Item 1A. Risk Factors
Item 1A. Risk Factors.
Below are material changes to the risk factors set forth under the caption “Risk Factors” in Part II, Item 1A of the Annual Report, which are incorporated herein by reference. The risks described in the Annual Report and below are not the only ones we face. Additional risks that we currently do not know about or that we currently believe to be immaterial may also impair our business, financial condition, operating results, liquidity, and future prospects.
Risks Related to Privacy and Security
A security breach or other significant disruption to our information technology systems or data, or those of our third-party business partners, or failures of our software used with our pumps to perform as we anticipate, could materially disrupt our operations or compromise sensitive information relating to our customers, suppliers, employees or other individuals, which could damage our relationships, expose us to litigation or regulatory proceedings, or harm our reputation.
The efficient operation of our business depends on our information technology and communication systems, as well as those of our suppliers, contract manufacturers, distributors and other third-party business partners. We rely on such systems to effectively store, process and transmit confidential, personal, or other sensitive data, including health information, proprietary sales and marketing data, accounting and financial information, manufacturing and quality records, inventory management data, product development tasks, research and development data, customer service and technical support information. These systems and the underlying data are vulnerable to damage or interruption from a number of causes, including earthquakes, fires, floods and other natural disasters, terrorist attacks, attacks by computer viruses or hackers, malware, ransomware or other destructive software, cyber-attacks, social-engineering attacks, malicious code, denial-of-service attacks, credential harvesting, supply chain attacks, power losses, and computer system, data network failures, and other similar threats. Cyber-attacks, malicious internet-based activity, online and offline fraud, and other similar activities are prevalent and continue to rise, are increasingly difficult to detect, and come from a variety of sources, including traditional computer “hackers,” threat actors, “hacktivists,” organized criminal threat actors, personnel (such as through theft or misuse), sophisticated nation states, and nation-state-supported actors. Some actors now engage and are expected to continue to engage in cyber-attacks, including without limitation nation-state actors for geopolitical reasons and in conjunction with military conflicts and defense activities. Notably, severe ransomware attacks are becoming increasingly prevalent and can lead to significant interruptions in our operations, loss of sensitive data and income, reputational harm, and diversion of funds. Extortion payments may alleviate the negative impact of a ransomware attack, but we may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting such payments.
Should any of the risks described herein occur, it could also result in the loss, theft, misuse, unauthorized disclosure, or unauthorized access of such sensitive information, which could lead to significant reputational or competitive harm, litigation involving us or our business partners, regulatory proceedings, or substantial liabilities, fines, penalties or expenses. Further, many of our third-party service providers are subject to similar risks. We rely on third-party service providers and technologies to operate critical business systems to process sensitive information in a variety of contexts, including, without limitation, cloud-based infrastructure, data center facilities, encryption and authentication technology, employee email, and other functions and systems. Our ability to monitor these third parties’ information security practices is limited, and these third parties may not have adequate information security measures in place. If our third-party service providers experience a security incident or other interruption, we could experience adverse consequences. While we may be entitled to damages if our third-party service providers fail to satisfy their privacy- or security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such an award. In addition, supply chain attacks have increased in frequency and severity, and we cannot guarantee that third parties’ infrastructure in our supply chain or our third-party partners’ supply chains have not been compromised.
39
In addition to the risks regarding information technology systems and processing of sensitive information, our insulin pumps and other products rely on software, some of which is developed by third-party service providers, that could contain vulnerabilities. We take steps to detect and remediate vulnerabilities, but we may not be able to detect and remediate all vulnerabilities because the threats and techniques used to exploit the vulnerability change frequently and are often sophisticated in nature. Therefore, such vulnerabilities could be exploited but may not be detected until after a security incident has occurred. These vulnerabilities pose material risks to our business. Further, we may experience delays in developing and deploying remedial measures designed to address any such identified vulnerabilities. These risks significantly increased when we began use of our Tandem Device Updater, which enables customers to remotely update software on their insulin pumps and may be higher after we launched our new mobile application in the second half of 2020. These risks may have further increased in the second half of 2022 when we enabled users to control insulin boluses through the mobile app.
Moreover, remote work has become more common and has increased risks to our information technology systems and data, as more of our employees use network connections, computers and devices outside our premises or network, including working at home, while in transit, and in public locations. Additionally, future or past business transactions (such as acquisitions or integrations) could expose us to additional cybersecurity risks and vulnerabilities, as our systems could be negatively affected by vulnerabilities present in acquired or integrated entities’ systems and technologies. Furthermore, we may discover security issues that were not found during due diligence of such acquired or integrated entities, and it may be difficult to integrate companies into our information technology environment and security program.
We may expend significant resources or modify our business activities to try to protect against security incidents. Whether or not our security measures and those of our third-party service providers are ultimately successful, our expenditures on those measures could have an adverse impact on our financial condition and results of operations, and divert management’s attention from pursuing our strategic objectives. Certain data privacy and security obligations may require us to implement and maintain reasonable or specific security measures or industry standards to protect our information technology systems and sensitive information.
Applicable data privacy and security obligations may require us to notify relevant stakeholders of security incidents. Such disclosures are costly, and the disclosure or the failure to comply with such requirements could lead to adverse consequences. If we (or a third party upon whom we rely) experience a security incident (such as the incident described below) or are perceived to have experienced a security incident, we may experience adverse consequences, such as government enforcement actions (for example, investigations, fines, penalties, audits, and inspections); additional reporting requirements and/or oversight; restrictions on processing sensitive information (including personal data); litigation (including class claims); indemnification obligations; negative publicity; reputational harm; monetary fund diversions; interruptions in our operations (including availability of data); financial loss; and other similar harms. Security incidents and attendant consequences may cause customers to stop using our products, deter new customers from using our products, and negatively impact our ability to grow and operate our business.
Our contracts may not contain limitations of liability, and even where they do, there can be no assurance that limitations of liability in our contracts are sufficient to protect us from liabilities, damages, or claims related to our data privacy and security obligations. We cannot be sure that our insurance coverage will be adequate or sufficient to protect us from or to mitigate liabilities arising out of our privacy and security practices, that such coverage will continue to be available on commercially reasonable terms or at all, or that such coverage will pay future claims.
In addition to experiencing a security incident, third parties may gather, collect, or infer sensitive information about us from public sources, data brokers, or other means that reveals competitively sensitive details about our organization and could be used to undermine our competitive advantage or market position. The failure of our or our service providers’ information technology systems or our pumps’ software or other mobile or cloud applications to perform as we anticipate, or our failure to effectively identify, investigate and mitigate potential threats through ongoing maintenance and enhancement of software applications, information technology systems and privacy policies and controls, could disrupt our entire operation or adversely affect our software products. For example, we market our Tandem Device Updater as having the unique capability to deploy software updates to our pumps, which may allow customers remote access to new and enhanced features. The failure of our Tandem Device Updater to provide software updates as we anticipate, including as a result of our inability to secure and maintain necessary regulatory approvals, the inability of our pumps to properly receive software updates, errors or viruses embedded within the software being transmitted, or the failure of our customers to properly use the system to complete the update, could result in decreased sales, increased warranty costs, and harm to our reputation, any of which could have a material adverse effect on our business, financial condition and operating results.
40
We may be subject to stringent and evolving U.S. and foreign laws, regulations, rules, contractual obligations, policies and other obligations related to data privacy and security. Our actual or perceived failure to comply with such obligations could lead to regulatory investigations or actions; litigation (including class claims); fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; loss of customers or sales; and other adverse business consequences.
In the ordinary course of business, we collect, receive, store, process, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, and share (collectively, process (or processing)) sensitive information. Our data processing activities may subject us to numerous data privacy and security obligations, such as various laws, regulations, guidance, industry standards, external and internal privacy and security policies, contractual requirements, and other obligations relating to data privacy and security.
There are a number of laws in the United States governing the privacy and security of personal information, including data breach notification laws, personal data privacy laws, consumer protection laws (e.g., Section 5 of the Federal Trade Commission Act), and other similar laws (e.g., wiretapping laws). For example, the U.S. Health Insurance Portability and Accountability Act of 1996 (HIPAA) as amended by the Health Information Technology for Economic and Clinical Health Act (“HITECH”), imposes specific requirements relating to the privacy, security, and transmission of individually identifiable protected health information.
For example, the Controlling the Assault of Non-Solicited Pornography and Marketing Act of 2003 ("CAN-SPAM”) and the Telephone Consumer Protection Act of 1991 (“TCPA”) impose specific requirements on communications with customers. For example, the TCPA imposes various consumer consent requirements and other restrictions on certain telemarketing activity and other communications with consumers by phone, fax or text message. TCPA violations can result in significant financial penalties, including penalties or criminal fines imposed by the Federal Communications Commission or fines of up to $1,500 per violation imposed through private litigation or by state authorities.
As another example, the California Consumer Privacy Act of 2018 (CCPA), as amended by the California Privacy Rights Act of 2020 (CPRA), applies to personal information of consumers, business representatives, and employees who are California residents, and requires businesses to provide specific disclosures in privacy notices and honor requests of such individuals to exercise certain privacy rights. The CCPA provides for administrative fines of up to $7,500 per violation and allows private litigants affected by certain data breaches to recover significant statutory damages. Although the CCPA exempts some data processed in the context of clinical trials, the CCPA increases compliance costs and potential liability with respect to other personal data we maintain about California residents. In addition, the CPRA expanded the CCPA’s requirements, including by adding a new right for individuals to correct their personal information and establishing a new regulatory agency to implement and enforce the law. Other states, such as Virginia and Colorado, have also passed comprehensive privacy laws, and similar laws are being considered in several other states, as well as at the federal and local levels. While these states, like the CCPA, also exempt some data processed in the context of clinical trials, these developments further complicate compliance efforts, and increase legal risk and compliance costs for us, the third parties upon whom we rely, and our customers.
Outside the United States, an increasing number of laws, regulations, and industry standards govern data privacy and security. For example, the European Union’s General Data Protection Regulation (“EU GDPR”), the United Kingdom’s GDPR (“UK GDPR”), and Canada’s Personal Information and Electronic Documents Act (PIPEDA) or the applicable provincial alternatives, impose strict requirements for processing personal data.
For example, under the EU GDPR, companies may face temporary or definitive bans on data processing and other corrective actions; fines of up to 20 million Euros / 17.5 million pounds sterling under the UK GDPR or, in each case, 4% of annual global revenue, whichever is greater; or private litigation related to processing of personal data brought by classes of data subjects or consumer protection organizations authorized at law to represent their interests. In Canada, the Personal Information Protection and Electronic Documents Act (“PIPEDA”) and various related provincial laws, as well as Canada’s Anti-Spam Legislation (“CASL”), may apply to our operations.
Additionally, regulators are increasingly scrutinizing companies that process children’s data. Numerous laws, regulations, and legally-binding codes, such as the Children’s Online Privacy Protection Act (“COPPA”), California’s Age Appropriate Design Code (effective in July 2024), the CCPA and CPRA, other U.S. state comprehensive privacy laws, the EU and UK GDPR, and the UK Age Appropriate Design Code, impose various obligations on companies that process children data, including by requiring certain consents to process such data and extending certain rights to children and their parents with respect that data. Some of these obligations have wide ranging applications, including for services that do not intentionally target child users (defined in some circumstances as a user under the age of 18 years old).
41
In the ordinary course of business, we may transfer personal data from Europe and other jurisdictions to the United States or other countries. Europe and other jurisdictions have enacted laws requiring data to be localized or limiting the transfer of personal data to other countries. In particular, the European Economic Area (EEA) and the UK have significantly restricted the transfer of personal data to the United States and other countries whose privacy laws it believes are inadequate. Other jurisdictions may adopt similarly stringent interpretations of their data localization and cross-border data transfer laws. Although there are currently various mechanisms that may be used to transfer personal data from the EEA and UK to the United States in compliance with law, such as the EEA and UK’s standard contractual clauses, these mechanisms are subject to legal challenges, and there is no assurance that we can satisfy or rely on these measures to lawfully transfer personal data to the United States. If there is no lawful manner for us to transfer personal data from the EEA, the UK or other jurisdictions to the United States, or if the requirements for a legally-compliant transfer are too onerous, we could face significant adverse consequences, including the interruption or degradation of our operations, the need to relocate part of or all of our business or data processing activities to other jurisdictions at significant expense, increased exposure to regulatory actions, substantial fines and penalties, the inability to transfer data and work with partners, vendors and other third parties, and injunctions against our processing or transferring of personal data necessary to operate our business. Additionally, companies that transfer personal data out of the EEA and UK to other jurisdictions, particularly to the United States, are subject to increased scrutiny from regulators, individual litigants, and activist groups. Some European regulators have ordered certain companies to suspend or permanently cease certain transfers out of Europe for allegedly violating the GDPR’s cross-border data transfer limitations. Additionally, in May 2023, the Irish Data Protection Commission determined that a major social media company’s use of the standard contractual clauses to transfer personal data from Europe to the United States was insufficient and levied a 1.2 billion Euro fine against the company and prohibited the company from transferring EU personal data to the United States.
In addition to data privacy and security laws, we are contractually subject to industry standards adopted by industry groups and we are, or may become subject to such obligations in the future. For example, we may also be subject to the Payment Card Industry Data Security Standard (“PCI DSS”). The PCI DSS requires companies to adopt certain measures to ensure the security of cardholder information, including using and maintaining firewalls, adopting proper password protections for certain devices and software, and restricting data access. Noncompliance with PCI-DSS can result in penalties ranging from $5,000 to $100,000 per month by credit card companies, litigation, damage to our reputation, and revenue losses. We are also bound by contractual obligations related to data privacy and security, and our efforts to comply with such obligations may not be successful. For example, certain privacy laws, such as the GDPR and the CCPA, require our customers to impose specific contractual restrictions on their service providers. Additionally, some of our customer contracts require us to host personal data locally. We publish privacy policies, marketing materials and other statements, such as compliance with certain certifications or self-regulatory principles, regarding data privacy and security. If these policies, materials or statements are found to be deficient, lacking in transparency, deceptive, unfair, or misrepresentative of our practices, we may be subject to investigation, enforcement actions by regulators or other adverse consequences.
Obligations related to data privacy and security are quickly changing, becoming increasingly stringent, and creating regulatory uncertainty. Additionally, these obligations may be subject to differing applications and interpretations, which may be inconsistent or conflict among jurisdictions. Preparing for and complying with these obligations requires us to devote significant resources, which may necessitate changes to our services, information technologies, systems, and practices and to those of any third parties that process personal data on our behalf. In addition, these obligations may require us to change our business model. We may at times fail (or be perceived to have failed) in our efforts to comply with our data privacy and security obligations. Moreover, despite our efforts, our personnel or third parties on whom we rely may fail to comply with such obligations, which could negatively impact our business operations.
If we or the third parties on which we rely fail, or are perceived to have failed, to address or comply with applicable data privacy and security obligations, we could face significant consequences, including but not limited to: government enforcement actions (e.g., investigations, fines, penalties, audits, inspections, and similar); litigation (including class-action claims) and mass arbitration demands; additional reporting requirements and/or oversight; bans on processing personal data; orders to destroy or not use personal data; and imprisonment of company officials. In particular, plaintiffs have become increasingly more active in bringing privacy-related claims against companies, including class claims and mass arbitration demands. Some of these claims allow for the recovery of statutory damages on a per violation basis; if viable, these claims carry the potential for monumental statutory damages, depending on the volume of data and the number of violations.
Any of these events could have a material adverse effect on our reputation, business, or financial condition, including but not limited to: loss of customers; interruptions or stoppages in our business operations (including, as relevant, clinical trials); inability to process personal data or to operate in certain jurisdictions; limited ability to develop or commercialize our products; expenditure of time and resources to defend any claim or inquiry; adverse publicity; or substantial changes to our business model or operations.
42
Risks Related to Our Regulatory Environment
New products or modifications to our existing products may require new 510(k) clearances, PMAs or certifications, or may require us to cease marketing or recall the modified products until clearances, certifications or approvals are obtained.
Any modification to a 510(k)-cleared device that could significantly affect its safety or effectiveness, or that would constitute a major change in its intended use, design, or manufacture, requires a new 510(k) clearance or, possibly, a PMA. The FDA requires every manufacturer to make this determination in the first instance, but the FDA may review any manufacturer’s decision. The FDA may not agree with our decisions regarding whether new clearances or approvals are necessary for changes that we have made to our products. If the FDA disagrees with our determination and requires us to submit new 510(k) notifications or PMAs for modifications to our previously cleared or approved products, for which we concluded that new clearances or approvals were not necessary, we may be required to cease marketing or to recall the modified product until we obtain clearance or approval, and we may be subject to significant regulatory fines or penalties.
Further, the FDA’s ongoing review of and potential changes to the 510(k) program may make it more difficult for us to modify our previously cleared products, either by imposing stricter requirements on when a new 510(k) for a modification to a previously cleared product must be submitted, or by applying more onerous review criteria to such submissions.
For those medical devices sold in the EU and for which we have obtained a CE Certificate of Conformity by a Notified Body, we must notify our Notified Body if significant changes are made to the products or if there are substantial changes to our quality assurance systems affecting those products. Obtaining variation of existing CE Certificates of Conformity or a new CE Certificate of Conformity can be a time-consuming process, and delays in obtaining required future clearances, certifications or approvals would adversely affect our ability to introduce new or enhanced products in a timely manner, which in turn would harm our future growth.
A recall or suspension of our products, or the discovery of serious safety issues with our products, could have a significant negative impact on us.
The FDA and equivalent foreign regulatory authorities have the authority to require the recall or suspension, either temporarily or permanently, of commercialized products in the event of material deficiencies or defects in quality systems, product design or manufacture or in the event that a product poses an unacceptable risk to health. Regulatory authorities have broad discretion to require the recall or suspension of a product or to require that manufacturers alert customers of safety risks, and may do so even in circumstances where we do not believe our product poses an unacceptable risk to health. In addition, manufacturers may, under their own initiative, recall a product or suspend sales if any material deficiency in a product is found or alert customers of unanticipated safety risks. A government-mandated or voluntary recall or suspension by us, one of our distributors or any of our other third-party suppliers could occur as a result of an unacceptable risk to health, component failures, manufacturing errors, design or labeling defects or other deficiencies and issues. Recalls, suspensions or other notices relating to any products that we distribute would divert managerial and financial resources, and have an adverse effect on our reputation, financial condition and operating results.
Further, under the FDA’s Medical Device Reporting regulations and equivalent regulations and requirements in other geographies, we are required to maintain appropriate quality systems and report incidents in which our product may have caused or contributed to serious injury or death in which our product malfunctioned and, if the malfunction were to recur, would likely cause or contribute to serious injury or death. Repeated product malfunctions may result in a voluntary or involuntary product recall or suspension of product sales, which could divert managerial and financial resources, impair our ability to manufacture our products in a cost-effective and timely manner and have an adverse effect on our reputation, financial condition and operating results. We have initiated product recalls in the past, and our risk of future product recalls may increase as we launch new products or offer new software updates for existing products.
43
Any adverse event involving any products that we distribute could result in future voluntary corrective actions, such as recalls or customer notifications, or regulatory authority action, which could include inspection, mandatory recall or other enforcement action. For example, the Australian Therapeutic Goods Administration (TGA) temporarily suspended our pump product sales in Australia starting November 24, 2020, however sales of pump-related supplies were allowed to continue. Effective April 1, 2021, following discussions with the TGA, the temporary suspension was lifted for our t:slim X2 with Basal-IQ technology, subject to certain post-market surveillance obligations and other conditions. We discontinued sales of earlier generation products in Australia and we started offering our Control-IQ technology in Australia. There can be no assurance that the TGA will not reimpose the suspension of our pump product sales or impose other regulatory restrictions in the future. In addition, other regulatory authorities may take similar actions against us, and any regulatory challenges we encounter could have a negative impact on our product sales and harm our reputation. Any corrective actions we take in response to this action or future matters with the TGA or other regulatory authorities, whether voluntary or involuntary, will require the dedication of our time and capital, may distract management from operating our business, may harm our reputation and financial results or could result in additional regulatory scrutiny in other geographies.
In addition, we may be required to conduct costly post-market testing and surveillance to monitor the safety or effectiveness of our products in the EU. We must comply with medical device reporting requirements, including the reporting of adverse events and malfunctions related to our products. Later discovery of previously unknown problems with our products, including unanticipated adverse events or adverse events of unanticipated severity or frequency, manufacturing problems, or failure to comply with regulatory requirements may result in changes to labeling, restrictions on such products or manufacturing processes, withdrawal of the products from the market, voluntary or mandatory recalls, a requirement to repair, replace or refund the cost of any medical device we manufacture or distribute, fines, suspension, variation or withdrawal of CE Certificates of Conformity, product seizures, injunctions or the imposition of civil or criminal penalties that would adversely affect our business, operating results and prospects.
Legislative or regulatory healthcare reforms, or other regulatory reforms, may result in downward pressure on the price of and decrease reimbursement for our products, and uncertainty regarding the healthcare regulatory environment could have a material adverse effect on our business.
The sales of our products depend in part on the availability of coverage and reimbursement from third-party payors such as government health administration authorities, private health insurers, health maintenance organizations and other healthcare-related organizations. Both the federal and state governments in the United States continue to propose and pass new legislation and regulations designed to, among other things, expand healthcare coverage to more individuals, contain or reduce the cost of healthcare, and improve the quality of healthcare outcomes. For example, the Affordable Care Act has substantially changed the way healthcare is financed by both governmental and private insurers and encourages improvements in the quality of healthcare items and services. In the future, additional changes could be made to governmental healthcare programs that could significantly impact the success of our products. This legislation and regulation may result in decreased reimbursement for medical devices, which may create additional pressure to reduce the prices charged for medical devices. Reduced reimbursement rates could significantly decrease our revenue, which in turn would place significant downward pressure on our gross margins and impede our ability to become profitable.
We cannot predict which, if any, additional healthcare reform proposals will be adopted, when they may be adopted or what impact they may have on the existing regulatory environment, or our ability to operate our business. Any of these factors could have a material adverse effect on our operating results and financial condition.
In the EU, the MDR became applicable on May 26, 2021, repealing and replacing both the MDD and Directive 90/385/EEC on active implantable medical devices. The MDR establishes transitional provisions. However, the changes to the regulatory system implemented in the EU by the MDR include stricter requirements for clinical evidence and pre-market assessment of safety and performance, new classifications to indicate risk levels, requirements for third party testing by Notified Bodies, tightened and streamlined quality management system assessment procedures and additional requirements for the quality management system, additional requirements for traceability of products and transparency as well a refined responsibility of economic operators. We are also required to provide clinical data in the form of a clinical evaluation report. Fulfillment of the obligations imposed by the MDR may cause us to incur substantial costs. We may be unable to fulfil these obligations, or our Notified Body may consider that we have not adequately demonstrated compliance with our related obligations to merit a CE Certificate of Conformity on the basis of the MDR.
44
Moreover, in the EU, some EU Member States may, after a medical device is CE marked, require the completion of additional studies that compare the cost-effectiveness of a particular medical device candidate to currently available therapies. This Health Technology Assessment, or HTA process, which is currently governed by the national laws of the individual EU Member States, is the procedure according to which the assessment of the public health impact, therapeutic impact and the economic and societal impact of use of a given medical device in the national healthcare systems of the individual country is conducted. The outcome of HTA regarding specific medical device will often influence the pricing and reimbursement status granted to these products by the competent authorities of individual EU Member States. In December 2021, Regulation No 2021/2282 on HTA, amending Directive 2011/24/EU, was adopted in the EU. This Regulation, which entered into force in January 2022 and will apply as of January 2025, is intended to boost cooperation among EU Member States in assessing health technologies and providing the basis for cooperation at EU level for joint clinical assessments in these areas. If we are unable to obtain or maintain favorable pricing and reimbursement status in EU Member States for our medical devices or medical devices that we may successfully develop and for which we may obtain certification, any anticipated revenue from and growth prospects for those products in the EU could be negatively affected.
In addition, the exit of the UK from the EU, commonly referred to as “Brexit” could lead to regulatory divergence between the EU and the UK. On May 26, 2021, the MDR became applicable in the EU. However, the MDR is not applicable in the UK. In the UK, medical devices are governed by the Medical Devices Regulations 2002 (SI 2002 No 618, as amended) (UK MDR 2002) which, for the time being, retains a regulatory framework similar to the framework set out by the MDD. The government plans to introduce new legislation governing medical devices with an aim for core aspects of the future regime for medical devices to apply from July 1, 2025. New legislation is also anticipated later in 2023 to bring into force strengthened post-market surveillance requirements ahead of the wider future regulatory regime. These post-market surveillance requirements are expected to apply from mid-2024. Should the UK or Great Britain further diverge from the EU from a regulatory perspective, tariffs could be put into place in the future. We could therefore, both now and in the future, face significant additional expenses to operate our business, which could significantly and materially harm or delay our ability to generate revenue or achieve profitability of our business. Any further changes in international trade, tariff and import/export regulations as a result of Brexit or otherwise may impose unexpected duty costs or other non-tariff barriers on us. These developments, or the perception that any of them could occur, may significantly reduce global trade and, in particular, trade between the EU and the UK.