What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2026-01-28 compared with 2025-01-28 · 156 added, 118 removed, 1434 unchanged (16% of the section changed)

Investing in our common stock involves a high degree of risk.

You should carefully consider the risks and uncertainties described below, together with all of the other information in this Annual Report on Form 10-K, including the section titled “Management’s Discussion and Analysis of Financial Condition and Results of Operations” and our consolidated financial statements and the accompanying notes and the information contained in our other public filings before deciding whether to invest in shares of our common stock.

You should carefully consider the risks and uncertainties described below, together with all of the other information in this Annual Report on Form 10-K, including the section titled “Management’s Discussion and Analysis of Financial Condition and Results of Operations” and our financial statements and the accompanying notes and the information contained in our other public filings before deciding whether to invest in shares of our common stock.

We cannot assure you that any of the events described below will not occur.

2 unchanged sentences

If any of the following risks occur, our business, financial condition, results of operations, and future prospects could be materially and adversely affected.

In that event, the trading price of our common stock could decline, and you could lose part or all of your investment.

In that event, the trading price of our common stock could decline, and you could lose all or part of your investment.

Risks Related to Our Financial Position and Need for Additional Capital

5 unchanged sentences

We are in the early stages of development of our drug candidates.

Our lead drug candidates, NX-5948, NX-2127 and NX-1607, are in the early stages of clinical development.

Our lead drug candidates, bexobrutideg (NX-5948), zelebrudomide (NX-2127) and NX-1607, are in the early stages of clinical development.

We expect to continue to incur significant expenses and increasing operating losses for at least the next several years.

We anticipate that our operating expenses and capital expenditure requirements will increase substantially if and as we:

• increase enrollment in and further develop our drug candidates NX-5948, NX-2127 and NX-1607 through Phase 1 clinical trials;

• increase enrollment in and further develop our drug candidates bexobrutideg, zelebrudomide and NX-1607 through Phase 1 and Phase 2 clinical trials;

• submit investigational new drug applications (INDs) and initiate clinical trials of our other drug candidates;

15 unchanged sentences

We have never generated revenue from product sales and may never be profitable.

We are in the early stages of clinical development of our lead drug candidates NX-5948, NX-2127 and NX-1607.

We are in the early stages of clinical development of our lead drug candidates bexobrutideg, zelebrudomide and NX-1607.

We expect that it will be many years, if ever, before we have a drug candidate ready for commercialization.

6 unchanged sentences

If we are unable to raise capital when needed, we may be required to delay, limit, reduce or terminate our research or product development programs or future commercialization efforts.

We expect our expenses to increase substantially in connection with our ongoing activities, particularly as we conduct our Phase 1 clinical trials of NX-5948, NX-2127 and NX-1607 and any future development of our drug candidates, grow our pipeline of drug candidates, expand the breadth of our DEL-AI platform, continue research and development and initiate additional clinical trials of and potentially seek marketing approval for our lead programs and other drug candidates.

We expect our expenses to increase substantially in connection with our ongoing activities, particularly as we conduct our Phase 1 and Phase 2 clinical trials of bexobrutideg, zelebrudomide and NX-1607 and any future development of our drug candidates, grow our pipeline of drug candidates, expand the breadth of our DEL-AI platform, continue research and development and initiate additional clinical trials of and potentially seek marketing approval for our lead programs and other drug candidates.

In addition, if we obtain marketing approval for any of our drug candidates, we expect to incur significant commercialization expenses related to product manufacturing, marketing, reimbursement and sales and distribution.

Furthermore, we expect to incur additional costs associated with operating as a public company.

Furthermore, we expect to continue to incur additional costs associated with operating as a public company.

Accordingly, we will need to obtain substantial additional funding in connection with our continuing operations.

5 unchanged sentences

Our future capital requirements will depend on many factors, including:

• the progress, costs and results of our Phase 1 clinical trials for NX-5948, NX-2127 and NX-1607 and any future clinical development of such drug candidates;

• the progress, costs and results of our Phase 1 and Phase 2 clinical trials for bexobrutideg, zelebrudomide and NX-1607 and any future clinical development of such drug candidates;

• the scope, progress, costs and results of preclinical and clinical development for our other drug candidates and development programs;

39 unchanged sentences

We are early in our development efforts.

Our lead drug candidates, NX-5948, NX-2127 and NX-1607, are in the early stages of clinical development.

If we are unable to advance our drug candidates through clinical development, develop, obtain regulatory approval for and commercialize our drug candidates or experience significant delays in doing so, our business may be materially harmed.

Our lead drug candidates, bexobrutideg (NX-5948), zelebrudomide (NX-2127) and NX-1607, are in the early stages of clinical development.

If we are unable to advance our drug candidates through clinical development or are unable to obtain regulatory approval for and commercialize our drug candidates or experience significant delays in doing so, our business may be materially harmed.

We are early in our development efforts.

Our lead drug candidates, NX-5948, NX-2127 and NX-1607, are in the early stages of clinical development and their risk of failure is high.

We have invested substantially all of our efforts and financial resources in building our DEL-AI platform, in the identification and preclinical development of our current drug candidates and in the preparation for and initiation of Phase 1 clinical trials for our lead drug candidates, as well as the preparation to advance NX-5948 into a Phase 2 clinical trial, anticipated in 2025.

Our lead drug candidates, bexobrutideg, zelebrudomide and NX-1607, are in the early stages of clinical development and their risk of failure is high.

We have invested substantially all of our efforts and financial resources in building our DEL-AI platform, in the identification and preclinical development of our current drug candidates, in the preparation for and initiation of Phase 1 clinical trials for our lead drug candidates and in the preparation for and initiation of the DAYBreak Phase 2 clinical trial evaluating bexobrutideg.

Our ability to generate revenue from product sales, which we do not expect will occur for many years, if ever, will depend heavily on the successful development and eventual commercialization of one or more of our drug candidates.

28 unchanged sentences

Further, certain patients have shown inherent (primary) resistance to approved BTK inhibitors and other patients have developed acquired (secondary) resistance to these inhibitors.

Both NX-5948 and NX-2127 degrade BTK with mutations that confer resistance to currently marketed BTK inhibitors, and we believe that preliminary data from our ongoing Phase 1 trials of NX-5948 and NX-2127 may provide evidence of clinical benefit to patients with such resistance mutations.

Both bexobrutideg and zelebrudomide degrade BTK with mutations that confer resistance to currently marketed BTK inhibitors, and we believe that preliminary data from our ongoing Phase 1 and Phase 2 trials of bexobrutideg and our Phase 1 trial of zelebrudomide may provide evidence of clinical benefit to patients with such resistance mutations.

However, any inherent primary or acquired secondary resistance to our BTK degraders in patients would prevent or diminish their clinical benefit.

We are in the early stages of clinical development of NX-5948 and NX-2127 and we currently have limited safety data of NX-5948 and NX-2127 in humans.

We are in the early stages of clinical development of bexobrutideg and zelebrudomide and we currently have limited safety data of bexobrutideg and zelebrudomide in humans.

Although some of our drug candidates have produced observable results in animal studies, these drug candidates may not demonstrate the same chemical and pharmacological properties in humans, and may interact with human biological systems in unforeseen, ineffective or harmful ways.

24 unchanged sentences

We may experience numerous unforeseen events during, or as a result of, clinical trials, that could delay or prevent our ability to receive marketing approval or commercialize our drug candidates, including:

• we may experience delays in corresponding with the FDA or a foreign regulatory authority regarding regulatory issues;

• we may experience delays in reaching, or may fail to reach, a consensus with regulators on trial design;

32 unchanged sentences

Second- and third-line therapies are administered to patients when prior therapy was ineffective.

Our current and planned clinical trials for our drug candidates NX-5948, NX-2127 and NX-1607 are and will be with patients who have received one or more prior treatments.

Our current and planned clinical trials for our drug candidates bexobrutideg, zelebrudomide and NX-1607 are and will be with patients who have received one or more prior treatments.

Subsequently, for those drug candidates that prove to be sufficiently beneficial, if any, we may seek approval potentially as a first-line therapy, but any drug candidates we develop, even if approved, may not be approved for first-line therapy, and, prior to any such approvals, we may have to conduct additional clinical trials.

2 unchanged sentences

It is impossible to predict when or if any drug candidates we may develop will prove safe in humans.

There is a limited safety data set for the effects of NX-5948, NX-2127 and NX-1607 in animals and we only recently have begun to test the safety of our drug candidates in humans.

There is a limited safety data set for the effects of bexobrutideg, zelebrudomide and NX-1607 in humans.

There can be no assurance that our current drug candidates or any future drug candidate will not cause undesirable side effects.

12 unchanged sentences

In particular, the small number of patients in our planned early clinical trials may make the results of these trials less predictive of the outcomes of later clinical trials.

For example, even if successful, the results of our initial clinical trials for NX-5948, NX-2127 and NX-1607 may not be predictive of the results of further clinical trials of these drug candidates or any of our other drug candidates.

The results of our initial clinical trials for bexobrutideg, zelebrudomide and NX-1607 may not be predictive of the results of further clinical trials of these drug candidates or any of our other drug candidates.

Moreover, preclinical and clinical data often are susceptible to varying interpretations and analyses, and many companies that have believed their drug candidates performed satisfactorily in preclinical studies and clinical trials nonetheless have failed to obtain marketing approval of their products.

4 unchanged sentences

Interim top-line and preliminary data from our planned clinical trials that we announce or publish from time to time may change as more patient data become available and are subject to audit and verification procedures that could result in material changes in the final data.

From time to time, we may publish interim top-line or preliminary data from our planned clinical trials.

Interim data from clinical trials that we may complete are subject to the risk that one or more of the clinical outcomes may materially change as patient enrollment continues and more patient data become available.

We have published and may continue to publish interim top-line or preliminary data from our current and planned clinical trials.

Interim data from clinical trials are subject to the risk that one or more of the clinical outcomes may materially change as patient enrollment continues and more patient data become available.

Preliminary or top-line data also remain subject to audit and verification procedures that may result in the final data being materially different from the preliminary data we previously published.

3 unchanged sentences

We may not be able to initiate or continue clinical trials for our drug candidates if we are unable to locate and enroll a sufficient number of eligible patients to participate in these trials as required by the FDA or similar regulatory authorities outside of the United States.

In particular, we are currently conducting Phase 1 clinical trials for each of our lead drug candidates NX-5948, NX-2127 and NX-1607, and we expect to initiate a Phase 2 clinical trial of NX-5948 in 2025.

In particular, we are currently conducting Phase 1 clinical trials for each of our lead drug candidates, bexobrutideg, zelebrudomide and NX-1607, and a Phase 2 clinical trial for bexobrutideg, and we expect to initiate a Phase 3 clinical trial for bexobrutideg in 2026.

We cannot predict how difficult it will be to enroll patients for these trials.

Therefore, our ability to identify and enroll eligible patients for our NX-5948, NX-2127 and NX-1607 clinical trials may be limited or may result in slower enrollment than we anticipate.

Therefore, our ability to identify and enroll eligible patients for our bexobrutideg, zelebrudomide and NX-1607 clinical trials may be limited or may result in slower enrollment than we anticipate.

In addition, some of our competitors have ongoing clinical trials for drug candidates that treat the same indications as our drug candidates, and patients who otherwise would be eligible for our planned clinical trials instead may enroll in clinical trials of our competitors’ drug candidates.

15 unchanged sentences

Because we have limited financial and managerial resources, we focus on research programs and drug candidates that we identify for specific indications.

As a result, we may forego or delay pursuit of opportunities with other drug candidates or for other indications that later prove to have greater commercial potential.

As a result, we may forgo or delay pursuit of opportunities with other drug candidates or for other indications that later prove to have greater commercial potential.

Our resource allocation decisions may cause us to fail to capitalize on viable commercial products or profitable market opportunities.

8 unchanged sentences

If we or any of our third-party manufacturers encounter such difficulties, our ability to provide supply of our current or future drug candidates for clinical trials, our ability to obtain marketing approval or our ability to provide supply of our drug candidates for patients, if approved, could be delayed or stopped.

For example, in October 2023, following our communication to the FDA of our intention to transition to an improved manufacturing process for NX-2127, the FDA placed a partial clinical hold on our ongoing Phase 1 clinical trial evaluating NX-2127.

For example, in October 2023, following our communication to the FDA of our intention to transition to an improved manufacturing process for zelebrudomide, the FDA placed a partial clinical hold on our ongoing Phase 1 clinical trial evaluating zelebrudomide.

We actively engaged in discussions with FDA as part of our efforts to lift the partial clinical hold, and in March 2024, the FDA lifted the partial clinical hold.

There can be no assurance that we can address any issues resulting in any partial or full clinical hold in a timely manner or at all, and we may incur additional expenses in connection with our efforts to address a partial or full clinical hold or advance our clinical programs.

We may not be successful in our efforts to identify or discover additional potential drug candidates.

We may not be successful in our efforts to identify or discover additional potential drug candidates, or in further efforts to expand the breadth of our DEL-AI platform.

A key element of our strategy is to apply our DEL-AI platform to address a broad array of targets and new therapeutic areas.

7 unchanged sentences

If we are unable to identify suitable drug candidates for preclinical and clinical development, we will not be able to obtain revenues from the sale of products in future periods, which likely would result in significant harm to our financial position and adversely impact our stock price.

We may not be successful in our efforts to expand the breadth of our DEL-AI platform.

A key element of our strategy is to expand the capabilities of our DEL-AI platform and leverage our platform to discover, develop and potentially commercialize additional drug candidates beyond our current portfolio to target diseases in a wide range of organ systems and tissues and treat various disease states.

We also intend to expand the capabilities of our DEL-AI platform and leverage our platform to discover, develop and potentially commercialize additional drug candidates beyond our current portfolio to target diseases in a wide range of organ systems and tissues and treat various disease states.

These enhancements require substantial technical, financial and human resources, and may not result in the discovery or development of additional drug candidates or therapies.

38 unchanged sentences

Supreme Court issued an opinion holding that courts reviewing agency action pursuant to the Administrative Procedure Act (APA) “must exercise their independent judgment” and “may not defer to an agency interpretation of the law simply because a statute is ambiguous.” The decision will have a significant impact on how lower courts evaluate challenges to agency interpretations of law, including those by the FDA and other agencies with significant oversight of the biopharmaceutical industry.

The new framework is likely to increase both the frequency of such challenges and their odds of success by eliminating one way in which the government previously prevailed in such cases.

As a result, significant regulatory policies will be subject to increased litigation and judicial scrutiny.

The new framework may result in an increase in both the frequency of such challenges and their odds of success by eliminating one way in which the government previously prevailed in such cases.

As a result, significant regulatory policies may be subject to increased litigation and judicial scrutiny.

Any resulting changes in regulation may result in unexpected delays, increased costs, or other negative impacts on our business that are difficult to predict but could have a material adverse effect on our business and financial condition.

53 unchanged sentences

We rely on third parties to conduct our clinical trials, and those third parties may not perform satisfactorily, including failing to meet deadlines for completing such trials.

We rely on third-party contract research organizations (CROs) to conduct our Phase 1 clinical trial programs for NX-5948, NX-2127 and NX-1607 and we will rely on third-party CROs to conduct any clinical trials for other drug candidates.

We rely on third-party contract research organizations (CROs) to conduct our clinical trial programs for bexobrutideg, zelebrudomide and NX-1607 and we will rely on third-party CROs to conduct any clinical trials for other drug candidates.

Agreements with these CROs might terminate for a variety of reasons, including for such CRO’s failure to perform.

2 unchanged sentences

For example, we will remain responsible for ensuring that each of our clinical trials is conducted in accordance with the general investigational plan and protocols in the applicable IND.

Moreover, the FDA and other foreign regulators such as the EMA and the MHRA require compliance with good clinical practice standards, commonly referred to as GCPs, for conducting, recording and reporting the results of clinical trials to assure that data and reported results are credible and accurate and that the rights, integrity and confidentiality of trial participants are protected.

Moreover, the FDA and other foreign regulators such as the EMA and the MHRA require compliance with good clinical practice standards (GCPs), for conducting, recording and reporting the results of clinical trials to assure that data and reported results are credible and accurate and that the rights, integrity and confidentiality of trial participants are protected.

If these CROs do not successfully carry out their contractual duties, meet expected deadlines or conduct our clinical trials in accordance with regulatory requirements or our stated protocols, we will not be able to obtain, or may be delayed in obtaining, marketing approvals for our drug candidates and will not be able to, or may be delayed in our efforts to, successfully commercialize our drug candidates.

7 unchanged sentences

Any unfavorable government policies on international trade, such as export controls, capital controls or tariffs, new legislation or regulations, renegotiation of existing trade agreements, or any retaliatory trade actions due to recent or future trade tension, may impede, delay, limit, or increase the cost of manufacturing our therapeutic candidates.

For example, in April 2025, the United States announced extensive tariffs on goods imported from China, where certain of our third-party manufacturers and suppliers are located.

While we believe we currently have sufficient inventory for clinical use and do not anticipate any near-term impact to our clinical programs, we expect these tariffs may increase the cost of our product supply in the future.

Such events could result in our clinical or commercial supply of drug, packaging and other services being interrupted or limited, which could harm our business.

27 unchanged sentences

We obtain certain chemical or biological intermediates in the synthesis of our drug candidates and natural health products (NHPs) for toxicology testing in countries affected by macroeconomic events and conditions, including inflation, interest rate fluctuations, uncertainty with respect to the federal budget and debt ceiling and potential government shutdowns related thereto, increasing financial market volatility and uncertainty, the impact of war or military conflict, including regional conflicts around the world, and public health pandemics.

Supply chain disruptions and delays as a result of any new tariff policies or trade restrictions could also negatively impact our cost of materials and production processes.

For example, the United States has announced tariffs on many goods imported from specified nations, including China and those in the European Union.

In addition, there are currently discussions concerning potential increased tariffs for pharmaceutical products, which may impact our supply chain and create uncertainty in the broader pharmaceutical industry.

While certain tariffs have been suspended, modified or temporarily reduced, we cannot predict the results of the U.S.

government’s trade negotiations or the outcome of ongoing legal challenges to specific tariff policies.

If we are unable to obtain these chemical or biological intermediates or NHPs in sufficient quantity and in a timely manner due to disruptions in the global supply chain caused by macroeconomic events and conditions, the development, testing and clinical trials of that drug candidate may be delayed or infeasible, and regulatory approval or commercial launch of any resulting product may be delayed or not obtained, which could significantly harm our business.

23 unchanged sentences

To achieve commercial success for any product for which we obtain marketing approval, we will need to establish sales, marketing and distribution capabilities, either by ourselves or through collaboration or other arrangements with third parties.

We currently expect that we may build our own focused, specialized sales and marketing organization to support the commercialization in the United States of drug candidates for which we receive marketing approval and which can be commercialized with such capabilities.

We may build our own focused, specialized sales and marketing organization to support the commercialization in the United States of drug candidates for which we receive marketing approval and which can be commercialized with such capabilities.

There are risks involved with establishing our own sales and marketing capabilities.

98 unchanged sentences

In addition, any threat to the breadth or strength of protection provided by our patents and patent applications could dissuade companies from collaborating with us to license, develop or commercialize current or future drug candidates.

Further, recent reforms and changes at government agencies of the United States and those of non-U.S.

jurisdictions could increase the delays, uncertainties and costs surrounding the prosecution of our patent applications, and the maintenance, enforcement, or defense of our issued patents.

For example, the ability of the USPTO and other applicable patent authorities to properly administer their functions is highly dependent on the levels of funding available to the agency and their ability to retain personnel and fill key leadership appointments, among various factors.

Termination of employees or delays in replacing or hiring for positions could significantly impact the ability of the USPTO and other applicable patent authorities to fulfill their functions and could greatly impact our ability to timely and adequately prosecute or maintain our patent applications, and our ability to timely and adequately maintain, enforce, or defend our issued patents.

Even if our patent applications issue as patents and are unchallenged, they may not issue in a form that will provide us with any meaningful protection against competing products or processes sufficient to achieve our business objectives, prevent competitors and other third parties from competing with us or otherwise provide us with any competitive advantage.

65 unchanged sentences

For example, we are aware of a patent owned by a third party with a claim that covers many potential targeted protein degraders.

This patent may be alleged to cover one or more of our targeted protein degrader drug candidates, including our NX-5948 and NX-2127 drug candidates.

This patent may be alleged to cover one or more of our targeted protein degrader drug candidates, including our bexobrutideg and zelebrudomide drug candidates.

While we believe that we have valid defenses against any assertion of such patent against us, such defenses may be unsuccessful.

17 unchanged sentences

Further, we do not know which processes we will use for commercial manufacture of our future products, or which technologies owned or controlled by third parties may prove important or essential to those processes.

Many companies have filed, and continue to file, patent applications related to novel protein degradation therapies that target disease-causing proteins and many companies have filed and continue to file patent applications related to ACT.

Many companies have filed, and continue to file, patent applications related to novel protein degradation therapies that target disease-causing proteins.

Some of these patent applications have already been allowed or issued and others may issue in the future.

189 unchanged sentences

Any of the foregoing scenarios could materially harm the commercial prospects for our drug candidates.

We have received Fast Track designation for NX-5948 and may seek Fast Track designation for other drug candidates in the future.

We have received Fast Track designation for bexobrutideg (NX-5948) and may seek Fast Track designation for other drug candidates in the future.

Fast Track designation may not lead to faster development or regulatory review or approval process, and it does not increase the likelihood that our drug candidates will receive marketing approval.

In January 2024, the FDA granted Fast Track designation for NX-5948 in the United States for the treatment of adult patients with relapsed or refractory CLL or small lymphocytic lymphoma after at least two lines of therapy, including a BTK inhibitory and a B-cell lymphoma 2 inhibitor, and in December 2024, the FDA granted Fast Track designation for NX-5948 in the United States for the treatment of adult patients with relapsed or refractory Waldenstrom’s macroglobulinemia after at least two lines of therapy, including a BTK inhibitor.

In January 2024, the FDA granted Fast Track designation for bexobrutideg in the United States for the treatment of adult patients with relapsed or refractory CLL or small lymphocytic lymphoma after at least two lines of therapy, including a BTK inhibitory and a B-cell lymphoma 2 inhibitor, and in December 2024, the FDA granted Fast Track designation for bexobrutideg in the United States for the treatment of adult patients with relapsed or refractory Waldenström macroglobulinemia after at least two lines of therapy, including a BTK inhibitor.

As part of our business strategy, we may also seek Fast Track designation for other of our drug candidates.

39 unchanged sentences

Any delay in obtaining, or inability to obtain, approval through the Accelerated Approval Program, or any issues in maintaining approval granted under the Accelerated Approval Program, would delay or prevent commercialization of our products, and would materially adversely affect our business, financial condition, results of operations and prospects.

We, as a company, have limited experience in filing for and obtaining regulatory approval to initiate a clinical trial, and we do not have experience completing any clinical trials, including large-scale, pivotal clinical trials or in manufacturing or in quality assurance in order to market a new drug in the United States or in any other jurisdiction.

As a company, we have limited experience in filing for or obtaining regulatory approval to initiate clinical trials, we do not have experience completing any clinical trials, including large-scale, pivotal clinical trials and we rely on third parties to conduct our clinical trials.

We, as a company, have limited experience in filing for and obtaining regulatory approval to initiate a clinical trial, and we do not have experience completing any pivotal clinical trials or in manufacturing or in quality assurance in order to market a new drug in the United States or in any other jurisdiction.

As a company, we have limited experience in filing for or obtaining regulatory approval to initiate clinical trials, we do not have experience completing any pivotal clinical trials and we rely on third parties to conduct our clinical trials.

We also do not have experience in manufacturing or in quality assurance in order to market a new drug and expect to rely on CROs or other third-party consultants or vendors to assist us in this process.

10 unchanged sentences

We may not be able to file for marketing approvals and may not receive necessary approvals to commercialize our products in any jurisdiction, which would materially impair our ability to generate revenue.

The UK’s exit from the EU continues to create political and economic uncertainty, particularly in the UK and the EU.

The UK is now being treated as a “third country” by the EU.

Due to the UK’s exit from the EU, the UK is now being treated as a “third country” by the EU.

Although UK legislation has retained existing EU law, new UK legislation is being drafted and the UK has not retained new EU law, including the Clinical Trials Regulation (EU) No 536/2014.

3 unchanged sentences

The regulatory framework for medicines that existed before the end of the transition period has also effectively been preserved in UK domestic legislation as “retained EU law.” By retaining a snapshot of EU legislation at its core, the UK has prevented substantial divergence in the regulation of medicines (although divergence has appeared in some areas).

However, some changes to the UK legislation have been immediately necessary, including the implementation

of the Northern Ireland Protocol (NIP), pursuant to which, the EU pharmaceutical legal framework acquis continues to apply in Northern Ireland (subject to periodic consent of the Northern Ireland Legislative Assembly), and only products compliant with EU law can be placed in the Northern Ireland market—adding an extra layer of regulatory complexity.

As a result, companies now need to comply with a separate UK regulatory legal framework in order to commercialize medicinal products in Great Britain (namely, England, Wales and Scotland, as EU law continues to apply in Northern Ireland).

The UK government has attempted to renegotiate fundamental aspects of the NIP so this is an unpredictable area for companies in the near future.

Failed attempts to renegotiate the NIP have led to media reports of the UK potentially triggering Article 16 of the NIP, a safeguarding measure, that may be engaged unilaterally if the application of the NIP leads to serious economic, societal or environmental difficulties that are liable to persist, or to diversion of trade.

The UK government has introduced the Northern Ireland Protocol Bill which, if enacted into law, would enable the government to unilaterally disapply parts of the NIP which may lead to changes to the regulatory environment in Northern Ireland, and may trigger retaliatory measures against the UK by the EU.

The UK government reached a new agreement with the EU, the “Windsor Framework,” which aims to amend the NIP.

According to the Windsor Framework, medicinal products intended for the UK market including Northern Ireland will be authorized by the MHRA and will bear a “UK only” label.

This means that medicinal products placed on the market in Northern Ireland will no longer need to be compliant with EU law.

These new measures will be implemented beginning January 1, 2025.

The UK government reached a new agreement with the EU, the “Windsor Framework,” which amended the Northern Ireland Protocol, pursuant to which, the EU pharmaceutical legal framework acquis continued to apply to Northern Ireland.

According to the Windsor Framework, medicinal products intended for the

UK market including Northern Ireland will be authorized by the MHRA and must bear a “UK only” label.

This means that medicinal products placed on the market in Northern Ireland no longer need to be compliant with EU law.

These new measures were implemented beginning January 1, 2025.

The TCA allows for future deviation from the current regulatory framework, and it is not known if and/or when any deviations may occur, which may have an impact on development, manufacture, marketing authorization, commercial sales and distribution of pharmaceutical products.

22 unchanged sentences

Consequently, it is possible that our clinical trials, or those of any future collaborator, may indicate an apparent positive effect of a drug candidate that is greater than the actual positive effect, if any, or alternatively fail to identify undesirable side effects.

If one or more of our drug candidates receives marketing approval and we, or others, discover that the drug is less effective than previously believed or causes undesirable side effects that were not previously identified, a number of potentially significant negative consequences could result, including:

If one or more of our drug candidates receives marketing approval and we, or others, later discover that the drug is less effective than previously believed, or causes undesirable side effects that were not previously identified, or if issues with the manufacturing process or manufacturers arise, or if we fail to comply with regulatory requirements, a number of potentially significant negative consequences could result, including:

• regulatory authorities may withdraw their approval of the drug or seize the drug;

• we, or any future collaborators, may be required to recall the drug, change the way the drug is administered or conduct additional clinical trials;

• additional restrictions may be imposed on the marketing of, or the manufacturing processes for, the particular drug;

• we may be subject to fines, injunctions or the imposition of civil or criminal penalties;

• regulatory authorities may require the addition of labeling statements, such as a “black box” warning or a contraindication;

• we, or any future collaborators, may be required to recall the drug, change the way the drug is administered, conduct post-marketing studies or additional clinical trials, or withdraw the drug from the market;

• additional restrictions may be imposed on the marketing, manufacturing processes, distribution, import or export, or use of the particular drug;

• we may be subject to litigation, fines, restitution, disgorgement of profits or revenues, injunctions or the imposition of civil or criminal penalties;

• we may receive warning letters or untitled letters from regulatory authorities;

• regulatory authorities may require the addition of labeling statements, such as a “black box” warning or a contraindication, or impose other restrictions or warnings on the labeling or marketing of the drug;

• we, or any future collaborators, may be required to create a Medication Guide outlining the risks of the previously unidentified side effects for distribution to patients;

• regulatory authorities may refuse to approve pending applications or supplements to approved applications that we submit;

• any ongoing clinical trials may be suspended;

• we, or any future collaborators, could be sued and held liable for harm caused to patients;

• relationships with any potential collaborators may be damaged;

• the drug may become less competitive in the marketplace;

• we may receive unfavorable press coverage;

• our reputation may suffer.

5 unchanged sentences

Violations of the FDCA and other statutes, including the False Claims Act, relating to the promotion and advertising of prescription drugs may lead to investigations and enforcement actions alleging violations of federal and state healthcare fraud and abuse laws, as well as state consumer protection laws.

The FDA has increased scrutiny of product claims and, in 2025, issued a significant number of enforcement actions to companies.

Other jurisdictions, including European countries, have similar provisions which may lead to investigations and enforcement actions by national authorities.

In addition, later discovery of previously unknown side effects or other problems with our products or their manufacturers or manufacturing processes, or failure to comply with regulatory requirements, may yield various results, including:

• restrictions on such products, manufacturers or manufacturing processes;

• restrictions and warnings on the labeling or marketing of a product;

• restrictions on product distribution or use;

• requirements to conduct post-marketing studies or clinical trials;

• warning letters or untitled letters;

• withdrawal of the products from the market;

• refusal to approve pending applications or supplements to approved applications that we submit;

• recall of products;

• fines, restitution or disgorgement of profits or revenues;

• suspension or withdrawal of marketing approvals;

• suspension of any ongoing clinical trials;

• damage to relationships with any potential collaborators;

• unfavorable press coverage and damage to our reputation;

• refusal to permit the import or export of our products;

• product seizure;

• injunctions or the imposition of civil or criminal penalties;

• litigation involving patients using our products.

Non-compliance with EU and UK requirements regarding safety monitoring or pharmacovigilance, and with requirements related to the development of products for the pediatric population (as explained further under “—If any of our drug candidates are not considered to be a new active substance or are deemed to fall within the “global marketing authorization” of an existing medicinal product or if pediatric studies are not adequately completed, this may result in lack of regulatory data protection or failure to obtain an extension to existing regulatory data protection,” below), also can result in significant financial penalties, and non-compliance with pediatric requirements may prevent regulatory approvals from being granted.

Non-compliance with EU and UK requirements regarding safety monitoring or pharmacovigilance, or with requirements related to the development of products for the pediatric population (as explained further under “—If any of our drug candidates are not considered to be a new active substance or are deemed to fall within the “global marketing authorization” of an existing medicinal product or if pediatric studies are not adequately completed, this may result in lack of regulatory data protection or failure to obtain an extension to existing regulatory data protection,” below), also can result in significant financial penalties, and non-compliance with pediatric requirements may prevent regulatory approvals from being granted.

Similarly, failure to comply with the EU and UK’s requirements regarding the protection of personal information can lead to significant penalties and sanctions.

1 unchanged sentence

We, any contract manufacturers we may engage in the future, our collaborators and their contract manufacturers also will be subject to other regulatory requirements, including submissions of safety and other post-marketing information and reports, registration and listing requirements, requirements regarding the distribution of samples to clinicians, recordkeeping, and costly post-marketing studies or clinical trials and surveillance to monitor the safety or efficacy of the product, such as the requirement to implement a REMS.

If we decide to seek Orphan Drug Designation or other designations from regulators for any of our current or future drug candidates, we may be unsuccessful or may be unable to maintain the benefits associated with these designations, including the potential for supplemental market exclusivity associated with an Orphan Drug Designation.

We may seek Orphan Drug Designation or other designations from regulators for one or more of our current or future drug candidates.

We have received Orphan Drug Designation for bexobrutideg (NX-5948) and may seek Orphan Drug Designation for other drug candidates in the future.

If we decide to seek Orphan Drug Designation or other designations from regulators for any of our other or future drug candidates, we may be unsuccessful or may be unable to maintain the benefits associated with these designations, including the potential for supplemental market exclusivity associated with an Orphan Drug Designation.

In March 2025, the FDA granted Orphan Drug Designation to bexobrutideg for the treatment of Waldenström macroglobulinemia, and in June 2025, the EMA granted Orphan Drug Designation to bexobrutideg for the treatment of adult patients with lymphoplasmacytic lymphoma, of which Waldenström macroglobulinemia is the most common subtype.

As part of our business strategy, we may also seek Orphan Drug Designation or other designations from regulators for other of our current or future drug candidates.

Regulatory authorities in some jurisdictions, including the United States, EU and European Economic Area (EEA), Switzerland and the UK, may designate drugs or biological products for relatively small patient populations as orphan drugs.

36 unchanged sentences

If enacted into law, this proposal will revise and replace the existing general pharmaceutical legislation and will affect the existing period of regulatory protections afforded to medicinal products.

The proposal is now undergoing the legislative process and the text of the initial proposal is likely to be amended by the European Parliament and the European Council.

The proposal is now undergoing the legislative process and is expected to be adopted in 2026.

If the FDA or comparable foreign regulatory authorities approve generic versions of any of our drug candidates that receive marketing approval, or such authorities do not grant our drug candidates appropriate periods of data or market exclusivity before approving generic versions of our drug candidates, the sales of our drug candidates could be adversely affected.

22 unchanged sentences

However, even if a compound is considered to be a new active substance and the innovator is able to gain the period of regulatory data protection and marketing protection, provided that no other IP or regulatory exclusivities applied, another unrelated company could also apply for a marketing authorization and market another competing medicinal product for the same therapeutic indication if such company obtained its own marketing authorization based on a separate MAA based on a full self-standing scientific data package supporting the application.

The period of regulatory data protection and marketing protection applies in the UK (running from the date of the first authorization in Great Britain).

The period of regulatory data protection and marketing protection applies in the UK (running from the date of the first UK marketing authorization).

In the EU, pursuant to Regulation 1901/2006, and in the UK pursuant to the Human Medicines Regulations 2012 (as amended), MAAs must include pediatric data based on pediatric investigation plans agreed with the EMA if the MAA concerns (i) a new active substance, or (ii) a new indication, pharmacological form, or route of administration (where the product is protected by an SPC or a patent qualifying for an SPC).

48 unchanged sentences

Failure to comply with these requirements could result in reputational risk, public reprimands, administrative penalties, fines or imprisonment.

The FDA’s and other regulatory authorities’ policies may change, and additional government regulations may be enacted that could prevent, limit or delay regulatory approval of our drug candidates.

Disruptions at the FDA may slow the time necessary for new products to be reviewed and/or approved, which would adversely affect our business.

In addition, there is substantial uncertainty regarding new initiatives and how these might impact the FDA, its implementation of laws, regulations, policies and guidance and its personnel.

Similar initiatives may also be directed toward other government agencies.

These initiatives could prevent, limit or delay development and regulatory approval of our product candidates, which would adversely affect our business.

Disruptions at the FDA may slow the time necessary for new products to be reviewed and/or approved, which would adversely affect our business.

Changes in FDA staffing could result in delays in the FDA’s responsiveness or in its ability to review submissions or applications, issue regulations or guidance, or implement or enforce regulatory requirements in a timely fashion or at all.

If any legislation, executive orders, or lapses in agency funding impose constraints on the FDA’s ability to engage in oversight and implementation activities in the normal course, our business may be negatively impacted.

Federal government shutdowns pose comparable risks.

government has experienced several shutdowns, including in 2025, during which regulatory agencies such as the FDA have furloughed critical employees and suspended critical activities.

A prolonged government shutdown, or geopolitical or global health concerns that prevent the FDA from conducting regular inspections, reviews, or other regulatory activities, could significantly impact the FDA’s ability to timely review and process our regulatory submissions, which could have a material adverse effect on our business.

Such disruptions could delay the development of our product candidates or prevent us from obtaining timely regulatory approvals.

Further, future government shutdowns or delays could impact our ability to access the public markets and obtain necessary capital in order to properly capitalize and continue our operations.

FDA-regulated industries, such as ours, face uncertainty with regard to the regulatory environment we will face as we proceed with research and development, and possibly in future commercialization.

Some of these efforts have manifested to date in the form of FDA reductions in workforce or other personnel measures that could impact the FDA’s ability to hire and retain key personnel, which could result in delays or limitations on our ability to obtain guidance from the FDA on our product candidates in development and obtain the requisite regulatory approvals in the future.

Moreover, additional changes to budget and staffing of other governmental agencies, including but not limited to those within the Department of Health and Human Services (HHS), could affect development activities such as enrollment and conduct of clinical trials.

There remains general uncertainty regarding future activities.

New executive orders, regulations, policies or guidance could be issued or promulgated that adversely affect us or create a more challenging or costly environment to pursue the development of new therapeutic products.

Alternatively, state governments may attempt to address or react to changes at the federal level with changes to their own regulatory frameworks in a manner that is adverse to our operations.

If we become negatively impacted by future governmental orders, regulations, policies or guidance, there could be a material adverse effect on us and our business.

Further, in connection with new initiatives, the FDA’s and other regulatory authorities’ policies may change, and additional government regulations may be enacted that could prevent, limit or delay regulatory approval of our drug candidates.

If we are slow or unable to adapt to changes in existing requirements or the adoption of new requirements or policies, or if we are not able to maintain regulatory compliance, we may lose any marketing approval that we may have obtained, and we may not achieve or sustain profitability.

11 unchanged sentences

beginning in 2026, establish a “maximum fair price” for a fixed number of pharmaceutical and biological products covered under Medicare Parts B and D following a price negotiation process with the Centers for Medicare and Medicaid Services (CMS);

and, beginning in 2023, penalize drug companies that raise prices for products covered under Medicare Parts B and D faster than inflation, among other reforms.

The CMS has taken a number of steps to implement the IRA, including:

on August 29, 2023, releasing the initial list of ten drugs subject to price negotiations;

on August 15, 2024 releasing the negotiated maximum prices for such drugs that will be effective beginning in 2026;

on October 2, 2024, releasing final guidance outlining the process for the second round of price negotiations for products subject to the “maximum fair price” provision;

and on December 20, 2024, releasing a list of 64 Medicare Part B products that had an adjusted coinsurance rate based on the inflationary rebate provisions of the IRA for the time period of January 1, 2025 to March 31, 2025.

and, as of 2023, penalize drug companies that raise prices for products covered under Medicare Parts B and D faster than inflation, among other reforms.

Since its enactment, CMS has taken steps to implement various drug pricing provisions of the IRA.

This includes, without limitation, releasing the negotiated maximum prices, which will be effective in 2026, for the first ten drugs that were subject to the IRA’s negotiation process, as well as the negotiated maximum prices for fifteen additional drugs to be effective in 2027, and releasing quarterly lists of Medicare Part B products that are subject to adjusted coinsurance rates based on the inflationary rebate provisions of the IRA.

It is unclear how future regulatory actions to implement the IRA, as well as the outcome of pending litigation against the IRA, may affect our products and future profitability, and we cannot predict the likelihood, nature, or extent of other health reform initiatives that may arise from future legislation or administrative actions.

Moreover, the results of the 2024 Presidential and Congressional elections, and potential subsequent developments, increase the uncertainty related to the healthcare regulatory environment.

Moreover, recent healthcare regulatory developments indicate that prescription drug price reduction remains a key policy objective for the current presidential administration.

For example, President Trump has signed multiple executive orders addressing prescription drug pricing and access, including:

on April 15, 2025, outlining several actions the Secretary of the Department of HHS must take to optimize healthcare regulations that will provide access to prescription drugs at lower costs;

on May 5, 2025, aiming to promote domestic production of critical medicines;

and on May 12, 2025, aiming to establish a “most favored nation” drug pricing policy that would tie U.S.

drug prices to the prices paid for drugs in other countries.

Since the May 12, 2025 “most favored nation” executive order, the Trump administration has continued to exert pressure on drug manufacturers to implement “most favored nation” pricing, including by suggesting that the administration may impose significant tariffs on pharmaceuticals if such manufacturers do not reach agreements to implement “most favored nation” pricing.

Additionally, in November 2025, CMS announced a new voluntary payment initiative called the GENEROUS Model (GENErating cost Reductions for U.S.

Medicaid Model) where drug manufacturers may voluntarily offer supplemental rebates to participating state Medicaid programs that are intended to provide such Medicaid programs with a “most favored nation” price for participating manufacturers’ products.

In addition, on June 28, 2024, the U.S.

6 unchanged sentences

These measures could reduce the ultimate demand for our products, once approved, or put pressure on our product pricing.

Another emerging trend at the state level is the establishment of prescription drug affordability boards, some of which will prospectively permit certain states to establish upper payment limits for drugs that the state has determined to be “high-cost.” Prescription drug affordability boards in several states, including Colorado, Maryland, Oregon, and Washington, have begun identifying products for affordability reviews and issuing information requests to manufacturers to determine whether upper payment limits may be justified.

Legislative and regulatory proposals have also been made to expand post-approval requirements and restrict sales and promotional activities for pharmaceutical products.

7 unchanged sentences

Furthermore, in some European countries, the authorities conduct an HTA to assess the cost-effectiveness of the product (in the UK that HTA assessment is conducted by the National Institute for Health and Care Excellence), which may significantly impact effective access to the market.

As of January 12, 2025, EU Health Technology Regulation No.

2021/2282 became applicable in respect of new oncology medicines.

Regulation No.

2021/2282 imposes a new procedure, a joint clinical assessment at a centralized level, as a mandatory step for the assessment of the pricing and reimbursement of medicinal products by national authorities.

It requires companies applying for products in scope to make relevant submissions for the joint clinical assessment, in line with a number of prespecified criteria.

If reimbursement of our drugs is unavailable or limited in scope or amount, or if pricing is set at unsatisfactory levels, our business could be materially harmed.

In particular, following the executive order of the Trump Administration of May 12, 2025, titled “Delivering Most-Favored-Nation Prescription Drug Pricing to American Patients,” there may be an unpredictable effect on prices of medicinal products in European countries.

The Executive Order directs federal agencies to implement policies that would align U.S.

prescription drug prices with the lowest prices paid by other comparable nations and mandates the Secretary of HHS to communicate “most-favored-nation” price targets to pharmaceutical manufacturers and, if significant progress is not achieved, to propose rulemaking to impose “most- favored nation” pricing across federal healthcare programs and potentially the private market.

For additional information, see the risk factor above titled “Current and future legislation may increase the difficulty and cost for us, and any collaborators, to obtain marketing approval of and commercialize our drug candidates and affect the prices we, or they, may obtain.” This policy may introduce significant risks to our future pricing strategies, revenue, and profitability in the U.S.

Additionally, the Executive Order instructs the Department of Commerce and the U.S.

Trade Representative to take action against foreign countries that engage in practices suppressing drug prices below fair market value, which could lead to increased pricing pressures or regulatory changes in international markets.

These developments, depending on whether and how they may be enacted, may adversely affect our global operations and financial performance.

Risks Related to Employees, Managing our Growth and Other Legal Matters

21 unchanged sentences

In addition, we have limited experience in product development.

We filed our first IND in December 2020 and currently have three drug candidates in ongoing Phase 1 trials, and expect to advance our drug candidate NX-5948 to a Phase 2 clinical trial in 2025.

We filed our first IND in December 2020, we currently have three drug candidates in ongoing Phase 1 trials, and we initiated a Phase 2 clinical trial for bexobrutideg in October 2025.

As our drug candidates enter and advance through preclinical studies and clinical trials, we will need to expand our development, regulatory and manufacturing capabilities or contract with other organizations to provide these capabilities for us.

39 unchanged sentences

In addition, such a breach may require notification to governmental agencies, the media or individuals pursuant to various federal and state data privacy and security laws (and other similar international laws), subject us to mandatory corrective action, and otherwise subject us to liability under laws and regulations that protect the privacy and security of personal information.

For example, data breaches frequently result in regulatory actions and commercial and class action litigation based on a variety of laws and legal duties, such as the California Consumer Privacy Act (CCPA), which provides for a private right of action in the event of certain data security breaches.

Additionally, the SEC adopted a new cybersecurity rule requiring companies subject to SEC reporting requirements to formally report material cybersecurity incidents, where failure to report may result in regulatory investigations leading to consent orders that may require additional compliance obligations and/or injunctions, fines and other penalties.

For example, data breaches frequently result in regulatory actions and commercial and class action litigation based on a variety of laws and legal duties, such as the California Consumer Privacy Act, as later amended by the California Privacy Rights Act (CCPA), which provides for a private right of action in the event of certain data security breaches.

Additionally, the SEC adopted a cybersecurity disclosure rule requiring companies subject to SEC reporting requirements to formally report material cybersecurity incidents, where failure to report may result in regulatory investigations leading to consent orders that may require additional compliance obligations and/or injunctions, fines and other penalties.

Such actions could result in significant legal and financial exposure and reputational damages that could have a material adverse effect on our business, financial condition, results of operations and prospects.

22 unchanged sentences

The HHS has enforcement discretion for HIPAA, and any enforcement activity can result in financial liability and reputational harm, and responses to such enforcement activity can consume significant internal resources.

On April 22, 2024, OCR issued a Final Rule, HIPAA Privacy Rule to Support Reproductive Health Care Privacy , which is intended to strengthen the HIPPA Privacy Rule by prohibiting the disclosure of protected health information related to lawful reproductive healthcare in certain circumstances.

In addition, states have shown an increased interest in regulating personal information in general and specifically in the privacy of health data.

On April 22, 2024, HHS issued a Final Rule, the HIPAA Privacy Rule to Support Reproductive Health Care Privacy, which is intended to strengthen the HIPPA Privacy Rule by prohibiting the disclosure of protected health information related to lawful reproductive healthcare in certain circumstances.

The Federal Trade Commission (FTC) has authority under Section 5 of the FTC Act to regulate unfair or deceptive practices, and has used this authority to initiate enforcement actions against companies that implement inadequate controls around privacy and information security in violation of their externally facing policies.

The FTC, as well as state attorneys general, have taken enforcement action against companies that do not abide by their representations to consumers regarding electronic security and privacy, including with respect to health information.

In addition, states have shown an increased interest in regulating the processing of personal information in general and specifically in the privacy of health data.

Washington state passed the My Health My Data Act, which took effect on March 31, 2024, and is focused on the collection of consumer health data.

2 unchanged sentences

Notably, Senate Bill 370 does not include a private right of action nor does it apply to entities that are subject to HIPAA.

Connecticut also amended its comprehensive privacy law in 2023, the Connecticut Data Privacy Act, to impose obligations aimed at “consumer health data.” Furthermore, state attorneys general are authorized to bring civil actions seeking either injunctions or damages in response to violations that threaten the privacy of state residents pursuant to local state laws.

Connecticut also amended its comprehensive privacy law in 2023, the Connecticut Data Privacy Act, to impose obligations aimed at “consumer health data.” Virginia also recently updated its Consumer Protection Act for certain health information and other states are considering health privacy legislation.

Furthermore, state attorneys general are authorized to bring civil actions seeking either injunctions or damages in response to violations that threaten the privacy of state residents pursuant to local state laws.

We cannot be sure how these regulations will be interpreted, enforced or applied to our operations.

2 unchanged sentences

state and international level, with new regulations coming into effect.

For example, the CCPA, which came into effect on January 1, 2020, and was amended and expanded by the California Privacy Rights Act (CPRA) as of January 1, 2023, provides California residents expanded privacy rights, including the right to request correction, access, and deletion of their personal information, the right to opt out of certain personal information sharing, and the right to receive detailed information about how their personal information is processed, including by California residents’ employers.

Additionally, the CCPA requires companies that process personal information of California residents to make disclosures to consumers about their data collection, use and sharing practices, allow consumers to opt out of certain data sharing with third parties, complete certain audits and assessments when processing higher risk data and provide a private right of action for data breaches, as described above.

For example, the CCPA, which came into effect on January 1, 2020, and was amended and expanded by the California Privacy Rights Act as of January 1, 2023, provides California residents expanded privacy rights, including the right to request correction, access, and deletion of their personal information, the right to opt out of personal information sharing with certain third parties for cross-context behavioral advertising purposes, the right to limit the use of sensitive personal information, and the right to receive detailed information about how their personal information is processed, including by California residents’ employers.

Additionally, the CCPA requires companies that process personal information of California residents to make disclosures to consumers about their data collection, use and sharing practices, complete certain audits and assessments when processing higher risk data and provide a private right of action for data breaches, as described above.

Although the CCPA includes limited exceptions—including exceptions for personal health information collected by covered entities or business associates subject to HIPAA, the CCPA may regulate or impact our processing of personal information depending on the context.

1 unchanged sentence

Notably, following California’s lead, over a third of other U.S.

states enacted or proposed privacy laws that contain obligations similar to the CCPA and CPRA that have taken effect or will take effect in coming years.

states enacted or proposed privacy laws that contain obligations similar to the CCPA that have taken effect or will take effect in coming years.

In addition, a comprehensive federal privacy bill, which includes a private right of action for violations, has been proposed and is under review by the U.S.

4 unchanged sentences

In the EU, the EU GDPR governs the collection, use, disclosure, transfer, or other processing of personal data.

The UK has implemented the EU GDPR as the UK GDPR which sits alongside the UK Data Protection Act 2018 (the UK GDPR together with the EU GDPR, the GDPR).

The GDPR imposes compliance obligations on controllers (and in more limited cases, on processors), including granting certain privacy rights to individuals to control how companies collect, use, disclose, retain and otherwise process their personal data as well as specific requirements for obtaining valid consent where consent is the legal basis for processing, requirements around accountability and transparency, the obligation to consider data protection when any new products or services are developed, the obligation to appoint data protection officers in certain circumstances, the obligation to notify relevant data protection supervisory authorities of notifiable personal data breaches without undue delay (and no later than 72 hours) after becoming aware of the personal data breach, and the requirement to provide more detailed notices for clinical trial subjects and investigators.

The UK has implemented the EU GDPR as the UK GDPR, which sits alongside the UK Data Protection Act 2018;

the UK Data Protection Act 2018 has been amended by the UK Data (Use and Access) Act 2025, which implements certain changes in relation to the UK GDPR and reforms the use of personal and non-personal data (the UK GDPR together with the EU GDPR, the GDPR).

The GDPR imposes compliance obligations on controllers (and in more limited cases, on processors), including (among others) granting certain privacy rights to individuals to control how companies collect, use, disclose, retain and otherwise process their personal data as well as specific requirements for obtaining valid consent where consent is the legal basis for processing, requirements around accountability and transparency, the obligation to consider data protection when any new products or services are developed, the obligation to appoint data protection officers in certain circumstances, the obligation to notify (i) relevant data protection supervisory authorities of personal data breaches without undue delay (and no later than 72 hours) after becoming aware of the personal data breach, unless the personal data breach is unlikely to result in a risk to the data subjects’ rights and freedoms;

and (ii) affected individuals, where the personal data breach is likely to result in a high risk to their rights and freedoms, whereas processors are required to notify the controller without undue delay after becoming aware of a personal data breach, and the requirement to provide more detailed notices for clinical trial subjects and investigators.

In addition, the EU GDPR prohibits the international transfer of personal data originating in the EEA (including, from clinical trial sites and other third parties (e.g., CROs)) to jurisdictions that the European Commission does not recognize as having ‘adequate’ data protection laws, unless a data transfer mechanism has been put in place or a derogation under the EU GDPR can be relied upon.

In certain cases, including when transfers are made in reliance on standard contractual clauses (EU SCCs), including a requirement for companies to carry out a transfer impact assessment (TIA)—which (among other things) assesses laws governing access to personal data in the recipient country and considers whether supplementary measures that provide privacy protections additional to those provided under EU SCCs—will need to be implemented to ensure an ‘essentially equivalent’ level of data protection to that afforded in the EEA.

In certain cases, for example, when transfers are made in reliance on standard contractual clauses (EU SCCs), there is a requirement for companies to carry out a transfer impact assessment (TIA)—which (among other things) assesses laws governing access to personal data in the recipient country and considers whether supplementary measures that provide privacy protections additional to those provided under EU SCCs—will need to be implemented to ensure an ‘essentially equivalent’ level of data protection to that afforded in the EEA.

On July 10, 2023, the European Commission adopted its Final Implementing Decision granting the U.S.

4 unchanged sentences

national security safeguards and redress.

Under the UK GDPR, companies not established in the UK but who process personal data in relation to the offering of goods or services to individuals in the UK, or to the monitoring of their behavior will be subject to the UK GDPR—the requirements of which at this time are largely aligned with those under the EU GDPR.

The European Commission has adopted an adequacy decision in favor of the UK, enabling data transfers from EU Member States to the UK without additional safeguards.

However, the UK adequacy decision will automatically expire in June 2025 unless the European Commission reassesses and renews/extends that decision, and remains under review by the European Commission during this period.

Under the UK GDPR, companies not established in the UK but who process personal data in relation to the offering of goods or services to individuals in the UK, or to the monitoring of the behavior of individuals in the UK, will be subject to the UK GDPR.

On December 19, 2025, the European Commission adopted its most recent adequacy decision in favor of the UK, enabling data transfers from EU Member States to the UK without additional safeguards until December 27, 2031.

The UK GDPR also imposes similar restrictions on transfers of personal data from the UK to jurisdictions that the UK Government does not consider adequate, including the United States.

5 unchanged sentences

data bridge (i.e., a UK equivalent of the Adequacy Decision) and adopted UK regulations to implement the UK-U.S.

Personal data may now be transferred from the UK under the UK-U.S.

Personal data may be transferred from the UK under the UK-U.S.

data bridge through the UK extension to the DPF to organizations self-certified under the UK extension to the DPF.

2 unchanged sentences

In the EU and other markets, potential new rules and restrictions on the flow of data across borders could increase the cost and complexity of doing business in those regions.

As a company, we have invested, and expect to continue to invest, significant time and resources in our GDPR compliance program.

As a company, we have invested, and expect to continue to invest, significant time and resources in our DPF certification and GDPR compliance program.

This is necessary to ensure we can initiate and maintain GDPR-compliant clinical trials in the EU or UK (as applicable).

19 unchanged sentences

AI also presents emerging ethical issues and if our use of AI becomes controversial, we may experience brand or reputational harm, competitive harm, or legal liability.

Legislation governing the development and use of AI has been passed or is under consideration in the United States at the state and local level, as well as internationally.

Legislation and regulations governing the development and use of AI have been passed or are under consideration in the United States at the state and local level, as well as internationally.

As a result, the ability to use artificial intelligence and machine learning may be constrained by current or future laws, regulatory or self-regulatory requirements.

13 unchanged sentences

Although there are legislative proposals to repeal or defer the capitalization requirement to later years, there can be no assurance that the provision will be repealed or otherwise modified.

Further, beginning with our 2025 tax year, the One Big Beautiful Bill Act restored immediate deductibility of domestic expenditures, while foreign expenditures will continue to be capitalized and amortized over 15 years.

Effective for transactions occurring on or after January 1, 2023, the IRA imposed a new one percent excise tax on certain repurchases of stock by publicly traded U.S.

81 unchanged sentences

Furthermore, our stock price may decline due in part to the volatility of the stock market and any general economic downturn.

We may be exposed to foreign exchange risk.

We incur portions of our expenses, and may in the future derive revenues, in a variety of currencies.

As a result, we may be exposed to foreign currency exchange risk as our results of operations and cash flows are subject to fluctuations in foreign currency exchange rates.

If in the future we incur greater portions of our expenses, or derive future revenues, from foreign currencies, fluctuations in currency exchange rates could have an impact on our results as expressed in U.S.

In addition, recent actions taken by the U.S.

government may further impact the value of the U.S.

dollar relative to other currencies, which may have the result of increasing the portions of our expenses which are realized in other currencies.

We currently do not engage in hedging transactions to protect against uncertainty in future exchange rates between particular foreign currencies and the U.S dollar.

We cannot predict the impact of foreign currency fluctuations, and foreign currency fluctuations in the future may adversely affect our business, financial condition, results of operations and prospects.

Our current operations are in the San Francisco Bay Area, and we or the third parties upon whom we depend may be adversely affected by earthquakes or other natural disasters as to which our business continuity and disaster recovery plans may not be adequate to protect us.

75 unchanged sentences

We may choose to raise additional capital in the future, depending on market conditions, strategic considerations and operational requirements.

For example, in March 2021, we sold an additional 5,175,000 shares of our common stock in a follow-on public offering;

in July 2022, we entered into separate Securities Purchase Agreements with certain purchasers to issue and sell pre-funded warrants to purchase an aggregate of 6,814,920 shares of our common stock in registered direct offerings;

and in April 2024, we sold an additional 11,916,667 shares of our common stock and pre-funded warrants to purchase an aggregate of 1,500,100 shares of our common stock in a public offering.

Such pre-funded warrants are immediately exercisable, have an exercise price of $0.001 and may be exercised at any time after the date of issuance.

For example, in April 2024, we sold an additional 11,916,667 shares of our common stock and pre-funded warrants to purchase an aggregate of 1,500,100 shares of our common stock in a public offering and in October 2025, we sold an additional 24,485,799 shares of our common stock in a registered direct offering.

The pre-funded warrants sold in April 2024 are immediately exercisable, have an exercise price of $0.001 and may be exercised at any time after the date of issuance.

In addition, we currently have on file with the SEC an automatic shelf registration statement on Form S-3 which allows us to offer and sell our registered common stock, preferred stock, debt securities, warrants, subscriptions rights and or units from time to time pursuant to one or more offerings at prices and terms to be determined at the time of sale.

48 unchanged sentences

Alternatively, if a court were to find the choice of forum provision contained in our restated certificate of incorporation and/or amended and restated bylaws to be inapplicable or unenforceable in an action, we may incur additional costs associated with resolving such action in other jurisdictions, which could harm our business, results of operations and financial condition.

We will continue to incur increased costs as a result of operating as a public company, and our management will be required to devote substantial time to new compliance initiatives and corporate governance practices.

We incur significant costs as a result of operating as a public company, and our management is required to devote substantial time to compliance initiatives and corporate governance practices.

As a public company, we incur significant legal, accounting and other expenses.

We are subject to the reporting requirements of the Exchange Act, the Sarbanes-Oxley Act, the Dodd-Frank Wall Street Reform and Consumer Protection Act, the listing requirements of Nasdaq and other applicable securities rules and regulations which impose various requirements on public companies, including establishment and maintenance of effective disclosure and financial controls and corporate governance practices.

We are subject to the reporting requirements of the Exchange Act, the Sarbanes-Oxley Act, the Dodd-Frank Wall Street Reform and Consumer Protection Act, the listing requirements of Nasdaq and other applicable securities rules and regulations which impose various requirements on public companies, including maintenance of effective disclosure and financial controls and corporate governance practices.

Compliance with these rules and regulations may strain our financial and management systems, internal controls, and employees.

For example, the Exchange Act requires, among other things, that we file annual, quarterly, and current reports with respect to our business and results of operations and the disclosure requirements under the Exchange Act are subject to change from time to time.

Complying with these new disclosure obligations once applicable to our company, or any or any additional new disclosure requirements that may apply to us in the future, could cause us to incur substantial costs and could increase negative publicity surrounding any incident that we are required to disclose.

Complying with these disclosure obligations or any new disclosure requirements that may apply to us in the future, could cause us to incur substantial costs and could increase negative publicity surrounding any incident that we are required to disclose.

Any failure or perceived failure by us to comply with these obligations may also subject us to enforcement action or litigation, any of which could harm our business.

Therefore, as a result of being a public company, our management and other personnel are required to devote a substantial amount of time to these compliance initiatives.

Moreover, these rules and regulations have increased our legal and financial compliance costs and have made some activities more time-consuming and costly.

Moreover, these rules and regulations result in high legal and financial compliance costs and have made some activities time-consuming and costly.

We cannot predict or estimate the amount or timing of additional costs we may incur to respond to these requirements.

9 unchanged sentences

The reporting on our assessment of the effectiveness of our internal control over financial reporting needs to include disclosure of any material weaknesses identified in our internal control over financial reporting.

Moreover, based on the market value of our common stock held by non-affiliates as of May 31, 2024, we are considered a large accelerated filer under SEC rules effective November 30, 2024, and, as a result, our independent registered public accounting firm is required to audit the effectiveness of our internal control over financial reporting pursuant to Section 404(b) of the Sarbanes-Oxley Act (Section 404(b)).

Moreover, based on the market value of our common stock held by non-affiliates as of May 31, 2025, we will continue to be considered a large accelerated filer under SEC rules for the fiscal year ending November 30, 2026, and, as a result, our independent registered public accounting firm will be required to audit the effectiveness of our internal control over financial reporting pursuant to Section 404(b) of the Sarbanes-Oxley Act (Section 404(b)).

Compliance with Section 404(b) will result in increased costs, expenses, and management resources.

9 unchanged sentences

In addition, if we are not able to continue to meet these requirements, we may not be able to remain listed on Nasdaq.

We no longer qualify as a “smaller reporting company” and, commencing with our quarterly report on Form 10-Q for the fiscal quarter ending February 28, 2025, we may no longer take advantage of reduced disclosure and reporting requirements applicable to smaller reporting companies.

Based on the market value of our common stock held by our non-affiliates as of May 31, 2024, we no longer qualify as a “smaller reporting company” as defined by the SEC effective November 30, 2024.

Therefore, beginning with our quarterly report on Form 10-Q for the fiscal quarter ending February 28, 2025, we will no longer be eligible to rely on the reduced disclosure and reporting requirements applicable to smaller reporting companies.

Moreover, we have chosen not to take advantage of the reduced disclosure and reporting requirements applicable to smaller reporting companies starting with this Annual Report on Form 10-K.

Any failure to comply with the increased disclosure and reporting requirements could have an adverse effect on our business, financial condition and results of operations.

Because we do not anticipate paying any cash dividends on our capital stock in the foreseeable future, capital appreciation, if any, will be your sole source of gain.

8 unchanged sentences

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1A. Risk Factors