What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2026-03-03 compared with 2025-03-17 · 128 added, 96 removed, 408 unchanged (35% of the section changed)

31 unchanged sentences

As the healthcare industry consolidates, competition to provide products and services to industry participants has become and may continue to become more intense.

This may result in greater pricing pressures and the exclusion of certain suppliers from important markets as group purchasing organizations, independent delivery networks, and large single accounts continue to use their market power to consolidate purchasing decisions.

This may result in greater pricing pressures and the exclusion of certain suppliers from important markets such as group purchasing organizations, independent delivery networks, and large single accounts continuing to use their market power to consolidate purchasing decisions.

If a group purchasing organization excludes us from being one of their suppliers, our net sales could be adversely impacted.

We expect that market demand, government regulation, third-party reimbursement policies, and societal pressures will continue to change the worldwide healthcare industry, which may exert further downward pressure on the prices of our products and limit our access to sell our products and services to customers.

We expect that market demand, government regulation, third-party reimbursement policies, and societal pressure will continue to change the worldwide healthcare industry, which may exert further downward pressure on the prices of our products and limit our access to sell our products and services to customers.

A significant portion of our OA Pain Management revenues are derived from a small number of customers, the loss of which could materially adversely affect our business, financial condition and results of operations.

We have historically derived most of our revenues from a small number of customers who resell our products to end-users.

We have historically derived most of our revenue from a small number of customers who resell our products to end-users.

Many of these customers are significantly larger companies than us.

16 unchanged sentences

We rely on a small number of suppliers for certain key raw materials and components for the manufacturing and delivery of our products, and disruption could materially adversely affect our business, financial condition, and results of operations.

Although we believe that alternative sources for many of these and other components and raw materials that we use in our manufacturing processes are available, we cannot be certain that the supply of key raw materials will continue to be available at current levels or will be sufficient to meet our future needs.

Although we believe that alternative sources for many of the components and raw materials that we use in our manufacturing processes are available, we cannot be certain that the supply of key raw materials will continue to be available at current levels or will be sufficient to meet our future needs.

We continue to see impacts on our supply chain as the companies that produce our products, product components or otherwise support our manufacturing processes, the distribution centers where we manage our inventory, or the operations of our logistics and other service providers, including third parties that sterilize and store our products, were disrupted, temporarily closed or experienced worker shortages for a sustained period of time during and following the global pandemic or due to other supply chain disruptions.

3 unchanged sentences

Our manufacturing processes involve inherent risks, and disruption could materially adversely affect our business, financial condition, and results of operations.

We manufacture our global commercial supply from a single site located in Bedford, Massachusetts.

The operation of biomedical manufacturing plants involves many risks, including the risks of breakdown, failure, substandard performance of equipment, the inability of production runs to pass internal quality standards, the need to comply with the requirements of directives of government agencies, including the FDA, and the occurrence of natural and other disasters.

1 unchanged sentence

In addition, governmental agencies of the United States or other countries may impose new requirements regarding registration, labeling or prohibited materials that may require us to modify or re-register our devices once they are already on the market or otherwise impact our ability to market the devices in the United States or other countries.

For example, on February 2, 2024, the FDA published a final rule to amend its QSR requirements to align more closely with the international consensus standards for medical devices by converging with quality management system requirements used by other regulatory authorities from other countries.

Specifically, the final rule does so primarily by incorporating by reference the 2016 edition of the ISO 13485 standard is effective February 2, 2026.

If we are slow or unable to adapt to changes in existing requirements or the adoption of new requirements or policies, or if we are not able to maintain regulatory compliance, we may lose any marketing authorization that we may have obtained, which could have a material adverse effect on our business, prospects, results of operations, financial condition and our ability to achieve or sustain profitability.

The process of complying with these governmental regulations can be costly and time consuming, and could delay or prevent the production, manufacturing or sale of our products.

The process of complying with these government regulations can be costly and time-consuming, and could delay or prevent the production, manufacturing or sale of our products.

We could become subject to product liability claims, which, if successful, could materially adversely affect our business, financial condition, and results of operations.

5 unchanged sentences

We and our third-party providers are subject to national, international, federal or state laws and regulations, regulatory guidance and industry standards relating to data protection, privacy and information security.

This includes the European Union (“EU”), GDPR, and the United Kingdom (“UK”) equivalent of the same (the “UK GDPR” together with the EU GDPR, the “GDPR”), as well as other national data protection legislation in force in relevant European Economic Area (“EEA”) Member States and the UK (including the UK Data Protection Act 2018), which governs the collection, use, storage, disclosure, transfer, or other processing of personal data (including health data processed in the context of clinical trials):

This includes the EU, GDPR, and the United Kingdom (“UK”) equivalent of the same (the “UK GDPR” together with the EU GDPR, the “GDPR”), as well as other national data protection legislation in force in relevant European Economic Area (“EEA”) Member States and the UK (including the UK Data Protection Act 2018), which governs the collection, use, storage, disclosure, transfer, or other processing of personal data (including health data processed in the context of clinical trials):

(i) regarding individuals in the EEA and UK;

1 unchanged sentence

The GDPR is wide-ranging in scope and imposes numerous additional requirements on companies that process personal data, including imposing special requirements in respect of the processing of special categories of personal data (such as health and data), relying on a legal basis or condition for processing personal data, where required, requiring that consent of individuals to whom the personal data relates, requiring information disclosures to individuals regarding data processing activities, requiring that safeguards are implemented to protect the security and confidentiality of personal data, creating mandatory data breach notification requirements in certain circumstances, requiring data protection impact assessments for high risk processing and requiring that certain measures (including contractual requirements) are put in place when engaging third-party processors.

The GDPR also provide individuals with various rights in respect of their personal data.

The GDPR also provides individuals with various rights in respect of their personal data.

The definition of personal data under GDPR is defined broadly and includes pseudonymized or coded data;

4 unchanged sentences

On June 4, 2021, the European Commission issued new forms of SCCs for data transfers from controllers or processors in the EEA (or otherwise subject to the EU GDPR) to controllers or processors established outside the EEA (and not subject to the EU GDPR).

The new SCCs replace the SCCs that were adopted previously under the Data Protection Directive.

The UK is not subject to the EC’s new SCCs but has published its own standard clauses, the International Data Transfer Agreement, which enables transfers from the UK.

7 unchanged sentences

Given the breadth and depth of changes in data protection obligations, complying with the GDPR and similar laws’ requirements are rigorous and time intensive and require significant resources and a review of our technologies, systems and practices, as well as those of any third-party service providers, contractors or consultants that process or transfer personal data.

Although the EU GDPR and the UK GDPR currently impose substantially similar obligations, it is possible that over time the UK GDPR could become less aligned with the EU GDPR, particularly with the UK plans to reform the country’s data protection legal framework in the new Data (Use and Access) Bill introduced into the UK legislative process.

The UK’s data protection regime is independent from but aligned to the EU’s data protection regime.

Although the UK is regarded as a third country under the EU’s GDPR, the European Commission has now issued an adequacy decision recognizing the UK as providing adequate protection under the EU GDPR and, therefore, transfers of personal data originating in the EEA to the UK remain unrestricted.

In December 2025, the European Commission adopted a decision to extend the validity of the UK adequacy decision for six years until December 2031, determining that the UK continues to offer a level of data protection that is “essentially equivalent” to the EU standards.

This follows the UK’s adoption of the Data (Use and Access) Act 2025 on 19 June 2025.

Like the EU GDPR, the UK GDPR restricts personal data transfers outside the UK to countries not regarded by the UK as providing adequate protection.

The UK Government has confirmed that personal data transfers from the UK to the EEA remain free flowing.

In addition, EEA Member States have adopted implementing national laws to implement the GDPR which may partially deviate from the GDPR and the competent authorities in the EEA Member States may interpret GDPR obligations slightly differently from country to country, so that we do not expect to operate in a uniform legal landscape in the EEA and UK with respect to data protection regulations.

1 unchanged sentence

The lack of clarity on future UK laws and regulations and their interaction with EU laws and regulations could add legal risk, uncertainty, complexity and compliance cost to the handling of European personal data and our privacy and data security compliance and could require us to amend our processes and procedures to implement different compliance measures for the UK and the EEA.

In the United States, numerous federal and state laws and regulations, including federal health information privacy laws, state data breach notification laws, state health information privacy laws and federal and state consumer protection laws that govern the collection, use, disclosure and protection of health-related and other personal information could apply to our operations or the operations of our collaborators and third-party providers.

For example, California enacted the California Consumer Privacy Act (“CCPA”).

This law, which became effective on January 1, 2020 gives California residents expanded rights to access and delete their personal information, opt out of certain personal information sharing and receive detailed information about how their personal information is used.

It also provides for civil penalties for violations, as well as a private right of action for data breaches that are expected to increase data breach litigation.

At this time, we do not collect personal data on residents of California but should we begin to do so, and in the context of doing so, become subject to the CCPA, the CCPA will impose new and burdensome privacy compliance obligations on our business and will raise new risks for potential fines and class actions.

In addition, the California Privacy Rights Act (“CPRA”) which became effective on January 1, 2023, imposes additional obligations on companies covered by the legislation and significantly modifies the CCPA, including by expanding consumers’ rights with respect to certain sensitive personal information.

The CPRA also created a new state agency that was vested with authority to implement and enforce the CCPA.

The effects of the CCPA are potentially significant and, should we begin to process personal information concerning California residents may require us to modify our data collection or processing practices and policies and to incur substantial costs and expenses in an effort to comply and increase our potential exposure to regulatory enforcement and/or litigation.

That the CCPA marked the beginning of a trend toward more stringent privacy legislation in the United States, which has increased our potential liability and may adversely affect our business.

New consumer privacy laws similar to the CCPA have been passed and proposed in numerous other states.

Such proposed legislation, if enacted, may add additional complexity, variation in requirements, restrictions and potential legal risk, require additional investment of resources in compliance programs, impact strategies and the availability of previously useful data and could result in increased compliance costs and/or changes in business practices and policies.

The existence of comprehensive privacy laws in different states in the country would make our compliance obligations more complex and costly and may increase the likelihood that we may be subject to enforcement actions or otherwise incur liability for noncompliance.

In addition to these comprehensive laws and proposals, several other states have passed or proposed more limited privacy laws focused on particular privacy issues.

For example, Washington’s My Health My Data Act, which became effective on March 31, 2024, regulates the collection and sharing of health information and has a private right of action, further increasing relevant compliance risk.

Connecticut and Nevada have also passed similar laws regulating consumer health data.

In addition, a small number of states have also passed laws that regulate biometric data specifically.

These various privacy and security laws may impact our business activities, including our identification of research subjects, relationships with business partners and ultimately the marketing and distribution of our products.

State laws are changing rapidly and there is discussion in the U.S.

Congress of a new comprehensive federal data privacy law to which we may likely become subject, if enacted.

In addition, many jurisdictions around the world have adopted legislation that regulates how businesses operate online and enforces information security, including measures relating to privacy, data security and data breaches.

Many of these laws require businesses to notify data breaches to the regulators and/or data subjects.

These laws are not consistent, and compliance in the event of a widespread data breach is costly and burdensome.

In many jurisdictions, enforcement actions and consequences for non-compliance with protection, privacy and information security laws and regulations are rising.

In the EEA and the UK, data protection authorities may impose large penalties for violations of the data protection laws, including potential fines of up to €20 million (£17.5 million in the UK) or 4% of annual global revenue, whichever is greater.

The authorities have shown a willingness to impose significant fines and issue orders preventing the processing of personal data on non-compliant businesses.

Data subjects also have a private right of action, as do consumer associations, to lodge complaints with supervisory authorities, seek judicial remedies, and obtain compensation for damages resulting from violations of applicable data protection laws.

In the United States, possible consequences for non-compliance include enforcement actions in response to rules and regulations promulgated under the authority of federal agencies and state attorneys general and legislatures and consumer protection agencies.

The risk of our being found in violation of these laws is increased by the fact that the interpretation and enforcement of them is not entirely clear.

Efforts to ensure that our business arrangements with third parties will comply with applicable healthcare laws and regulations will involve substantial costs.

Any action against us for violation of these laws, even if we successfully defend against it, could cause us to incur significant legal expenses and divert our management’s attention from the operation of our business.

The shifting compliance environment and the need to build and maintain robust and expandable systems to comply with multiple jurisdictions with different compliance and/or reporting requirements increases the possibility that a healthcare company may run afoul of one or more of the requirements.

Failure to comply with the requirements of the GDPR and the related national data protection laws of the EEA Member States and the UK may result in fines up to €20 million (£17.5 million for the UK GDPR) or 4% of a company’s global annual revenues for the preceding financial year, whichever is higher.

The GDPR also confers a private right of action on data subjects and consumer associations to lodge complaints with supervisory authorities, seek judicial remedies, and obtain compensation for damages resulting from violations of the GDPR.

In the United States, numerous federal and state laws and regulations, including health information privacy laws, state data breach notification laws, and federal and state consumer protection laws that govern the collection, use, disclosure and protection of health-related and other personal information could apply to our operations or the operations of our collaborators and third-party service providers.

For example, the California Consumer Privacy Act (“CCPA”), grants California consumers (as defined in the law) individual privacy rights, including the rights to access, correct and delete their personal information, opt out of certain personal information sharing and receive detailed notice about how their personal information is used or shared.

In addition, the California Privacy Rights Act (“CPRA”) significantly modified the CCPA, including by expanding consumers’ rights with respect to certain sensitive personal information and created a state agency vested with authority to enforce the CCPA.

The CCPA also provides for a private right of action for certain data breaches.

The effects of the CCPA are potentially significant and may require us to modify our data collection or processing practices and policies and to incur substantial costs and expenses in an effort to comply.

The CCPA marked the beginning of a trend toward more stringent privacy legislation at the state level.

As of January 2026, 19 other U.S.

states have also enacted or are considering similar omnibus privacy legislation similar to the CCPA.

The existence of comprehensive privacy laws in different states in the country, which vary in their requirements and enforcement, may make our compliance obligations more complex and costly and may increase the likelihood that we become subject to litigation, enforcement actions or otherwise incur liability actual or perceived for noncompliance.

In addition to these comprehensive state privacy laws, other states, including Washington, Connecticut and Nevada, have passed laws that apply more stringent standards to consumer health information.

Most notably, Washington’s My Health My Data Act regulates the collection and sharing of consumer health information and has a private right of action, further increasing relevant compliance risk.

In addition, a smaller number of states have passed laws that regulate biometric data specifically.

The increasingly complex landscape of privacy and security laws may impact our business activities, including our identification of research subjects, relationships with business partners and ultimately the marketing and distribution of our products.

State laws are changing rapidly and industry organizations regularly adopt and advocate for new standards in these areas.

Regulators and legislators in the U.S.

are increasingly scrutinizing and restricting certain personal data transfers and transactions involving foreign countries.

For example, the Department of Justice’s January 8, 2025, Rule on Preventing Access to U.S.

Sensitive Personal Data and Government-Related Data by Countries of Concern or Covered Persons, prohibits transfers of data, including health data, genetic data, and biospecimens, to countries of concern, including China.

The regulations also restrict certain investment agreements, employment agreements and vendor agreements involving such data and countries of concern, absent specified cybersecurity controls.

Actual or alleged violations of these regulations may be punishable by criminal and/or civil sanctions and may result in exclusion from participation in federal and state programs and could restrict our ability to use certain vendors, sites, investigators, or service providers in clinical trials.

The shifting compliance environment and the need to build and maintain robust and expandable systems to comply with privacy and security laws in multiple jurisdictions increases our compliance risk.

Any action against us for violation of these laws, even if we successfully defend against it, could cause us to incur significant legal expenses, divert our management’s attention from the operation of our business, and lead to reputational damage and loss of current and future business, any of which may have a material adverse effect on our business.

Compliance with data protection laws and regulations could require us to take on more onerous obligations in our contracts, restrict our ability to collect, use and disclose data, or in some cases, impact our ability to operate in certain jurisdictions.

3 unchanged sentences

The use of new and evolving technologies, such as artificial intelligence, in our business may result in spending material resources and presents risks and challenges that can impact our business including by posing security and other risks to our confidential and/or proprietary information, including personal information, and as a result we may be exposed to reputational harm and liability.

We may use and integrate artificial intelligence into our business processes, and this innovation presents risks and challenges that could affect its adoption, and therefore our business.

If we enable or offer solutions that draw controversy due to perceived or actual negative societal impact, we may experience brand or reputational harm, competitive harm or legal liability.

The use of certain artificial intelligence technology can give rise to intellectual property risks, including compromises to proprietary intellectual property and intellectual property infringement.

Additionally, we expect to see increasing government and supranational regulation related to artificial intelligence use and ethics, which may also significantly increase the burden and cost of research, development and compliance in this area.

For example, the EU’s Artificial Intelligence Act (“AI Act”) — the world’s first comprehensive AI law — which has entered into force on August 1, 2024 and most provisions of which will become effective on August 2, 2026.

This legislation imposes significant obligations on providers and deployers of high-risk artificial intelligence systems and encourages providers and deployers of artificial intelligence systems to account for EU ethical principles in their development and use of these systems.

If we develop or use AI systems that are governed by the AI Act, it may necessitate ensuring higher standards of data quality, transparency, and human oversight, as well as adhering to specific and potentially burdensome and costly ethical, accountability, and administrative requirements.

The rapid evolution of artificial intelligence will require the application of significant resources to design, develop, test and maintain our products and services to help ensure that artificial intelligence is implemented in accordance with applicable law and regulation and in a socially responsible manner and to minimize any real or perceived unintended harmful impacts.

Our vendors may in turn incorporate artificial intelligence tools into their offerings, and the providers of these artificial intelligence tools may not meet existing or rapidly evolving regulatory or industry standards, including with respect to privacy and data security.

Further, bad actors around the world use increasingly sophisticated methods, including the use of artificial intelligence, to engage in illegal activities involving the theft and misuse of personal information, confidential information and intellectual property.

Any of these effects could damage our reputation, result in the loss of valuable property and information, cause us to breach applicable laws and regulations, and adversely impact our business.

We may use and integrate artificial intelligence (“AI”) into our business processes, and this innovation presents risks and challenges that could affect its adoption, and therefore our business.

The use of AI presents risks and challenges that could adversely affect our business and reputation, including cybersecurity, data privacy, IT, confidentiality, regulatory, legal, operational, competitive, reputational, intellectual property and other risks.

Specifically, risks related to accuracy, bias, AI hallucinations, discrimination, harmful content, misinformation, fraud, scams, targeted attacks (including model poisoning or data poisoning), surveillance, data leakage, bias and inequality, environmental and other harms may flow from our development or use of AI technologies.

For example, use of certain AI tools may increase the risk of unauthorized disclosure of confidential information, compromise of proprietary intellectual property, or inadvertent inclusion of third-party intellectual property or other protected material, which could result in disputes or claims of infringement.

Additionally, government and supranational regulation related to AI is evolving as new laws and regulations are implemented globally and could increase the operational cost of compliance, including through requirements related to transparency, accountability, risk management, human oversight, and data governance.

We expect to see increasing regulation related to AI governance, use and ethics, which may also significantly increase the burden and cost of research, development and compliance in this area.

For example, the EU’s Artificial Intelligence Act (“AI Act”) — the world’s first comprehensive AI law —entered into force on August 1, 2024, with most important provisions scheduled to become effective on August 1, 2026.

As currently enacted, the AI Act imposes significant obligations on providers and deployers of high-risk AI systems and general purpose AI models, and encourages providers and deployers of AI systems to account for EU ethical principles when developing and using AI technology.

The scope of requirements depends on legal and risk determinations that rely on novel legal provisions that have not yet been fully interpreted by courts or regulators, and non-compliance can lead to significant fines.

In the U.S., the regulatory environment is complex and uncertain.

Over the past year, states have advanced, and in some cases passed, dozens of laws focusing on AI governance and regulation, including deployment of AI in healthcare settings.

At the Federal level, the current executive administration has endorsed a federal moratorium on the enforcement of state AI laws, including through a December 11, 2025, executive order on “Ensuring a National Policy Framework for Artificial Intelligence.” So far, these efforts have not been successful at curtailing state action on AI regulation, contributing to a complicated legislative patchwork, which may be litigated in state and federal courts.

In addition, there is continued uncertainty regarding the application of existing federal and state legal frameworks to uses and development of AI, and legal norms and market standards regarding AI continue to evolve.

For example, various federal and state regulators have issued guidance and focused enforcement efforts on the use of AI in regulated sectors.

The FDA, for example, issued guidance on the use of artificial intelligence in medical devices, requiring detailed risk management and review processes to obtain approvals.

The FDA has further issued, for example, draft guidance on the use of AI in regulatory decision-making for drug and biological products that centers on the context of use while establishing a credibility assessment framework for establishing and evaluating AI model outputs intended to support regulatory decision-making.

If we develop or use AI systems that are governed by these laws or regulations, including as informed by regulatory guidance, we will need to meet higher standards of data quality, transparency, and human oversight, and we would need to adhere to specific, potentially burdensome and costly ethical, accountability, and administrative requirements.

We may also be subject to significant enforcement or litigation in the event of any perceived non-compliance.

The rapid evolution of AI will require the application of significant resources to design, develop, test and maintain our products and services to help ensure that AI is implemented in accordance with applicable law and regulation and in a socially responsible manner and to minimize any real or perceived unintended harmful impacts.

Our vendors may in turn incorporate AI tools into their offerings, and the providers of these AI tools may not meet existing or rapidly evolving regulatory or industry standards, including with respect to privacy and data security.

Further, bad actors around the world use increasingly sophisticated methods, including the use of AI, to engage in illegal activities involving theft and misuse of personal information, confidential information and intellectual property.

In addition, the use of generative AI models in our internal or third-party systems may create new attack surfaces or methods for adversaries, which could impact us and our vendors.

Any of these effects could damage our reputation, result in the loss of valuable property and information, cause us to breach applicable laws and regulations, and adversely impact our business, financial condition and results of operation.

We are increasingly dependent on sophisticated information technology and if we fail to effectively maintain or protect our information systems or data, including from data security incidents or breaches, our business could be adversely affected.

We are increasingly dependent on sophisticated information technology for our products and infrastructure.

As a result of technology initiatives, recently enacted regulations, changes in our system platforms and integration of new business acquisitions, we have been consolidating and integrating the number of systems we operate and have upgraded and expanded our information systems capabilities.

As a result of technological initiatives, recently enacted regulations, changes in our system platforms and integration of new business acquisitions, we have been consolidating and integrating the number of systems we operate and have upgraded and expanded our information systems capabilities.

We also have outsourced elements of our operations to third parties, and, as a result, we manage a few third-party suppliers who may or could have access to our confidential intellectual property or business information.

5 unchanged sentences

Although we devote resources to protect our information systems, we realize that cyberattacks, cyber intrusions and other disruptions are a threat, and there can be no assurance that our efforts will prevent information security incidents or breaches that would result in business, legal, financial or reputational harm to us, or would have a material adverse effect on our business, financial condition, results of operations and prospects.

We may not be able to anticipate all types of security threats, nor may we be able to implement preventive measures effective against all such security threats.

We may not be able to anticipate all types of security threats, nor may we be able to implement preventive measures to be effective against all such security threats.

The techniques used by cyber criminals change frequently, may not be recognized until launched and can originate from a wide variety of sources, including insider threats and outside groups such as external service providers, organized crime affiliates, terrorist organizations or hostile foreign governments or agencies, or generated using artificial intelligence.

1 unchanged sentence

We rely on our third-party providers to implement effective security measures and identify and correct for any such failures, deficiencies or data security incidents or breaches.

Any data security incident or breach in our or our third-party providers’ information technology systems could lead to the unauthorized access, disclosure and use of non-public information, including protected health information and other personally identifiable information which is protected by HIPAA, and other laws.

Any data security incident or breach in our or our third-party providers’ information technology systems could lead to unauthorized access, disclosure and use of non-public information, including protected health information and other personally identifiable information which is protected by HIPAA, and other laws.

Any such access, disclosure, or other loss of information could result in legal claims or proceedings, liability under laws that protect the privacy of personal information, damage to our reputation and the further development and commercialization of our products could be delayed.

3 unchanged sentences

While we maintain insurance at levels that we believe are appropriate for our business, this coverage may not be sufficient in type or amount to cover us against all claims related to data security incidents, breaches or other interruptions.

Any compromise to our information security or that of our third-party service providers or contractors could result in an interruption in our operations, the unauthorized publication of our confidential business or proprietary information, the unauthorized release, use, disclosure and/or dissemination of customer, vendor, or employee data, the violation of privacy and/or data protection laws, including under the GDPR, in the European Union or the UK, or other laws and exposure to litigation, any of which could harm our business and operating results.

Any compromise to our information security or that of our third-party service providers or contractors could result in an interruption in our operations, the unauthorized publication of our confidential business or proprietary information, the unauthorized release, use, disclosure and/or dissemination of customer, vendor, or employee data, the violation of privacy and/or data protection laws, including under the GDPR, in the EU or the UK, or other laws and exposure to litigation, any of which could harm our business and operating results.

Our contracts may not contain limitations of liability, and even where they do, there can be no assurance that limitations of liability in our contracts are sufficient to protect us from liabilities, damages, or claims related to our privacy and data security obligations.

3 unchanged sentences

We may face circumstances in the future that will result in impairment charges, including, but not limited to, goodwill impairment, intangible assets impairment and in-process research and development charges.

If the fair value of any of our long-lived assets decrease as a result of an economic slowdown, a downturn in the markets where we sell products and services, a downturn in our stock price, financial performance or future outlook, or other reasons, we may be required to record an impairment charge on such assets.

If the fair value of any of our long-lived assets decreases as a result of an economic slowdown, a downturn in the markets where we sell products and services, a downturn in our stock price, financial performance or future outlook, or other reasons, we may be required to record an impairment charge on such assets.

We are required to test intangible assets with indefinite life periods for potential impairment annually and on an interim basis if there are indicators of a potential impairment.

4 unchanged sentences

We have experienced a number of management changes in recent years, and there can be no assurances that any future management changes will not adversely affect our business.

Effective February 1, 2026, we had a transition in our President and Chief Executive Officer (“CEO”) role, in which Cheryl Blanchard became Executive Chair of our Board of Directors and she was replaced as President and CEO by Stephen Griffin, who had been Executive Vice President, Chief Financial Officer and Chief Operating Officer.

This transition in our CEO role may disrupt our operations, create uncertainty among employees and investors, and result in changes to our strategic direction.

We believe that our future success will depend in large part upon our ability to attract and retain technical and highly skilled executive, managerial, professional, and technical personnel.

22 unchanged sentences

Further expanding our business in international markets.

To the extent funds generated from our operations, together with our existing capital resources, are insufficient to meet future requirements, we will be required to obtain additional funds through equity or debt financings, through strategic alliances with corporate partners and others, or through other sources.

To the extent funds generated from our operations, together with our existing capital resources, are insufficient to meet future requirements, we will be required to obtain additional funds through equity or debt financing, through strategic alliances with corporate partners and others, or through other sources.

The terms of any future equity financing may be dilutive to our investors, and the terms of any debt financing may contain restrictive covenants, which limit our ability to pursue certain courses of action.

15 unchanged sentences

taxation of such activities may impact our effective tax rate, result in higher tax payments and harm our business, financial condition, cash flows and results of operations.

Substantial changes to U.S.

tax law may adversely affect our business.

On July 4, 2025, tax reform legislation included in the One Big Beautiful Bill Act (the “OBBBA”) was enacted in the United States.

Key corporate tax provisions include the restoration of 100% bonus depreciation, allowing for the potential for immediate expensing of domestic research and experimental expenditures, changes to Section 163(j) interest limitations, updates to Global Intangible and Low-Taxed Income (“GILTI”) and Foreign Derived Intangible Income (“FDII”) rules, amendments to energy credits, and expanded Section 162(m) aggregation requirements.

We have evaluated the elective provisions allowed under the new U.S.

tax legislation and accounted for tax deductions for bonus depreciation and research and development expenses allowed under the new legislation.

Other changes enacted did not have a material impact to our financial statements.

Adverse developments affecting the financial services industry, such as actual events or concerns involving liquidity, defaults, or non-performance by financial institutions or transactional counterparties, could adversely affect the Company ’ s current and projected business operations and its financial condition and results of operations.

1 unchanged sentence

If any of our customers, suppliers or other parties with whom we conduct business are unable to access funds pursuant to lending arrangements with financial institutions, such parties’ ability to pay their obligations to us or to enter into new commercial arrangements requiring additional payments to us could be adversely affected.

Although we assess our banking and customer relationships as we believe necessary or appropriate, our access to funding sources and other credit arrangements in amounts adequate to finance or capitalize our current and projected future business operations could be significantly impaired by factors that affect the Company, the financial institutions with which the Company has credit agreements or arrangements directly, or the financial services industry or economy in general.

Although we assess our banking and customer relationships as we believe necessary or appropriate, our access to funding sources and other credit arrangements in amounts adequate to finance or capitalize our current and projected future business operations could be significantly impaired by factors that affect us, the financial institutions with which we have credit agreements or arrangements directly, or the financial services industry or economy in general.

These factors could include, among others, events such as liquidity constraints or failures, the ability to perform obligations under various types of financial, credit or liquidity agreements or arrangements, disruptions or instability in the financial services industry or financial markets, or concerns or negative expectations about the prospects for companies in the financial services industry.

8 unchanged sentences

Termination of cash management arrangements and/or delays in accessing or actual loss of funds subject to cash management arrangements.

The impact of the Russian invasion of Ukraine and the conflict in the Middle East on the global economy, energy supplies and raw materials is uncertain, but may prove to negatively impact our business and operations.

The short and long-term implications of Russia’s invasion of Ukraine and the conflict in the Middle East are difficult to predict at this time.

The impact of the ongoing conflict between Russia and Ukraine and the conflict in the Middle East on the global economy, energy supplies and raw materials is uncertain, but may prove to negatively impact our business and operations.

The short and long-term implications of the ongoing conflict between Russia and Ukraine and the conflict in the Middle East are difficult to predict at this time.

We continue to monitor any adverse impact that the outbreak of war in Ukraine, the subsequent institution of sanctions against Russia by the United States and several European and Asian countries, and the conflict in the Middle East may have on the global economy in general, on our business and operations and on the businesses and operations of our suppliers and other third parties with which we conduct business.

8 unchanged sentences

and constraints, volatility, or disruption in the capital markets, any of which could negatively affect our business and financial condition.

Congress, the Trump administration, or any new administration may make substantial changes to fiscal, tax and other federal policies that may adversely affect our business.

In 2017, the U.S.

Congress and the Trump administration made substantial changes to U.S.

policies, which included comprehensive corporate and individual tax reform.

In addition, the Trump administration called for significant changes to U.S.

trade, healthcare, immigration and government regulatory policy.

With the transition to the Biden administration in early 2021, changes to U.S.

policy occurred and since the start of the Trump Administration in 2025, U.S.

policy changes have been implemented at a rapid pace and additional changes are likely.

Significant political, trade, regulatory developments, and other circumstances beyond our control, could have a material adverse effect on our financial condition or results of operations.

Significant political, trade, or regulatory developments, such as those stemming from changes in the U.S.

federal administration, are difficult to predict and may have a material adverse effect on us, as we both import materials and equipment necessary to manufacture our products in the U.S., and export materials and products from the U.S.

Similarly, changes in U.S.

federal policy that affect the geopolitical landscape could give rise to circumstances outside our control that could have negative impacts on our business operations.

Changes to U.S.

policy implemented by the U.S.

Congress, the Trump administration or any new administration have impacted and may in the future impact, among other things, the U.S.

Congress, the current administration or any new administration have impacted and may in the future impact, among other things, the U.S.

and global economy, international trade relations, unemployment, immigration, healthcare, taxation, the U.S.

regulatory environment, inflation and other areas.

Although we cannot predict the impact, if any, of these changes to our business, they could adversely affect our business.

Until we know what policy changes are made, whether those policy changes are challenged and subsequently upheld by the court system and how those changes impact our business and the business of our competitors over the long term, we will not know if, overall, we will benefit from them or be negatively affected by them.

For example, certain governments (including the United States and other countries) have imposed or may impose tariffs on a wide range of products, raw materials, and intermediate goods, including on products that we purchase from certain key suppliers.

Additional tariffs, or retaliatory measures by other countries in response, may be implemented at any time.

Historically, tariffs have led to increased trade and political tensions.

In response to tariffs, other countries have implemented retaliatory tariffs on U.S.

Political tensions as a result of trade policies could reduce trade volume, investment, technological exchange, and other economic activities between major international economies, resulting in a material adverse effect on global economic conditions and the stability of global financial markets.

Any changes in political, trade, regulatory, and economic conditions, including U.S.

trade policies, could have a material adverse effect on our financial condition or results of operations.

Until we know what policy changes are made, whether those policy changes are challenged and subsequently upheld by the court system, the duration that those policy changes remain in effect, and how those changes impact our business and the business of our competitors over the long term, we will not know if, overall, we will benefit from them or be negatively affected by them.

Risks Related to Our Commercialization Activities

3 unchanged sentences

As J&J MedTech accounts for a large percentage of our revenue and has unilateral decision-making authority over in-market activities, including end-user pricing and discounts, reimbursement strategy, and overall promotion strategy, actions taken by J&J MedTech impact our ability to predict and generate revenue and have a material impact on our business, financial condition, and results of operations.

In October 2025, J&J MedTech announced that it planned to divest its orthopedics implants and related surgical products business which would include Monovisc and Orthovisc products that we manufacture.

This action by J&J MedTech could impact our ability to predict and generate revenue and have a material impact on our business, financial condition, and results of operations.

We may not succeed in our buildout of our direct sales channel in the United States, and our failure to do so could negatively impact our business and financial results.

Beginning in 2019, we started selling and marketing many of our products directly to customers, including hospitals and ASCs, through our direct Anika sales team and large network of independent third-party distributors.

Beginning in 2019, we started selling and marketing many of our products directly to customers, including hospitals and ASCs, through our direct Anika sales team and a network of independent third-party distributors.

This approach was a departure from our historical distribution model in the United States, and we cannot be certain that we will be successful in implementing and executing on this commercial approach or that, even if we are able to implement it, the approach will be successful at scale.

14 unchanged sentences

In addition, we cannot be certain that payers who currently provide reimbursement for our products or procedures that use our products will continue to provide such reimbursement in the future, and such payer decisions could negatively impact the sales of our current or future products.

Even when our products or procedures that use our products are covered by third-party payers, reimbursement may be subject to significant administrative requirements, including prior authorization, claims documentation, and utilization management processes.

Payers may delay, deny, or reduce payment for administrative or technical reasons, or may require providers to pursue appeals or resubmissions, which can be costly and time-consuming.

Such delays or denials may discourage providers from purchasing or administering our products and could negatively impact sales, cash flows, and operating results.

In addition, third-party payers are increasingly attempting to contain the costs of health care products and services by limiting both coverage and the level of reimbursement for new therapeutic products and by refusing, in some cases, to provide coverage for uses of approved products for disease indications for which the FDA, or the applicable foreign regulatory agency, has granted marketing approval.

14 unchanged sentences

marketing approval for Cingal.

In 2019, we began the design of our third Phase III clinical trial to enable us to evaluate our full-scale Phase III clinical trial design, including patient and site selection criteria, and increase the probability of success for the Phase III trial.

In 2022, we completed this third Phase III clinical trial, which achieved its primary endpoint.

2 unchanged sentences

regulatory approval.

We acquired the Aristospan NDA s in September 2024 to assist with our Cingal regulatory filing with the FDA.

In parallel, we are exploring the potential to advance Cingal through commercial partnerships in the U.S.

1 unchanged sentence

Other unforeseen future developments could have a substantial negative impact on the timeline for and the cost associated with a potential Cingal regulatory approval, our overall business condition, financial results, and competitive position could be affected.

We also are conducting our clinical trial to support approval in the United States for Hyalofast, our single-stage, off-the-shelf, cartilage repair therapy, currently sold only outside the United States.

We have fully enrolled the 200 patients targeted in the trial.

This pivotal trial has a two-year follow-up protocol expected to be achieved in early 2025 before regulatory submission is completed.

We have filed the first two modules as part of a modular PMA which is the first step in seeking FDA approval for Hyalofast in the United States.

The final module of the PMA will be filed in 2025 once the clinical data becomes available to be submitted to the FDA.

We may experience difficulties or delays in securing regulatory approval for Hyalofast, which could negatively affect our business and financial results.

In July 2025, we announced topline results from our U.S.

pivotal FastTRACK Phase III trial of Hyalofast, our single-stage, off-the-shelf, cartilage repair therapy, currently sold only outside the United States.

This trial failed to achieve the pre-specified co-primary endpoints, although it did demonstrate consistent improvements in treated patients across all measures of pain and function relative to microfracture.

Based on this clinical and other data, we submitted a PMA on October 31, 2025, with the FDA for Hyalofast.

As expected, we received in January 2026 a deficiency letter from the FDA informing us that the Hyalofast PMA lacks information needed to complete its review.

Among other things, the letter addressed matters related to chemistry, manufacturing and controls (CMC) and the statistical analysis plan for both primary and secondary endpoints and whether any of these endpoints achieved statistical significance.

We plan to continue to engage with the FDA to explore potential approaches to address the FDA’s concerns so that it might complete its review.

Although there can be no assurance that we will be able to fully address the FDA’s concerns, we continue to believe the totality of evidence presented in this study and the data from outside the United Sates demonstrates the clinical value of Hyalofast.

Although we believe the totality of the data may be sufficient to support approval, there can be no assurance that the FDA will agree.

Failure to achieve the pre-specified co-primary endpoints in the trial could materially negatively impact our ability to obtain regulatory approval or delay a decision by FDA.

Moreover, the FDA may determine that any post hoc analyses or alternative endpoints we propose are not sufficient to support approval.

Although the FDA may have used similar endpoints for other cartilage repair product approvals in the past, there can be no assurance they will apply the same standards in this case because, among other factors, these endpoints used by the FDA were not part of our original trial design.

If the FDA’s review of this submission is delayed, or if we fail to achieve regulatory approval for this product candidate, it would have a material adverse effect on our future revenue and adversely impact our business and financial results, including impairment of our in-process research and development intangible asset.

Any unforeseen developments or delays could have a substantial negative impact on the timeline for and the cost associated with a potential Hyalofast regulatory approval, and our overall business condition, financial results, and competitive position could be affected.

5 unchanged sentences

In addition to regulations enforced by the FDA, we are subject to other existing and future federal, state, local, and foreign regulations applicable to product clearance or approval, which may vary significantly across jurisdictions.

Additional clearance or approval of existing products may be required when changes to such products may affect the safety and effectiveness, including for new indications for use, labeling changes, process or manufacturing changes, the use of a different facility to manufacture, process or package the product, and changes in performance or design specifications.

Additional clearance or approval of existing products may be required when changes to such products may affect safety and effectiveness, including for new indications for use, labeling changes, process or manufacturing changes, the use of a different facility to manufacture, process or package the product, and changes in performance or design specifications.

For our devices that are subject to 510(k) clearances, the FDA requires device manufacturers to make a determination of whether a modification requires a clearance;

13 unchanged sentences

Our operations and products are subject to extensive regulation, compliance with which is costly and time consuming, and our failure to comply may result in substantial penalties, including recalls of our products.

The FDA and foreign regulatory bodies impose extensive regulations applicable to our operations and products, including regulations governing product and sterilization standards, packaging requirements, labeling requirements, adverse event reporting, quality system and manufacturing requirements, import restrictions, tariff regulations, duties, and tax requirements.

The FDA and foreign regulatory bodies impose extensive regulations applicable to our operations and products, including regulations governing product and sterilization standards, packaging requirements, labeling requirements, adverse event reporting, quality management system and manufacturing requirements, import restrictions, tariff regulations, duties, and tax requirements.

The FDA and other foreign regulatory bodies worldwide conduct periodic inspections of our facilities to determine compliance with the FDA’s requirements and all comparable foreign regulations.

18 unchanged sentences

We secured certification extensions for several products in accordance with EU MDR transitional guidance.

We have achieved MDR certification for Monovisc and Hyalofast, and have other products’ submissions either under review, or planned to meet updated certification deadlines.

We have achieved EU MDR certification for Monovisc and Hyalofast, and have other products’ submissions either under review, or planned to meet updated certification deadlines.

Compliance with this and any other requirements is time-consuming and costly, and our failure to comply may subject us to significant liabilities, which could have a material adverse effect on our business, financial condition, and results of operations.

2 unchanged sentences

We are subject to periodic inspections by the FDA and other regulatory bodies related to regulatory requirements that apply to products designed and manufactured, and clinical trials sponsored by us.

If we receive a notice of inspectional observations or deficiencies from the FDA or other regulatory bodies following an inspection, we may be required to undertake corrective and protective actions or other actions in order to address the FDA or other regulatory bodies concerns which could be expensive and time-consuming to complete and could impose additional burdens and expenses.

If we receive notice of inspectional observations or deficiencies from the FDA or other regulatory bodies following an inspection, we may be required to undertake corrective and protective actions or other actions to address the FDA or other regulatory bodies concerns which could be expensive and time-consuming to complete and could impose additional burdens and expenses.

We have previously received notices of observations or deficiencies from the FDA.

3 unchanged sentences

We have hired experienced clinical development and regulatory staff, and we have also retained the services of knowledgeable external service providers, including consultants and clinical research organizations, to develop and supervise our clinical trials and regulatory processes.

Despite our internal investment in staffing, we will remain dependent upon these third-party contract research organizations and consultants to carry out portions of our clinical and preclinical research studies and regulatory filing assistance for the foreseeable future.

As a result, we have had and will have less control over the conduct of the clinical trials, the timing and completion of the trials, the required reporting of adverse events, and the management of data developed through the trials than would be the case if we were relying entirely on our own staff.

Despite our internal investment in staffing, we will remain dependent upon these third-party contract research organizations and consultants to carry out portions of our clinical and pre-clinical research studies and regulatory filing assistance for the foreseeable future.

As a result, we have had and will have less control over the conduct of the clinical trials, the timing and completion of the trials, the required reporting of adverse events, and the management of data developed through the trials that would be the case if we were relying entirely on our own staff.

Outside parties may have staffing difficulties, may undergo changes in priorities or may become financially distressed, adversely affecting their willingness or ability to conduct our trials.

5 unchanged sentences

If we are found to have promoted such “off label” uses, we may become subject to significant government fines and other related liability.

In the current administration, the FDA has increased its enforcement scrutiny over prescription drug advertising, particularly direct-to-consumer product promotion and advertising.

If the FDA finds any of our promotional communications or advertising to be violative, we may receive an untitled or warning letter, requests for corrective advertising, or fines, amongst other enforcement tools available to the FDA.

The federal government has levied large civil and criminal fines against companies for alleged improper promotion and has enjoined several companies from engaging in off-label promotion.

1 unchanged sentence

We are subject to various healthcare laws and regulations, and any failure to comply with applicable laws could subject us to significant liability and harm our business.

The sales, marketing and pricing of products and the relationships that medical products companies have with healthcare providers such as physicians, hospitals, ASCs, and others are under increased scrutiny.

The sales, marketing, pricing, and reimbursement practices of medical product companies, and their relationships with healthcare providers such as physicians, hospitals, ASCs, and others, are subject to extensive regulation and enforcement scrutiny.

Our industry is subject to various laws and regulations pertaining to healthcare fraud and abuse, as well as other laws that impose extensive tracking and reporting related to all transfers of value provided to certain health care providers and others.

1 unchanged sentence

These laws and regulations are broad in scope and are subject to evolving interpretation.

Because our products are administered by healthcare providers and reimbursed by government healthcare programs under a “buy-and-bill” model, our pricing, contracting, discounting, reimbursement support, and other arrangements with customers and third parties may be subject to heightened scrutiny under federal and state fraud and abuse laws, including the Anti-Kickback Statute and the False Claims Act.

Even arrangements intended to facilitate product access, reimbursement, or patient affordability may be subject to regulatory interpretation or enforcement.

We could be required to incur substantial costs to investigate, audit, and monitor compliance or to alter our practices, to the extent that we are subject to government scrutiny under these laws.

20 unchanged sentences

This decision was made as the cost to manage these product lines impacted our profitability and took focus away from our core HA-related business.

The integration of the two acquired companies into our operations required more effort and expense than was originally planned.

This resulted in additional expenses, the disruption of our ongoing business, processes and systems, or inconsistencies in standards, controls, procedures, practices, policies and compensation arrangements, which adversely affected our ability to achieve the anticipated benefits of the acquisitions.

There may be increased risk with the divestitures of these businesses due to diversion of the attention of management created by the divestiture process, disruptions or other difficulties encountered in the divestiture process, and unforeseen liabilities or unanticipated problems with the businesses being sold, which could have a material adverse effect on our business, operating results and financial condition.

We are working diligently to complete divestiture associated activities to minimize employee, supplier, distributor, and customer disruptions.

The acquisition of these two companies and the related investment in the business have contributed to our net loss in recent years.

While the divestitures are substantially complete, there may be increased risk with the divestitures of these businesses due to diversion of the attention of management created by the divestiture process, disruptions or other difficulties encountered in the divestiture process, and unforeseen liabilities or unanticipated problems with the businesses being sold, which could have a material adverse effect on our business, operating results and financial condition.

The acquisition of these two companies and the related investment in the business have significantly contributed to our net losses in recent years.

We expect to continue to actively explore inorganic growth as a part of our future growth strategy, which exposes us to a variety of risks that could adversely affect our business operations.

14 unchanged sentences

Fluctuations in foreign currency exchange rates relative to the U.S.

Unfavorable labor regulations applicable to our European operations, such as severance and the unenforceability of non-competition agreements in the European Union;

Unfavorable labor regulations applicable to our European operations, such as severance and the unenforceability of non-competition agreements in the EU;

The impact of strikes, work stoppages, work slowdowns, grievances, complaints, claims of unfair labor practices, or other collective bargaining disputes;

52 unchanged sentences

If securities or industry analysts do not publish or cease publishing research or reports about us, our business, or our market, or if they adversely change their recommendations regarding our stock, our stock price and trading volume could decline.

The trading market for our common stock is influenced by the research and reports that securities or industry analysts may publish about us, our business, our market, or our competitors.

The trading market for our common stock is influenced by research and reports that securities or industry analysts may publish about us, our business, our market, or our competitors.

No person is under any obligation to publish research or reports on us, and any person publishing research or reports on us may discontinue doing so at any time without notice.

16 unchanged sentences

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1A. Risk Factors