CMG, §1A diff (2022 → 2023)

You should carefully consider the risks described below in addition to the other information set forth in this Annual Report on Form 10-K, including the “Management’s Discussion and Analysis of Financial Conditions and Results of Operations” section and the consolidated financial statements and related notes. If any of the risks and uncertainties described below occur or continue to occur, our business, financial condition and results of operations, and the trading price of our common stock could be materially and adversely affected. The risks and uncertainties described below are those that we have identified as material but are not the only risks and uncertainties we face. Our business is also subject to general risks and uncertainties that affect many other companies, including, but not limited to, overall economic and industry conditions. Additional risks not currently known to us or that we presently deem immaterial may arise or become material and may negatively impact our business, reputation, financial condition, results of operations or the trading price of our common stock.

Risks Related to the Nature of our Business and the Restaurant Industry

Food safety and food-borne illness concerns may have an adverse effect on our business by decreasing sales and increasing costs.

Food safety is our top priority, and we dedicate significant resources to ensuring that our guests enjoy safe, high-quality food products. However, even with strong preventative controls and interventions, food safety risks cannot be completely eliminated in every restaurant. Incidents of food-borne illnesses continue to occur in the restaurant industry and may result from the failure of restaurant employees or suppliers to follow our food safety policies and procedures, or from employees or guests entering our restaurant while ill and contaminating ingredients or surfaces. Although we monitor and audit compliance with our program, we cannot guarantee that each and every food item is safely and properly maintained from the start of the supply chain through guest consumption. Any report, legitimate or rumored, of food-borne illness such as E. coli, hepatitis A, norovirus or salmonella, or other food safety issues, such as food tampering or contamination, at one of our restaurants could adversely affect our reputation and have a negative impact on our sales. In addition, instances of food-borne illness or food safety issues that occur solely at competitors’ restaurants could result in negative publicity about the restaurant industry and adversely impact our sales. Social media has dramatically increased the speed with which negative publicity, including actual or perceived food safety incidents, is disseminated before there is any meaningful opportunity to investigate, respond to and address an issue. The occurrence of food-borne illnesses or food safety issues could also adversely affect the price and availability of affected ingredients, resulting in higher costs and lower margins.

We may be at a higher risk for food safety incidents than some competitors due to our greater use of fresh, unprocessed produce, handling of raw chicken in our restaurants, our reliance on employees cooking with traditional methods and the lack of added preservatives and frozen ingredients in our menu items. The risk of illnesses associated with our food also may increase due to our delivery or catering businesses, in which our food is transported, stored and/or served in conditions that are not under our control. All of these factors could have an adverse impact on our ability to attract and retain guests, which could in turn have a material adverse effect on our growth and profitability.

Our digital business, which accounted for a significant portion of our 2023 total revenue, is subject to risks.

In 2023, 37.4% of our food and beverage revenue was derived from digital orders, which includes third-party delivery and customer pickup in-restaurant and through our Chipotlanes. Approximately 18% of our 2023 food and beverage revenue consisted of delivery orders for which we are reliant on third-party delivery companies. Depending on which ordering platform a guest uses – our platform or the platform of a third-party delivery service – the delivery fee we collect from the guest may be less than the actual delivery cost, which has a negative impact on our profitability. In addition, several jurisdictions (e.g., California, New York City and Seattle) have implemented minimum wages for delivery drivers, and other jurisdictions are considering similar wage regulations, which could increase delivery fees and decrease our digital sales. In 2023, we implemented menu price increases to partially offset the increases in ingredients, labor and other costs; however, our higher menu prices may cause some guests to shift their purchases to other restaurants offered on the platform. If the third-party delivery companies we utilize increase their fees or give greater priority or promotions on their platforms to other restaurants, our delivery business and our sales may be negatively impacted. These delivery companies maintain control over data regarding our guests who use their platform and over the guest experience. We use our mobile app to drive convenience and increase brand engagement with our guests. If a third-party delivery driver fails to make timely deliveries or fails to deliver the complete order, our guests may attribute the bad customer experience to Chipotle and our reputation and sales could be negatively impacted. The ordering and payment platforms used by these third parties, our mobile app or our online ordering site have been and could again be interrupted by technological failures, user errors, cyber-attacks or other factors, which could adversely impact sales through these channels and negatively impact our overall sales and reputation. In addition, the delivery business has been consolidating and may continue to consolidate, which may give third-party delivery companies more leverage in negotiating the terms and pricing of contracts, which in turn could negatively impact our profits from this channel.

The restaurant industry is highly competitive. If we are not able to compete successfully, our business, financial condition and results of operations would be adversely affected.

The restaurant industry is highly competitive with respect to taste preferences, price, food quality and selection, customer service, brand reputation, digital engagement, advertising and promotional initiatives, and the location, attractiveness and maintenance of restaurants. We also compete with non-traditional market participants, such as “convenience meals” in the form of entrées, side dishes or meal preparation kits from the deli or prepared foods sections of grocery stores, meal kit delivery services, and “ghost” or “dark” kitchens, where meals are prepared at separate takeaway premises rather than a restaurant. Increased competition could have an adverse effect on our sales, profitability and development plans. If guest or dietary preferences change, if our marketing efforts are unsuccessful, or if our restaurants are unable to compete successfully with other restaurant outlets, our business could be adversely affected.

We continue to believe that our commitment to higher-quality and responsibly sourced ingredients resonates with guests and gives us a competitive advantage; however, many of our competitors also make claims related to the quality of their ingredients and lack of artificial flavors, colors and preservatives. The increasing use of these claims by competitors, regardless of the accuracy of such claims, may lessen our differentiation and make it more difficult for us to compete. If we are unable to continue to maintain our distinctiveness and compete effectively, our business, financial condition and results of operations could be adversely affected.

If we do not continue to persuade guests of the benefits of paying higher prices for our higher-quality food, our sales and results of operations could be hurt.

Our success depends in large part on our ability to persuade guests that food made with ingredients that were raised or grown according to our Food with Integrity principles are worth paying a higher price relative to prices of some of our competitors, particularly quick-service restaurants. Under our Food with Integrity principles, for example, animals must be responsibly raised, and the milk in our sour cream, cheese and queso must come from cows that have not been treated with rBGH, practices which typically are more costly than conventional farming. If we are not able to successfully persuade guests that consuming food made in accordance with our Food with Integrity principles is better for them and the environment, or if guests do not agree with the overall value proposition of our menu, our sales could be adversely affected, which would negatively impact our results of operations.

Our inability or failure to recognize, respond to and effectively manage the immediacy of social media could have a material adverse impact on our business.

Social media and internet-based communications, including video-sharing, social networking, and gaming and messaging platforms, give users immediate access to a broad audience. These platforms have dramatically increased the speed and scale of dissemination and accessibility of information, including negative comments about our food quality or safety, negative guest or employee experiences and videos depicting inappropriate behavior of employees and guests. Accurate, inaccurate or misleading information can be widely disseminated before there is any meaningful opportunity to respond or address an issue. It is impossible for us to fully predict or control social media backlash, and the inappropriate use of social media by our guests or employees could harm our business, prospects, financial condition, and results of operations, regardless of the information’s accuracy.

Use of social media is an important element of our marketing efforts. Social media and internet-based communication platforms are evolving rapidly, and we need to continuously innovate and evolve our marketing strategies to maintain our brand relevance and broad appeal to guests. We also continue to invest in other digital marketing initiatives to reach our guests and build their awareness of, engagement with, and loyalty to us, including our “Chipotle Rewards” loyalty program. These initiatives may not be successful, resulting in expenses incurred without the benefit of higher revenues, increased customer engagement or brand recognition. Other risks associated with our use of social media and internet-based communication platforms include association with influencers or online celebrities who become embroiled in controversy, platforms and business partners who experience challenges, improper disclosure of proprietary information, negative comments about us, exposure of personally identifiable information, fraud, hoaxes or malicious dissemination of false information. Use of social media by our employees, guests and associates could lead to litigation or result in negative publicity that could damage our reputation.

Risks Related to Human Capital

If we are not able to hire, develop and retain qualified restaurant employees and/or appropriately plan our workforce, our growth plan and profitability could be adversely affected.

Our aggressive pace of opening new restaurants can make it increasingly difficult to recruit and hire sufficient numbers of qualified employees to manage and work in our restaurants, to maintain an effective system of internal controls for a dispersed workforce and to train employees to deliver a consistently high-quality product and customer experience, which could materially harm our business and results of operations. Maintaining appropriate staffing in our restaurants requires precise workforce planning, which has become more complex due to predictive scheduling laws (also called “fair workweek” or “secure scheduling”) and “just cause” termination legislation in certain geographic areas where we operate. The market for qualified talent continues to be competitive and we must continue to offer competitive wages, benefits and workplace conditions to retain qualified employees. We have experienced and may continue to experience challenges in hiring and retaining restaurant employees and in maintaining full restaurant staffing in various locations, which has resulted in longer wait times for guest orders, temporary closures of the digital make line and decreased employee and guest satisfaction. In one instance, we permanently closed a restaurant due to lack of necessary staff after a prolonged recruiting effort. A shortage of qualified candidates who meet legal work authorization requirements, failure to hire, train and retain new restaurant employees in a timely manner or higher than expected turnover levels could affect our ability to open new restaurants, grow sales at existing restaurants or meet our labor cost objectives. In addition, failure to adequately monitor and proactively respond to employee dissatisfaction could lead to poor guest satisfaction, higher turnover, litigation and unionization efforts, which could negatively impact our ability to meet our growth targets. We have experienced labor union efforts to organize groups of our employees from time to time and, if successful, those organizational efforts may decrease our operational flexibility and disrupt our normal operations, which could adversely affect our business.

If we fail to comply with applicable federal, state and local employment and labor laws and regulations, it could have a material, adverse impact on our business.

Various federal, state and local employment and labor laws and regulations govern our relationships with our employees, and similar laws and regulations apply to our operations outside of the U.S. These laws and regulations relate to matters such as employment discrimination, wage and hour laws, requirements to provide and document meal and rest periods or other benefits, family leave mandates, requirements regarding working conditions and accommodations to certain employees, citizenship or work authorization and related requirements, insurance and workers’ compensation rules, healthcare laws and anti-discrimination and anti-harassment laws. We incur substantial costs to comply with these laws and regulations and non-compliance could expose us to significant liabilities. For example, we have had lawsuits filed against us alleging violations of federal and state laws regarding employee wages and payment of overtime, meal and rest breaks, employee classification, employee record-keeping and related practices with respect to our employees. We incur legal costs to defend these types cases, and we could incur losses from these and similar cases, and the amount of such losses or costs could be material.

In addition, several jurisdictions (e.g. New York City, Philadelphia, Chicago, Seattle, etc.) have implemented fair workweek or “secure scheduling” legislation, which impose complex requirements related to scheduling for certain restaurant and retail employees, and additional jurisdictions are considering similar legislation. Several jurisdictions also have implemented sick pay and paid time off legislation, which requires employers to provide paid time off to employees, and “just cause” termination legislation, which restricts companies’ ability to terminate employees or reduce employees’ hours unless they can prove “just cause” or a “bona fide economic reason” for the termination or reduction in hours. All of these regulations impose additional obligations on us and our failure to comply with any of these regulations could subject us to penalties and other legal liabilities, which could adversely affect our ability to attract and retain employees and our results of operations, and potentially cause us to close or reduce operating hours of some restaurants in these jurisdictions. For example, we previously reported the settlement of a complaint alleging that we violated New York City’s Fair Workweek law and Earned Safe and Sick Time Act, and we also have been and are undergoing several audits of our compliance with employment law requirements, which could result in additional liabilities. Our liability exposure for these employment laws and regulations may be higher than our restaurant peers because we are one of the largest restaurant companies that owns and operates all our restaurants, while most of our restaurant peers franchise some or a significant portion of their operations.

11

Increases in the cost of labor, including mandated minimum wage increases, could adversely impact our business and profitability.

Our profitability has been and could continue to be adversely impacted by increases in labor costs, including wages and benefits, which are some of our most significant costs, including increases triggered by federal, state and local laws governing matters such as minimum wages, meal and rest breaks and changes to eligibility for overtime pay; regulations regarding scheduling and benefits; increased health care and workers’ compensation insurance costs; and higher wages and benefit costs necessary to attract, hire and retain high-quality employees with the right skill sets in a highly competitive job market. In addition, state and local laws may require wage increases and standards on working hours and other factors that would restrict our flexibility to respond to market conditions and increase our costs without corresponding benefits. Beginning in April 2024, new California legislation requires national restaurant chains, including Chipotle, to pay a minimum $20 per hour wage to restaurant workers in California, which minimum wage may be increased annually by a state-appointed council. Other state, county and city jurisdictions are considering similar regulations. Our ability to offset higher labor costs by increasing menu prices depends on the willingness of our guests to pay the higher prices and the perceived value of our meals relative to competitors. If competitive or inflationary pressures or other factors prevent us from offsetting higher labor costs by increased menu prices, our profitability may decline.

A failure to recruit, develop and retain effective leaders or the loss or shortage of personnel with key capacities and skills could impact our strategic growth plans and jeopardize our ability to meet our business performance expectations and growth targets.

Our ability to continue to grow our business depends substantially on the contributions and abilities of our executive leadership team and other key management personnel. Changes in senior management could expose us to significant changes in strategic direction and initiatives. A failure to maintain appropriate organizational capacity and capability to support our strategic initiatives or to build adequate bench strength with key skillsets required for seamless succession of leadership, could jeopardize our ability to meet our business performance expectations and growth targets. If we are unable to attract, develop, retain and incentivize sufficiently experienced and capable management personnel, our business and financial results may suffer.

Risks Related to Cybersecurity, Data Privacy and IT Systems

Breaches or other unauthorized access, theft, modification or destruction of guest and/or employee personal, confidential or other material information that is stored in our systems or by third parties on our behalf could adversely affect our business.

As our reliance on technology has grown, the scope and severity of risks posed to our systems from cyber threats has increased. Many of our information technology systems (whether cloud-based or hosted in proprietary servers), including those used for our point-of-sale, web and mobile platforms, online and mobile payment systems, delivery services and rewards programs and administrative functions, contain personal, financial or other information that is entrusted to us by our guests, business partners and employees. Many of our information technology systems also contain confidential information about our business, such as business strategies, development initiatives and designs, and confidential information about third parties, such as suppliers. Similar to many other restaurant companies, we have in the past experienced, and we expect to continue to experience, cyber-attacks, including phishing, and other attempts to breach, or gain unauthorized access to, our systems and databases. To date, these attacks have not had a material impact on our operations, but we cannot provide assurance that they will not have an impact in the future.

Our third-party providers’ and business partners’ information technology systems and databases are likewise subject to such risks. The number and frequency of these attempts varies from year to year but could be exacerbated to some extent by an increase in our digital operations. In addition, we provide some guest and employee data, as well as confidential information important to our business, to third parties to conduct our business. Individuals performing work for us and these third parties also may access some of this data, including on personally owned digital devices. To the extent we, a third party or such an individual were to experience a breach of our or their information technology systems that results in the unauthorized access, theft, use, destruction or other compromises of customers’ or employees’ data or confidential information of Chipotle stored in or transmitted through such systems, including through cyber-attacks or other external or internal methods, it could result in a material loss of revenues from the potential adverse impact to our reputation and brand, a decrease in our ability to retain customers or attract new ones, the imposition of potentially significant costs (including loss of data or payment for recovery of data) and liabilities, loss of business, loss of business partners and licensees and the disruption to our supply chain, business and plans. Unauthorized access, theft, use, destruction or other compromises are becoming increasingly sophisticated and may occur through a variety of methods, including attacks using malicious code, vulnerabilities in software, hardware or other infrastructure (including systems used by our supply chain), system misconfigurations, phishing or social engineering. The rapid evolution and increased adoption of artificial intelligence technologies may intensify our cybersecurity risks. Our logging capabilities, or the logging capabilities of third parties, are not always complete or sufficiently granular, affecting our ability to fully understand the scope of security breaches.

12

Such security breaches also could result in a violation of applicable U.S. and international privacy, cyber and other laws or trigger data breach notification laws, including new disclosure rules promulgated by the SEC, and subject us to private third party or securities litigation and governmental investigations and proceedings, any of which could result in our exposure to material civil or criminal liability.

We may be required to make significant capital investments and other expenditures to investigate security incidents, remedy cybersecurity problems, recuperate lost data, prevent future compromises and adapt systems and practices to react to the changing threat environment. These include costs associated with notifying affected individuals and other agencies, additional security technologies, training and personnel, retention of experts and providing credit monitoring services for individuals whose data has been breached. These costs could be material and could adversely impact our results of operations in the period in which they are incurred, including by causing us to delay the pursuit of other important business strategies and initiatives, and may not meaningfully limit the success of future attempts to breach our information technology systems.

Media or other reports of existing or perceived security vulnerabilities in our systems or those of our third-party business partners or service providers can also adversely impact our brand and reputation and materially impact our business. Additionally, the techniques and sophistication used to conduct cyber-attacks and compromise information technology systems, as well as the sources and targets of these attacks, change frequently and are often not recognized until such attacks are launched or have been in place for a period of time. The rapid evolution and increased adoption of artificial intelligence technologies amplifies these concerns. We continue to make significant investments in technology, third-party services and personnel to develop and implement systems and processes that are designed to anticipate cyber-attacks and to prevent or minimize breaches of our information technology systems or data loss, but these security measures cannot provide assurance that we will be successful in preventing such breaches or data loss.

We may incur increased costs to comply with privacy and data protection laws and, if we fail to comply, we could be subject to government enforcement actions, private litigation and adverse publicity.

Complex local, state, federal and international laws and regulations apply to the collection, use, retention, protection, disclosure, transfer and other processing of personal data. These privacy and data protection laws and regulations are quickly evolving, with new or modified laws and regulations proposed and implemented frequently and existing laws and regulations subject to new or different interpretations and enforcement. For example, the European Union’s General Data Protection Regulation (“GDPR”) requires companies to meet certain requirements regarding the handling of personal data, including its use, protection and transfer and the ability of persons whose data is stored to correct or delete such data about themselves, and failure to meet the GDPR requirements could result in penalties of up to 4% of annual worldwide revenue. Additionally, the California Consumer Privacy Act of 2018 (“CCPA”) provides a private right of action for data breaches and requires companies that process the personal information of California residents to make new disclosures to consumers about their data collection, use and sharing practices, allow consumers to opt out of certain data sharing with third parties and to request deletion of personal information (subject to certain exceptions). Other states passed similar privacy legislation that took effect in 2023, and other states and countries passed or are considering expanding or passing comprehensive privacy laws. If we fail, or are perceived to have failed, to properly respond to security breaches of our or a third party’s information technology systems or fail to properly respond to or honor consumer requests under any of the foregoing privacy laws, we could experience reputational damage, adverse publicity, loss of consumer confidence, reduced sales and profits, complications in executing our growth initiatives and regulatory and legal risk, including regulatory fines and penalties, and in some cases civil liabilities where individuals have been provided with a private right of action.

Compliance with the current and future privacy and data protection laws can be costly and time-consuming and there is no assurance that our compliance efforts will be successful in preventing breaches or data loss. Our failure to comply with applicable laws and regulations or other obligations to which we may be subject relating to personal information, or to protect personal information from unauthorized access, use or other processing, could result in enforcement actions and regulatory investigations against us, claims for damages by customers and other affected individuals, fines or damage to our brand reputation, any of which could have a material adverse effect on our operations, financial performance and business.

The regulatory environment related to privacy and data security is changing at an ever-increasing pace, with new, increasingly rigorous, and often unclear requirements applicable to our business. In addition, the issues regulated by privacy laws (such as advertising and marketing, children, biometric, employee, surveillance, artificial intelligence, and health related information) have expanded, as have the number of city, state, federal and international governmental bodies and agencies that have recently passed or are currently considering privacy legislation or regulatory rulemaking. Where not limited by preemption and where there are perceived shortcomings in federal laws, many states have passed or are considering adopting stricter versions of federal privacy laws (e.g., state level statutes similar to the Telephone Consumer Protection Act of 1991, the Health Insurance Portability and Accountability Act, and the Children’s Online Privacy Protection Act of 1998). Private service providers also have implemented mandatory privacy requirements impacting businesses, like Chipotle, that wish to utilize services available on their platforms.

13

In addition, a number of recent lawsuits have pled creative claims under privacy legislation such as the Video Privacy Protection Act, Electronic Communications Privacy Act (including the WireTap Act and Stored Communications Act), Computer Fraud and Abuse Act, and similar state laws alleging wiretapping, eavesdropping, tape recording and invasion of privacy through the use of marketing pixels, analytics software, session replay technology, voice recording, and live chat functionality. Defending against such claims can be costly and strain internal resources.

Taken together, Chipotle faces rapidly increasing compliance costs in order to modify its operations and business practices to comply with applicable laws, regulations and other requirements.

We rely heavily on information technology systems and failures or interruptions in our IT systems could harm our ability to effectively operate our business and/or result in the loss of guests or employees.

We rely heavily on information technology systems, including the point-of-sale and payment processing system in our restaurants, technologies supporting our digital and delivery business, technologies that trace ingredients back to suppliers and growers and manage our supply chain, our rewards program, technologies that facilitate marketing initiatives, employee engagement and payroll processing, and various other processes and transactions. Our ability to effectively manage our business and coordinate the procurement, production, distribution, safety and sale of our products depends significantly on the availability, reliability and security of these systems. Many of these critical systems are provided and managed by third parties, and we are reliant on these third-party providers to implement protective measures that ensure the security and availability of their systems. Although we have operational safeguards in place, these safeguards may not be effective in preventing the failure of these third-party systems or platforms to operate effectively and be available. Failures may be caused by various factors, including power outages, catastrophic events, physical theft, computer and network failures, inadequate or ineffective redundancy, problems with transitioning to upgraded or replacement systems or platforms, flaws in third-party software or services, errors or improper use by our employees or the third-party service providers. If any of our critical IT systems were to become unreliable, unavailable, compromised or otherwise fail, and we were unable to recover in a timely manner, we could experience an interruption in our operations that could have a material adverse impact on our profitability.

Risks Related to Supply Chain

Increases in the costs of ingredients and other materials, including increases caused by inflation, global conflicts and climate risks, or the failure to procure sufficient ingredients could adversely affect our results of operations.

Supply chain risk could increase our costs and result in a shortage of ingredients and supplies that are critical to our restaurant operations. The markets for some of our ingredients, such as beef, avocado and other produce, are particularly volatile due to factors beyond our control such as limited sources, seasonal shifts, climate conditions, inclement weather, natural disasters, recent inflationary trends, military and geopolitical conflicts and industry demand, including as a result of animal disease outbreaks, international commodity markets, food safety concerns, product recalls and government regulation. In addition, for certain of our ingredients and other materials, we have a limited number of suppliers and distributors. We remain in regular contact with our key suppliers and to date we have not experienced significant prolonged disruptions in our supply chain; however, inflationary pressures for certain supplies and ingredients could continue as inflation increases continue across the global supply chain. Our efforts to mitigate future price risk through forward contracts, strong partnerships with key suppliers, directly managing key raw material procurement, diversifying our supply base and other activities may not fully insulate us from increases in commodity costs, which could have an adverse impact on our profitability.

We also could be adversely impacted by price increases specific to meats raised in accordance with our Responsibly Raised animal welfare criteria, and ingredients grown in accordance with our Food with Integrity specifications, the markets for which are generally smaller and more concentrated than the markets for conventionally raised or grown ingredients. Any increase in the prices of the ingredients most critical to our menu, such as chicken, beef, dairy (for cheese, sour cream and queso), avocados, tomatoes and pork, would have a particularly adverse effect on our operating results. If the cost of one or more ingredients significantly increases, we may choose to temporarily suspend serving menu items that use those ingredients, such as guacamole or one of our proteins, rather than pay the increased cost. Any such changes to our available menu may negatively impact our restaurant traffic and could adversely impact our sales and brand.

14

Shortages or interruptions in the supply of ingredients could adversely affect our operating results.

Our business is dependent on frequent and consistent deliveries of ingredients that comply with our Food with Integrity specifications, such as dairy (for cheese, sour cream and queso). We may experience shortages, delays or interruptions in the supply of ingredients and other supplies to our restaurants due to inclement weather, natural disasters, labor issues or other operational disruptions at our suppliers, distributors or transportation providers, or other conditions beyond our control. Ongoing global conflicts have disrupted and could continue to disrupt some shipping routes, which could result in shortages or delays of certain ingredients. In addition, we have a single or a limited number of suppliers for some of our ingredients, including certain oils, tomatoes, tortillas and adobo. Although we believe we have potential alternative suppliers and sufficient reserves of ingredients, shortages or interruptions in our supply of ingredients could adversely affect our financial results.

Legal and Regulatory Risks

We could be party to litigation or other legal proceedings that could adversely affect our business, results of operations and reputation.

We have been and likely will continue to be subject to litigation and other legal proceedings that may adversely affect our business. These legal proceedings may involve claims brought by employees, guests, government agencies, suppliers, shareholders or others through private actions, administrative proceedings, regulatory actions or other litigation, including litigation on a class or collective basis on behalf of what can be a large group of potential claimants. These legal proceedings have involved, and in the future may involve, allegations of illegal, unfair or inconsistent employment practices, including those governing wage and hour, employment of minors, discrimination, harassment, wrongful termination, and vacation and family leave laws; food safety issues including food-borne illness, food contamination and adverse health effects from consumption of our food products; data security or privacy breaches; guest discrimination; personal injury in our restaurants; marketing and advertising claims, including claims that our Food with Integrity or other sustainability claims are misleading or inaccurate; infringement of patent, copyright or other intellectual property rights; violation of the federal securities laws; workers’ compensation; or other concerns. We are party to a number of pending lawsuits and governmental audits alleging violations of federal and state employment laws, including wage and hour claims, and we could be involved in similar or even more significant litigation and legal proceedings in the future. Even if the allegations against us in current or future legal matters are unfounded or we ultimately are held not liable, the costs to defend ourselves may be significant and the litigation may subject us to substantial settlements, fines, penalties or judgments against us and may divert management's attention away from operating our business, all of which could negatively impact our financial condition and results of operations. Litigation also may generate negative publicity, regardless of whether the allegations are valid, or we ultimately are not liable, which could damage our reputation, and adversely impact our sales as well as our relationships with our employees and guests.

15

We are subject to extensive laws, government regulation, and other legal requirements and our failure to comply with existing or new laws and regulations could adversely affect our operational efficiencies, ability to attract and retain talent and results of operations.

Our business is subject to extensive federal, state, local and international laws and regulations, including those relating to:

preparation, sale and labeling of food, including regulations of the Food and Drug Administration, which oversees the safety of the entire food system, including inspections and mandatory food recalls, menu labeling and nutritional content;

employment practices and working conditions, including minimum wage rates, wage and hour practices, meal and rest breaks, fair workweek/secure scheduling and “just cause” legislation, employment of minors, discrimination, harassment, classification of employees, paid and family leave, workplace safety, immigration and overtime among others;

privacy and data security (including regulations governing the protection of personal information, advertising and marketing, access by children, biometrics, surveillance, artificial intelligence, health-related information and financial information), such as California Privacy Rights Act and CCPA in California and privacy-related legislation in a growing number of other states, and international laws such as GDPR in the European Union and Personal Information Protection and Electronic Documents Act in Canada;

health, sanitation, safety and fire standards and the sale of alcoholic beverages;

building and zoning requirements, including state and local licensing and regulation governing the design and operation of facilities and land use;

public accommodations and safety conditions, including the Americans with Disabilities Act and similar state laws that give civil rights protections to individuals with disabilities in the context of employment, public accommodations, online resources and other areas;

environmental matters, such as emissions and air quality; water consumption; the discharge, storage, handling, release and disposal of hazardous or toxic substances; local ordinances restricting the types of packaging we can use in our restaurants; and claims we make about our sustainability practices and achievements; and

public company compliance, disclosure and governance matters, including accounting and tax regulations, SEC and NYSE disclosure requirements.

Compliance with these laws and regulations, and future new laws or changes in these laws or regulations that impose additional requirements, can be costly. Any failure or perceived failure to comply with these laws or regulations could result in, among other things, revocation of required licenses, administrative enforcement actions, fines and civil and criminal liability.

Risks Related to Our Growth and Business Strategy

If we are unable to meet our projections for new restaurant openings, or efficiently maintain the attractiveness of our existing restaurants, our profitability could suffer.

Our growth depends on our ability to open new restaurants at an aggressive rate and operate them profitably as soon as possible. In the past year, the cost of opening new restaurants has increased, due to construction labor inflation and increased costs of materials and equipment. Our timeline for completing construction also has gotten longer, due to landlord reluctance to commit to building in light of high interest rates, tight money supply and general economic conditions, and due to backlogs and long wait times for us to obtain required permits and utility hookups. In addition, we incur substantial startup expenses each time we open a new restaurant, and it can take up to 36 months to ramp up the sales and profitability of a new restaurant, during which time costs may be higher as we train new employees and build up a customer base. If we are unable to build the customer base that we expect or fail to overcome the higher startup expenses associated with new restaurants, our new restaurants may not be as profitable as our existing restaurants. Our ability to open and profitably operate new restaurants also is subject to various risks, such as the identification and availability of desirable locations; the negotiation of acceptable lease terms; the need to obtain all required governmental permits (including zoning approvals and liquor licenses) and comply with other regulatory requirements; the availability of capable contractors and subcontractors; increases in the cost and decreases in the availability of labor and building material; changes in weather, natural disasters, pandemics or other acts of God that could delay construction and adversely affect guest traffic; our ability to hire and train qualified management and restaurant employees; and general economic and business conditions. At each potential location, we compete with other restaurants and retail businesses for desirable development sites, construction contractors, management personnel, hourly employees and other resources. If we are unable to successfully manage these risks, we could face increased costs and lower than anticipated sales and earnings in future periods.

In addition, we continue to improve our existing restaurants through remodels, upgrades and regular upkeep. If the costs associated with remodels, upgrades or regular upkeep are higher than anticipated, restaurants are closed for remodeling for longer periods than planned or remodeled restaurants do not perform as expected, we may not realize our projected desired return on investment, which could have a negative effect on our operating results.

16

Our failure to effectively manage and support our growth could have a negative adverse effect on our business and financial results.

As of December 31, 2023, we owned and operated over 3,400 Chipotle restaurants and we plan to open a significant number of new restaurants in the next several years. Our existing restaurant management systems, back-office technology systems and processes, financial and management controls, information systems and personnel may not be adequate to support our continued growth. To effectively manage a larger number of restaurants, we may need to upgrade and expand our infrastructure and information systems, automate more processes that currently are manual or require manual intervention and hire, train and retrain restaurant employees and corporate support staff, all of which may result in increased costs and at least temporary inefficiencies. We also place a lot of importance on our culture, which we believe has been an important contributor to our success, and as we continue to grow it may be increasingly difficult to maintain our culture. Our failure to sufficiently invest in our infrastructure and information systems and maintain our strong staffing and culture could harm our brand and operating results.

If we partner with or acquire new businesses and third-party providers that do not align with our core values or that do not fulfill their contractual responsibilities and commitments, our brand reputation and international growth plans could suffer.

Our global growth strategy includes expanding our existing restaurant footprint and introducing Chipotle in new international jurisdictions in which we currently do not operate. The success of our strategy will depend on our identifying and partnering with new business partners, including licensees, joint venture partners, suppliers and distributors, and may include identifying suitable acquisition targets in these new jurisdictions that align with our core values. In 2023, we signed our first-ever development agreement to open restaurants in the Middle East in partnership with international franchise retail operator Alshaya Group, which will initially open new Chipotle restaurants in Dubai and Kuwait before expanding further across the region. Licensees like Alshaya, and future joint venture partners would be authorized to operate restaurants under the Chipotle brand, and we believe guests will expect the same quality of food and customer service in these third-party operated restaurants as they receive in Chipotle-operated restaurants. We provide extensive training to our business partners and we include specific food quality and safety standards and guest service requirements in the contracts we sign with our business partners; however, we do not have direct control over the restaurants operated by third-party partners, and the quality and service in those restaurants may be less than the quality and service of Chipotle-operated restaurants. Failure of our business partners to adhere to our high food quality and operating standards could damage our brand reputation and impair our international expansion plans. New partnerships and/or acquisitions also may divert management’s attention from other initiatives and/or day-to-day operations, which could adversely affect our business and results of operations.

The market price of our common stock may be more volatile than the market price of our peers.

We believe the market price of our common stock generally has traded at a higher price-earnings ratio than stocks of most of our peer companies as well as the overall market, which typically has reflected market expectations for higher future operating results. At any given point in time, our price-earnings ratio may trade at more than twice the price-earnings ratio of the S&P 500. Also, the trading market for our common stock has been volatile at times, including because of adverse publicity events. As a result, if we fail to meet market expectations for our operating results in the future, any resulting decline in the price of our common stock could be significant.

Risks Related to Sustainability Factors

We are subject to evolving public disclosure requirements and expectations, including with respect to sustainability matters, that could expose us to numerous risks and could adversely affect our reputation and results of operations.

We are subject to evolving disclosure obligations promulgated by governmental and regulatory organizations relating to sustainability factors that impact our business. These disclosure obligations are complex and not always consistent, making compliance difficult and uncertain. In addition, investors, guests and other stakeholders increasingly are focusing on sustainability matters and related disclosures. We have incurred and expect to continue to incur increased expenses and management time and attention to comply with these disclosure obligations and stakeholder expectations. For example, measuring Scope 1, 2 and 3 greenhouse gas emissions relating to our business, developing reduction plans and initiatives, and creating and disclosing achievable reduction goals can be costly, difficult and time consuming and is subject to evolving reporting standards, including California’s Climate Corporate Data Accountability Act, California’s Greenhouse Gases: Climate-Related Financial Risk Bill, the SEC’s proposed climate-related reporting requirements, and similar proposals by other local and international regulatory agencies. We may also communicate certain initiatives and goals regarding sustainability and human capital management related matters, such as diversity, responsible sourcing and social investments in our SEC filings or in other public disclosures. In November 2021, we announced that we had set science-based targets validated by the Science Based Targets Initiative to reduce absolute Scope 1, 2 and 3 greenhouse gas emissions 50% by 2030 from a 2019 base year, and achievement of this goal is subject to risks and uncertainties, many of which are outside of our control and may prove to be more difficult and costly than we anticipate.

17

In addition, statements about our sustainability-related initiatives and goals, and progress toward those goals, may be based on standards for measuring progress that are still developing, internal controls and processes that continue to evolve, and assumptions that are subject to change in the future. If we are unable to meet our sustainability-related goals or evolving stakeholder or industry expectations and standards, or if we are perceived to have not responded appropriately to the growing concern for sustainability issues, investors, guest and other stakeholders may choose to patronize a competitor that they perceive to be more responsive, and our reputation, business or financial condition may be adversely affected. If our sustainability-related data, processes and reporting are incomplete or inaccurate, or if we fail to achieve progress with respect to our sustainability goals on a timely basis, or at all, our reputation, business, financial performance and growth could be adversely affected.

In addition, we could be criticized by anti-ESG stakeholders for the scope or nature of our sustainability initiatives or goals or for any revisions to these goals. We could also be subjected to negative responses by governmental actors (such as anti-ESG legislation or retaliatory legislative treatment) or consumers (such as boycotts or negative publicity campaigns) that could adversely affect our reputation, business, financial performance and growth.

Climate change and volatile adverse weather conditions could adversely affect our restaurant sales or results of operations.

There is growing concern that climate change and global warming has caused and may continue to cause more severe, volatile weather or extended droughts, which could increase the frequency and duration of weather impacts on our operations. Adverse weather conditions have in the past and may again impact guest traffic at our restaurants and, in more severe cases such as hurricanes, tornadoes, wildfires or other natural disasters, cause temporary restaurant closures, all of which negatively impact our restaurant sales. In addition, our supply chain is subject to increased costs caused by the effects of climate change, diminishing energy and water resources. Increasing weather volatility and changes in global weather patterns can reduce crop size and crop quality, or destroy crops altogether, which could result in decreased availability or higher pricing for our produce and other ingredients. We may be forced to source ingredients from new geographic regions, which could impact quality and taste, and increase our costs. These factors are beyond our control and, in many instances, unpredictable. Climate change and government regulation relating to climate change also could result in construction delays for new restaurants and interruptions to the availability or increases in the cost of utilities. The ongoing and long-term costs of these impacts related to climate change and other sustainability-related issues could have a material adverse effect on our business and financial condition if we are not able to mitigate them.

General Risk Factors

Economic and business factors that are largely beyond our control may adversely affect consumer behavior and the results of our operations.

Restaurant dining generally is dependent upon consumer discretionary spending, which may be affected by general economic conditions that are beyond our control. Increasing or prolonged high inflation, international, domestic and regional economic conditions, consumer income levels, financial market volatility, a slow or stagnant pace of economic growth, mass layoffs, rising energy costs, rising interest rates, social unrest, military conflicts and governmental, political and budget concerns or divisions may have a negative effect on consumer confidence and discretionary spending. Persistent inflation and concern about a prolonged economic downturn may lead consumers to decrease their discretionary spending. A significant decrease in our guest traffic or average transactions would negatively impact our financial performance. The actual or perceived threat of a pandemic or communicable disease, terrorist attack, mass shooting, heightened security requirements, including cybersecurity, or a failure to protect information systems for critical infrastructure, such as the electrical grid and telecommunications systems, could harm our operations, the economy or consumer confidence generally. Any of the above factors or other unfavorable changes in business and economic conditions affecting our guests could increase our costs, reduce traffic in our restaurants or limit our ability to increase pricing, any of which could lower our profit margins and have a material adverse effect on our sales, financial condition and results of operations. These factors also could cause us to, among other things, reduce the number and frequency of new restaurant openings, close restaurants or delay remodeling of our existing restaurant locations. Further, poor economic conditions may force nearby businesses to shut down, which could reduce traffic to our restaurants or cause our restaurant locations to be less attractive.

18

Our quarterly financial results may fluctuate significantly, including due to factors that are not in our control.

Our quarterly financial results may fluctuate significantly and could fail to meet investors’ expectations for various reasons, including:

negative publicity about the safety of our food, employment-related issues, litigation or other issues involving our restaurants;

fluctuations in supply costs, particularly for our most significant ingredients, and our inability to offset the higher cost with price increases, without adversely impacting guest traffic;

our inability to purchase sufficient quantities of our key ingredients as our restaurant count grows;

labor availability and wages of restaurant management and employees;

increases in marketing or promotional expenses;

the timing of new restaurant openings and related revenues and expenses, and the operating costs at newly opened restaurants;

the impact of inclement weather and natural disasters, such as freezes and droughts, which could decrease guest traffic and increase the costs of ingredients;

the amount and timing of stock-based compensation;

litigation, settlement costs and related legal expenses;

tax expenses, asset impairment charges and non-operating costs; and

variations in general economic conditions, including the impact of rising inflation and the impact of rising interest rates on consumer demand trends.

As a result of any of these factors, results for any one quarter are not necessarily indicative of results to be expected for any other quarter or for any year. Average restaurant sales or comparable restaurant sales in any future period may decrease.