subject us to investigations, administrative proceedings, sanctions, enforcement actions, fines, damages, litigation, civil and other penalties, as well as harm our reputation, financial condition, and operations.

Risks Related to Gorilla’s Incorporation in the Cayman Islands

Because we are incorporated under the laws of the Cayman Islands, you may face difficulties in protecting your interests, and compliance with economic substance legislation of Cayman Islands may adversely impact us. Additionally, if we re-domicile to another jurisdiction, its laws will govern our agreements, potentially limiting our ability to enforce legal rights.

We are an exempted company incorporated under the laws of the Cayman Islands, and our corporate affairs are governed by our amended and restated memorandum and articles of association, the Companies Act and the common law of the Cayman Islands. The rights of shareholders and the fiduciary duties of our directors under Cayman Islands law differ significantly from those in the United States, as the Cayman Islands has a distinct body of corporate and securities law with comparatively limited judicial precedent as compared to the United States. For instance, Cayman Islands companies may not have standing to initiate a shareholders derivative action in a Federal court of the United States, and the courts of the Cayman Islands are unlikely to recognize or enforce U.S. judgments based on civil liability provisions of federal securities laws.

While Cayman Islands courts may recognize and enforce foreign money judgments from competent foreign courts without retrial on the merits, this recognition is subject to certain conditions. Judgments must be final and conclusive and for a liquidated sum, and must not be in respect of taxes or a fine or penalty, inconsistent with a Cayman Islands judgment in respect of the same matter, impeachable on the grounds of fraud or obtained in a manner, or be of a kind the enforcement of which is, contrary to natural justice or the public policy of the Cayman Islands (awards of punitive or multiple damages may well be held to be contrary to public policy). A Cayman Islands Court may stay enforcement proceedings if concurrent proceedings are being brought elsewhere. As a result, public shareholders may have more difficulty in protecting their interests in the face of actions taken by management, members of the Board of Directors or controlling shareholders than they would as public shareholders of a United States company.

In addition, the Cayman Islands has enacted the International Tax Co-operation (Economic Substance) Act (as Revised) (“Substance Act”), effective January 1, 2019, introducing certain economic substance requirements for in-scope Cayman Islands entities which are engaged in certain “relevant activities,” which in the case of exempted companies incorporated before January 1, 2019, will apply in respect of financial years commencing July 1, 2019 onwards. As a Cayman Islands company, we are required to file annual notifications, which need to state whether we are carrying out any relevant activities and if so, whether we have satisfied economic substance tests where applicable. It is anticipated that the Substance Act will evolve and be subject to further clarification and amendments. Non-compliance may result in penalties, and the evolving nature of the Substance Act may require us to allocate additional resources and adjust operations to meet ongoing compliance obligations.

Furthermore, we may consider relocating our home jurisdiction or re-domiciling out of the Cayman Islands to another jurisdiction. Such a relocation could subject us to foreign regulatory requirements and cause our material agreements to be governed by the laws of the new jurisdiction. The legal system and enforcement mechanisms of such jurisdictions may differ from those of the United States, potentially limiting our ability to enforce agreements or obtain remedies, which could result in a loss of business, business opportunities or capital.

Above factors collectively pose risks to our operations, governance, and shareholder rights, potentially impacting our business, financial condition, and results of operations.

Risks Related to Gorilla’s Substantial Presence in Taiwan, Thailand and Egypt

Gorilla’s global operations are subject to the risks of doing business internationally, including periodic foreign economic downturns and political instability, any of which may adversely affect its business, results of operations and financial condition.

Gorilla’s headquarters are located in the United Kingdom, while its offices and employees, including certain management members, are primarily in Taiwan, a region where political, economic, and military conditions, including any escalation of tensions between China and Taiwan, may directly affect its business and operations. Gorilla has historically conducted much of its business in Taiwan and has now expanded into emerging markets, such as Egypt and Thailand, which are central to its growth strategy. However, many of these regions where we operate or plan to operate have experienced, and may continue to experience, political instability, civil unrest, hostilities, terrorist activities, export controls and economic volatility, amplified by global conflicts including the Russia-Ukraine and the Hamas-Israel conflicts. Additionally, other facts relating to the operation of Gorilla’s business outside of the United States may have an adverse effect on Gorilla’s business, financial condition and results of operations, including:

As Gorilla continues to operate its business, its success will depend in part, on its ability to anticipate and effectively manage these risks. The impact of any one or more of these factors could adversely affect Gorilla’s business, financial condition and results of operations.

Currency exchange rate fluctuations in the various currencies in which we do business could have a material adverse effect on our results of operations.

We report our operating results in U.S. dollars, but a substantial portion of our revenues and expenses are denominated in currencies other than the U.S. dollar. Accordingly, we must translate such revenues and expenses, as well as corresponding assets and liabilities, into U.S. dollars at exchange rates in effect during or at the end of each reporting period, as applicable. As a result, fluctuations in foreign currency exchange rates can adversely affect our results of operations. The exchange rates among the Egyptian Pounds, New Taiwan Dollar, and other currencies in which we incur costs or earn revenues and the U.S. dollar have changed substantially in recent years and may fluctuate substantially in the future.

Given our anticipated international operations, Gorilla expects the number of transactions in various foreign currencies to continue to grow in the future. As a result, Gorilla may need to convert the currencies received through its operations into other currencies in order to fund its continued operations. Such conversions may create transaction costs to Gorilla. In addition, although Gorilla tries to limit its exposure to foreign currency fluctuations, the use of hedging instruments may not be available for all currencies or may not always offset losses resulting from foreign currency exchange rate fluctuations. Moreover, the use of hedging instruments can itself result in losses if we are unable to structure effective hedges with such instruments.

Exchange controls and other restrictions on the movement of capital out of certain jurisdictions or otherwise affecting our settlement transactions or our subsidiaries’ ability to pay dividends or make other payments to us may have a material adverse effect on our results of operations and financial condition.

We are subject in certain jurisdictions where we have operations, such as certain countries in Asia and Egypt, to the risk that regulatory authorities in or outside such jurisdictions may impose exchange controls or restrictions on the movement of capital, including on transactions involving transfers of funds from such jurisdictions, as well as restrictions on repatriation of funds or repatriation of profits on subsidiaries from such jurisdictions, which may restrict the amount of funds that can be transferred or dividends that can be paid upstream to us from such jurisdictions. If we are unable to transfer such amounts from such jurisdictions when and as needed, we will remain subject to foreign exchange risk relating to such retained funds denominated in local currencies (including merchant funds held by us), to the extent we cannot convert such funds into other currencies (whether as a result of foreign exchange restrictions in such jurisdictions, or any restrictions on transferring funds out of such jurisdictions), which may adversely impact our ability to settle such transactions and subject us to significant foreign exchange risk, which could have a material adverse effect on our results of operations, liquidity and financial condition.

In addition, repatriations of cash from our subsidiaries may be subject to local tax laws, rules and regulations in the relevant jurisdictions, which are subject to change from time to time.

It may be difficult to enforce a U.S. judgment against Gorilla, its officers and directors in Taiwan or the United States, or to assert U.S. securities laws claims in Taiwan or serve process on Gorilla’s officers and directors and these experts.

Many of Gorilla’s directors or officers are not residents of the United States and most of their and Gorilla’s assets are located outside the United States. Service of process upon Gorilla or its non-U.S. resident directors and officers and enforcement of judgments obtained in the United States against Gorilla or its non-U.S. directors and executive officers may be difficult to obtain within the United States. Gorilla have been informed by its legal counsel in Taiwan that it may be difficult to assert claims under U.S. securities laws in original actions instituted in Taiwan or obtain a judgment based on the civil liability provisions of U.S. federal securities laws. Taiwanese courts may refuse to hear a claim based on a violation of U.S. securities laws against Gorilla or its non-U.S. officers and directors because Taiwan may not be the most appropriate forum to bring such a claim. In addition, even if a Taiwanese court agrees to hear a claim, it may determine that Taiwanese law and not U.S. law is applicable to the claim. If U.S. law is found to be applicable, the content of applicable U.S. law must be proved as a fact, which can be a time-consuming and costly process. Certain matters of procedure will also be governed by Taiwanese law. Taiwanese courts might not enforce judgments rendered outside Taiwan, which may make it difficult to collect on judgments rendered against Gorilla or its non-U.S. officers and directors.

Moreover, among other reasons, including but not limited to, fraud or absence of due process, or the existence of a judgment which is at variance with another judgment that was given in the same matter if a suit in the same matter between the same parties was pending before a court or tribunal in Taiwan, a Taiwanese court will not enforce a non-Taiwanese judgment if it was given in a state whose laws do not provide for the enforcement of judgments of Taiwanese courts (subject to exceptional cases) or if its enforcement is likely to prejudice its sovereignty or security.

Risks Related to the Gorilla Financial Statements and Internal Control Over Financial Reporting

As an emerging growth company, we benefit from exemptions, including the exemption from the auditor attestation of internal controls report, which may make our securities less attractive to investors. Failure to implement and maintain effective internal controls or remediate identified weaknesses could impair our ability to accurately report financial results, meet reporting obligations, and prevent fraud, adversely affecting investor confidence and the market price of our shares.

Gorilla is eligible to be treated as an emerging growth company, as defined in Section 2(a) of the Securities Act, as modified by the JOBS Act. Gorilla could be an emerging growth company for up to five years, although circumstances could cause it to lose that status earlier, including if its total annual gross revenue exceeds $1.235 billion, if it issues more than $1.0 billion in non-convertible debt securities during any three-year period, or if, before that time, it becomes a “large accelerated filer” under U.S. securities laws. As long as we qualify as an emerging growth company, we may take advantage of certain exemptions from various reporting requirements that apply to other public companies that are not emerging growth companies, including not being required to comply with the auditor attestation requirements of Section 404 of the Sarbanes-Oxley Act. As a result, its shareholders may not have access to certain information that they may deem important. Gorilla cannot predict whether investors will find its securities less attractive because it relies on these exemptions. If some investors find its securities less attractive as a result, there may be a less active trading market for its securities and the price of Gorilla’s securities may be more volatile.

Effective internal controls are necessary for us to provide reliable and accurate financial information and to effectively prevent fraud. We devote significant financial and managerial resources and time to comply with the internal control over financial reporting requirements and continue to enhance our controls. Internal control over financial reporting has inherent limitations, including human error, sample-based testing, the possibility that controls could be circumvented or become inadequate because of changed conditions, unidentified controls, and fraud, which might not prevent or detect all misstatements or fraud, and could result in adverse consequences to us, including, but not limited to, a loss of investor confidence in the reliability of our financial results, increased risk of fraud or misuse of corporate assets, regulatory investigations, and civil or criminal sanctions, which could adversely affect our business, financial condition, results of operations, and prospects, as well as the trading price of our shares may be materially and adversely affected.

Risks Related to Ownership of Our Ordinary Shares

The trading price of our ordinary shares is likely to continue to be volatile.

The trading price of our ordinary shares has been highly volatile and could continue to be subject to wide fluctuations in response to various factors, some of which are beyond our control. Our ordinary shares have experienced significant intra-day price fluctuations over the past 52 weeks. The stock market in general, and the market for technology companies in particular, has experienced extreme price and volume fluctuations that have often been unrelated or disproportionate to the operating performance of those companies. In particular, a large proportion of our ordinary shares has been historically and may in the future be traded by short sellers which may put pressure on the supply and demand for our ordinary shares, further influencing volatility in its market price. Public perception of our company or management and other factors outside of our control may additionally impact the share price of companies like us that garner a disproportionate degree of public attention, regardless of actual operating performance.

We qualify as a foreign private issuer, exempting us from certain U.S. reporting and governance requirements, but losing this status could increase our compliance costs significantly.

As a foreign private issuer under the Exchange Act, Gorilla is exempt from certain provisions applicable to U.S. domestic public companies, including rules on proxy solicitation related to the furnishing and content of proxy statements, the requirement for officers, directors, and principal shareholders to file public reports of their share ownership and trading activities under Section 16 of the Exchange Act, including the “short-swing profit” recovery provisions, the filing of quarterly reports on Form 10-Q containing unaudited financial information, and Regulation FD, which is intended to prevent issuers from making selective disclosures of material information. Unlike U.S. domestic issuers, which must file annual reports on Form 10-K within 60 to 75 days after the fiscal year-end (depending on their filing status), foreign private issuers have up to 120 days to file their annual report on Form 20-F. These exemptions may reduce the level of transparency and limit shareholder protections compared to U.S. domestic companies.

If Gorilla loses its foreign private issuer status, it will be required to file with the SEC periodic reports and registration statements on U.S. domestic issuer forms, which are more detailed and extensive than the forms available to a foreign private issuer, comply with U.S. GAAP, federal proxy requirements, and Section 16 short-swing profit provisions, and lose its ability to rely on exemptions from certain corporate governance requirements under the listing rules of Nasdaq, which could significantly increase its compliance costs.

A market for our securities may not be sustained, which could adversely affect the liquidity, price and trading volume of our securities.

The stock markets, including Nasdaq on which Gorilla lists the ordinary shares and warrants under the symbols “GRRR,” and “GRRRW,” respectively, have from time to time experienced significant price and volume fluctuations. Even with an active market, the market price and trading volume of the ordinary shares and warrants may be volatile and could decline significantly. Gorilla cannot assure you that the market price of the ordinary shares and warrants will not fluctuate widely or decline, in the future in response to a number of factors, including, among others, the following:

If Gorilla failed to meet Nasdaq’s continued listing requirements and was delisted, it could impair investors’ ability to sell securities unless a market can be established or sustained. If securities are moved to the OTC Bulletin Board, an inter-dealer automated quotation system for equity securities that is not a national securities exchange, liquidity and price may further decline. While the Company believes it is currently in compliance with the Nasdaq’s listing rules, there can be no guarantee that it will maintain compliance in the future.

As a public company, Gorilla may initially attract limited or inexperienced analyst coverage, leading to inaccurate forecasts and increasing the likelihood of failing to meet estimates. Unfavorable opinions, changes in financial estimates or Gorilla’s failure to meet these estimates, or analysts’ failure to initiate or maintain coverage could negatively impact Gorilla’s market performance and investor expectations.

In the past, securities class-action litigation has often been instituted against companies following periods of volatility in the market price of their shares. This type of litigation could result in substantial costs and divert Gorilla’s management’s attention and resources, which could have a material adverse effect on us.

ITEM 4: INFORMATION ON THE COMPANY

4.A. HISTORY AND DEVELOPMENT OF THE COMPANY

General Corporate Information

Gorilla was incorporated in 2001 as a Cayman Islands exempted company, and our principal executive office is located at 64 North Row, London, United Kingdom W1K 7DA. Our legal and commercial name is Gorilla Technology Group Inc. Our company incorporation number is 110283. Our registered office address in the Cayman Islands is located at PO Box 309, Ugland House, Grand Cayman, KY1-1104, Cayman Islands. Gorilla’s ordinary shares were listed on the Nasdaq Capital Market on July 14, 2022. Our website address is https://www.gorilla-technology.com, and our telephone number is +442039880574. Information contained on, or that can be accessed through, our website does not constitute a part of this annual report and is not incorporated by reference herein. We have included our website address in this Annual Report solely for informational purposes. The SEC maintains an Internet site that contains reports, proxy and information statements, and other information regarding issuers, such as we, that file electronically, with the SEC at www.sec.gov. Our agent for service of process in the United States is Puglisi & Associates, 850 Library Avenue, Suite 204, Newark, Delaware 19715.

4.B. BUSINESS OVERVIEW

Introduction: The Foundation of Intelligent Digital Transformation

Headquartered in London United Kingdom, Gorilla is a global solution provider specializing in Security Intelligence, Network Intelligence, Business Intelligence, and Internet of Things (“IoT”). With a strong presence in Asia Pacific, the United States, Europe, the Middle East, and Latin America, we deliver AI-driven solutions that power Smart Cities, Enterprises, Government, Manufacturing, Telecommunications, Retail, Transportation, Logistics, Healthcare, and Education.

Our expertise lies in revolutionizing urban operations, enhancing security, and optimizing digital transformation. We deliver pioneering products that integrate AI, deep learning, and edge computing to advance intelligent video surveillance, facial recognition, license plate recognition, post-event analytics, cybersecurity, and network intelligence. By leveraging these innovations, we empower governments and enterprises to increase efficiency, security, and resilience, ultimately improving the quality of life for people worldwide.

History: Our Evolution

Founded in 2001 in the Cayman Islands, Gorilla initially focused on video content solutions for broadcasting firms in Taiwan, where our AI-driven video analysis capabilities were first developed.

In 2010, Gorilla pivoted towards computer vision, machine learning, and cybersecurity, investing in optical character recognition, object detection, facial recognition, and AI-powered analytics. Over the past decade, we have expanded into Big Data Analytics, IoT, Edge AI computing, and infrastructure solutions, transforming how governments and enterprises collect, process, and analyze data to drive real-world impact.

Today, our AI-powered solutions are deployed in government institutions, corporate offices, highways, airports, seaports, train stations, hospitals, retail spaces, universities, and law enforcement agencies. Gorilla continues to be a trusted technology partner, helping organizations secure, optimize, and future-proof their operations.

Our Edge AI-driven solutions process data directly at the network’s edge, reducing reliance on cloud-based computation and ensuring faster, more efficient, and cost-effective AI operations. The four key advantages of

Edge AI include: