What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2025-02-27 compared with 2024-02-29 · 233 added, 105 removed, 576 unchanged (37% of the section changed)

14 unchanged sentences

• Our business and results of operations could be adversely impacted by inflation.

Risks specifically related to our financial position, capital requirements and ownership of our common stock.

Risks related to our financial position, capital requirements and ownership of our common stock.

These risks include:

7 unchanged sentences

• Future sales and issuances of our common stock or rights to purchase common stock, including pursuant to our equity incentive plans, could result in additional dilution of the percentage ownership of our stockholders and could cause our stock price to fall.

• We have identified material weaknesses in our internal control over financial reporting, and our management has concluded that our disclosure controls and procedures were not effective as of December 31, 2023 and 2024.

If we fail to remediate these material weaknesses, or if we identify additional material weaknesses in the future or otherwise fail to maintain an effective system of internal control over financial reporting in the future, we may not be able to accurately or timely report our financial condition or results of operations, investors may lose confidence in the accuracy and completeness of our financial reports and the trading price of our common stock may decline.

Risks related to our intellectual property.

9 unchanged sentences

• Our patent protection and prosecution for some of our product candidates is dependent on third parties.

• We rely on third-party manufacturers to manufacture our product candidates and provide supplies for our preclinical candidates.

• We rely on third-party manufacturers to manufacture our product candidates and provide supplies for our studies.

If any of our third-party manufacturers encounter problems or loss of drug material during production or otherwise fail to comply with their contractual obligations, the development of our product candidates could be delayed or stopped.

• Our existing partnerships are important to our business.

• Our existing partnerships are important to our business, and future partnerships may also be important to us.

If we are unable to maintain any of these partnerships, or if these partnerships are not successful, our business could be adversely affected.

44 unchanged sentences

Adverse changes between preliminary or interim data and final data could significantly harm our business and prospects.

Further, additional disclosure of interim data by us

or by our competitors in the future could result in volatility in the price of our common stock.

See the description of risks under the heading “Risks Specifically Related to Our Financial Position, Capital Requirements and Ownership of Our Common Stock” for more disclosure related to the risk of volatility in our stock price.

Further, additional disclosure of interim data by us or by our competitors in the future could result in volatility in the price of our common stock.

See the description of risks under the heading “Risks Related to Our Financial Position, Capital Requirements and Ownership of Our Common Stock” for more disclosure related to the risk of volatility in our stock price.

Further, others, including regulatory agencies, may not accept or agree with our assumptions, estimates, calculations, conclusions or analyses or may interpret or weigh the importance of data differently, which could impact the value of the particular program, the approvability or commercialization of the particular product candidate or product and our company in general.

4 unchanged sentences

The Company’s financial performance is subject to global and US economic conditions.

Recent increases in interest rates and inflation, globally, and in the US regions, have led to economic volatility, increased borrowing costs, price increases and risks of recessions.

Recent increases in interest rates and inflation, globally, and in the US regions, have led to economic volatility, increased borrowing costs,

price increases and risks of recessions.

Economic recessions may have adverse consequences across industries, including the biotechnology industry, which may adversely affect the Company’s business and financial condition.

1 unchanged sentence

In addition, changes in general market, economic and political conditions in domestic and foreign economies or financial markets, including fluctuation in stock markets resulting from, among other things, trends in the economy and inflation, as are being currently experienced, may adversely impact our cash runway as well as our ability to raise funds.

Risks Specifically Related to Our Financial Position, Capital Requirements and Ownership of Our Common Stock

Unfavorable global economic or political conditions could adversely affect our business, financial condition or results of operations.

Our business is susceptible to general conditions in the global economy and in the global financial markets.

A global financial crisis or a global or regional political disruption could cause extreme volatility in the capital and credit markets.

A severe or prolonged economic downturn, including a recession or depression resulting from the political disruption, could result in a variety of risks to our business, including weakened demand for our current or future product candidates, if approved, and our ability to raise additional capital when needed on acceptable terms, if at all.

A weak or declining economy or political disruption could also strain our manufacturers or suppliers, possibly resulting in supply disruption, or cause our customers to delay making payments for our potential drugs, if approved.

Russia’s invasion of Ukraine and sanctions against Russia are causing disruptions to global economic conditions.

The escalation in October 2023 of the conflict between Israel and Hamas also could cause disruptions to global economic conditions and affect the stability of the Middle East region.

Further, the global equity markets in general have recently experienced extreme price and volume fluctuations, including as a result of economic uncertainty and increased interest rates, inflation, the government closure of Silicon Valley Bank and Signature Bank, and liquidity concerns at other financial institutions that may be unrelated to our operating performance.

Any of the foregoing could materially and adversely affect our business, financial condition, results of operations and prospects, and we cannot anticipate all of the ways in which the political or economic climate and financial market conditions could adversely impact our business.

Our operations are concentrated in one location, and we or the third parties upon whom we depend may be adversely affected by a wildfire and earthquake or other natural disasters and our business continuity and disaster recovery plans may not adequately protect us from a serious disaster.

Our current operations are predominantly located in California.

Any unplanned event, such as a flood, wildfire, explosion, earthquake, extreme weather condition, epidemic or pandemic, power outage, telecommunications failure or other natural or man-made accidents or incidents that result in us being unable to fully utilize our facilities may have a material and adverse effect on our ability to operate our business, particularly on a daily basis, and have significant negative consequences on our financial and operating conditions.

Any similar impacts of natural or man-made disasters on our third-party CMOs and CROs, could cause delays in our clinical trials and may have a material and adverse effect on our ability to operate our business and have significant negative consequences on our financial and operating conditions.

If a natural disaster, power outage or other event occurred that prevented us from using our clinical sites, impacted clinical supply or the conduct of our clinical trials, that damaged critical infrastructure, such as the manufacturing facilities of our third-party CMOs, or that otherwise disrupted operations, it may be difficult or, in certain cases, impossible, for us to continue our business for a substantial period of time.

The disaster recovery and business continuity plans we and our CMOs and CROs have in place may prove inadequate in the event of a serious disaster or similar event.

In the event of an accident or incident at these facilities, we cannot assure you that the amounts of insurance we currently carry will be sufficient to satisfy any damages and losses.

If our facilities, or the manufacturing facilities of our CMOs or CROs, are unable to operate because of an accident or incident or for any other reason, even for a short period of time, any or all of our development programs may be harmed.

Any business interruption could adversely affect our business, financial condition, results of operations and prospects.

Risks Related to Our Financial Position, Capital Requirements and Ownership of Our Common Stock

We have incurred significant losses since our inception and anticipate that we will continue to incur significant losses for the foreseeable future.

1 unchanged sentence

To date, we have financed our operations primarily through equity financings and our research and development licensing agreements and have incurred significant operating losses since our inception in 1997.

For the year ended December 31, 2023, we incurred a net loss of $126.1 million and as of December 31, 2023, we had an accumulated deficit of $464.4 million.

For the year ended December 31, 2024, we incurred a net loss of $232.6 million and as of

December 31, 2024, we had an accumulated deficit of $704.0 million.

We expect to incur additional net losses in future years as we execute our plan to continue our discovery, research and development activities, including the ongoing and planned clinical development of our antibody product candidates, and incur the additional costs of operating as a public company.

24 unchanged sentences

We do not have sufficient cash to complete the clinical development of any of our product candidates and will require additional funding to complete the development activities required for regulatory approval of our current product candidates or any other future product candidates that we develop independently.

Because successful development of our product candidates is uncertain, we are unable to estimate the actual funds we will require to complete research and development and commercialize our product candidates.

Because successful development of our product candidates

is uncertain, we are unable to estimate the actual funds we will require to complete research and development and commercialize our product candidates.

Adequate additional financing may not be available to us on acceptable terms, or at all.

6 unchanged sentences

Since our IPO, the trading price of our common stock has ranged from a low of approximately $5.75 to a high of approximately $58.345.

From January 2, 2024 to December 31, 2024, the trading price of our common stock ranged from a low of $15.31 to a high of $27.24.

Our stock price could be subject to wide fluctuations in response to a variety of factors, including the following:

21 unchanged sentences

Our principal stockholders, directors and management own a significant percentage of our stock and will be able to exert significant control over matters subject to stockholder approval.

Based on information available to us as of December 31, 2023 our executive officers, management, directors, 5% stockholders and their affiliates beneficially owned, as a group, approximately 64.8% of our voting stock.

Based on information available to us as of December 31, 2024 our executive officers, directors, 5% stockholders and their affiliates beneficially owned, as a group, approximately 56.8% of our voting stock.

The interests of these stockholders may not be the same as or may even conflict with your interests.

Therefore, our officers, directors and 5% stockholders and their affiliates will have the ability to influence us through this ownership position and so long as they continue to beneficially own a significant amount of our outstanding voting stock.

15 unchanged sentences

These sales may also result in material dilution to our existing stockholders, and new investors could gain rights superior to our existing stockholders.

Pursuant to our 2023 equity incentive plan (2023 plan), subject to board approval, our management is authorized to grant stock options and other equity-based awards to our employees, directors and consultants.

Pursuant to our 2023 Equity Incentive Plan (2023 Plan), subject to the Board of Directors approval, our management is authorized to grant stock options and other equity-based awards to our employees, directors and consultants.

As of December 31, 2024, we had options to purchase 12,370,081 shares outstanding under our equity compensation plans.

1 unchanged sentence

We plan to register the number of shares available for issuance or subject to outstanding awards under our equity compensation plans.

On February 27, 2023, we filed an automatic universal shelf registration statement on Form S-3 (File No.

333-270030) as a well-known seasoned issuer as defined in Rule 405 under the Securities Act of 1933, as amended, which became effective upon filing (the Shelf Registration Statement).

The Shelf Registration Statement allows us to offer an indeterminate amount of securities, including equity securities, debt securities, warrants, rights, units and depositary shares, from time to time as described in the Shelf Registration Statement.

The specific terms of any offering under the Shelf

Registration Statement will be established at the time of such offering.

The Shelf Registration Statement will expire on February 27, 2026.

On February 27, 2023, we entered into a sales agreement (the Sales Agreement) with SVB Securities LLC (the Agent) pursuant to which we may offer and sell, from time to time, through the Agent (the ATM Offering), shares of our common stock having an aggregate offering price of up to $200 million (the ATM Shares).

Any ATM Shares offered and sold in the ATM Offering are to be issued pursuant to the Shelf Registration Statement and the 424(b) prospectus supplement relating to the ATM Offering dated February 27, 2023 (the ATM Prospectus).

From the date of the ATM Prospectus through December 31, 2024, no shares of our common stock were sold pursuant to the ATM Offering and, as of December 31, 2024, we may sell shares of our common stock for remaining gross proceeds of up to $200 million from time to time pursuant to the ATM Prospectus.

If our internal control over financial reporting is not effective, we may not be able to accurately report our financial results or file our periodic reports in a timely manner, which may cause investors to lose confidence in our reported financial information and may lead to a decline in our stock price.

9 unchanged sentences

Under the Tax Cuts and Jobs Act of 2017 (TCJA), our federal NOLs generated in tax years ending after December 31, 2017, may be carried forward indefinitely, but the deductibility of such federal NOLs generated in tax years beginning after December 31, 2021, is limited.

It is uncertain if and to what extent various states will conform to the TCJA.

In addition, under Sections 382 and 383 of the Internal Revenue Code of 1986, as amended, and corresponding provisions of state law, if a corporation undergoes an “ownership change,” which is generally defined as a greater than 50% change, by value, in its equity ownership over a three-year period, the corporation’s ability to use its pre-change NOL carryforwards and other pre-change U.S.

Under Sections 382 and 383 of the Internal Revenue Code of 1986, as amended, and corresponding provisions of state law, if a corporation undergoes an “ownership change,” which is generally defined as a greater than 50% change, by value, in its equity ownership over a three-year period, the corporation’s ability to use its pre-change NOL carryforwards and other pre-change U.S.

tax attributes (such as research tax credits) to offset its post-change income or taxes may be limited.

It is also possible that we have in the past

undergone, and in the future may undergo, ownership changes that could result in additional limitations on our net operating loss and tax credit carryforwards.

It is also possible that we have in the past undergone, and in the future may undergo, ownership changes that could result in additional limitations on our net operating loss and tax credit carryforwards.

As a result, our pre-2018 NOL carryforwards may expire prior to being used.

4 unchanged sentences

The TCJA changed the income tax treatment of research and development expenses which may result in additional federal and state tax liabilities.

For tax years ended in December 31, 2022 and subsequent years, research and development costs must be capitalized and amortized over a period of years;

For tax years beginning after December 31, 2021, research and development costs must be capitalized and amortized over a period of years;

this has resulted in additional federal tax expense and liabilities to us in 2022 and 2023.

Currently, there is proposed legislation in Congress that would retroactively restore the deduction of research and development expenses, which if enacted, would reduce our 2023 federal tax expense and liabilities by a material amount.

We do not intend to pay dividends on our common stock so any returns will be limited to the value of our stock.

2 unchanged sentences

Any return to stockholders will therefore be limited to the appreciation of their stock.

Provisions in our amended and restated certificate of incorporation and bylaws, as well as provisions of Delaware law, could make it more difficult for a third party to acquire us or increase the cost of acquiring us, even if doing so would benefit our stockholders or remove our current management.

Provisions in our amended and restated certificate of incorporation and second amended and restated bylaws, as well as provisions of Delaware law, could make it more difficult for a third party to acquire us or increase the cost of acquiring us, even if doing so would benefit our stockholders or remove our current management.

Some provisions of our charter documents and Delaware law may have anti-takeover effects that could discourage an acquisition of us by others, even if an acquisition would be beneficial to our stockholders and may prevent attempts by our stockholders to replace or remove our current management.

15 unchanged sentences

Our management and other personnel need to devote a substantial amount of time to ensure that we comply with all of these requirements.

Moreover, the reporting requirements, rules and regulations increase our legal and financial compliance costs and also make some activities more time-consuming and costly.

Moreover, the reporting requirements, rules and regulations increase our legal and financial compliance costs and also make some

activities more time-consuming and costly.

These reporting requirements, rules, and regulations, coupled with the increase in potential litigation exposure associated with being a public company, could also make it more difficult for us to attract and retain qualified persons to serve on our Board of Directors or Board committees or to serve as executive officers, or to obtain certain types of insurance, including directors’ and officers’ insurance, on acceptable terms.

2 unchanged sentences

Any changes we make to comply with these obligations may not be sufficient to allow us to satisfy our obligations as a public company on a timely basis, or at all.

Investors' expectations of our performance relating to environmental, social and governance factors may impose additional costs and expose us to new risks.

There is an increasing focus from certain investors, employees, regulators and other stakeholders concerning corporate responsibility, specifically related to environmental, social and governance (ESG) factors.

Some investors may use these factors to guide investment strategies and decisions.

Complying with ESG standards and expectations may impose additional costs and expose us to new risks for not meeting investor and third-party expectations in meeting published ESG guidelines.

Our ability to effectively monitor and respond to the rapid and evolving developments and expectations relating to sustainability, including the environmental, social and governance matters, may impose unexpected costs or results in reputational or other harm that could have a material adverse effect on our business.

There is an increasing focus from certain investors, employees, regulators and other stakeholders concerning corporate responsibility and sustainability matters, including with regard to environmental, social and governance (ESG) factors.

Some investors and investor groups may use these factors, either positively or negatively, to guide investment strategies and decisions and, in some cases, investors may choose not to invest in us if they believe our policies or practices relating to corporate responsibility and sustainability do not align with their expectations.

Currently, a variety of third-party providers of corporate responsibility and sustainability ratings measure the performance of companies on ESG topics, and the results of these assessments are widely publicized.

Investors, particularly institutional investors, use these ratings to benchmark companies against their peers, and major institutional investors have publicly emphasized the importance of ESG measures to their investment decisions.

Topics taken into account in such assessments include, among others, companies’ efforts and impacts on climate change, human rights, business ethics and compliance, diversity, equity and inclusion (DEI) and the role of companies’ board of directors in overseeing various sustainability-related issues.

In light of investors’ increased focus on sustainability matters, if we are, for example, perceived as lagging in taking steps with respect to ESG initiatives, certain investors may seek to engage with us on improving our ESG disclosures or performance.

They may also make voting decisions or take other actions to hold us and our Board of Directors accountable.

In addition, there are rapidly evolving developments and changing expectations relating to sustainability matters.

As a result, the criteria by which our corporate responsibility and sustainability practices are assessed may change, which could cause us to undertake costly initiatives or actions to satisfy new demands.

If we elect not to or are unable to adequately recognize and respond to such developments and changing governmental, societal, investor and/or consumer expectations relating to sustainability matters, we may miss corporate opportunities, become subject to additional scrutiny or incur unexpected costs.

We may face risk of litigation or reputational damage in the event that our sustainability policies or practices do not meet the standards set by various constituencies.

We may also face reputational damage if we are unable to achieve an acceptable sustainability rating from third-party rating services.

A low sustainability rating by a third-party rating service could also result in the exclusion of our Common Stock from consideration by certain investors who may elect to invest with our competitors instead.

Ongoing focus on corporate responsibility and sustainability matters by investors and other stakeholders as described above may impose additional costs or expose us to new risks.

Any failure or perceived failure by us in this regard could have a material adverse effect on our reputation and on our business, financial condition or results of operations, including the sustainability of our business over time, and could cause the market value of our Common Stock to decline.

Further, our emphasis on sustainability issues may not maximize short-term financial results and may yield financial results that conflict with the market’s expectations.

We may in the future make business decisions consistent with our sustainability goals that we believe, based on considered analysis, will create value and improve our financial performance over the long-term.

These decisions, however, may not be consistent with the short-term expectations of our stockholders and may not produce the long-term benefits that we expect, in which case our business, financial condition and results of operations could be harmed.

We have identified material weaknesses in our internal control over financial reporting, and our management has concluded that our disclosure controls and procedures were not effective as of December 31, 2023 and 2024.

Pursuant to Section 404 of the Sarbanes-Oxley Act, our management is required to report on, and our independent registered public accounting firm is required to audit, the effectiveness of our internal control over financial reporting.

The rules governing the standards that must be met for management to determine the adequacy of our internal control over financial reporting are complex and require significant documentation, testing, and possible remediation if a deficiency is identified.

Annually, we perform activities that include reviewing, documenting, and testing our internal control over financial reporting.

If we fail to maintain the adequacy of our internal control over financial reporting, we will not be able to conclude on an ongoing basis that we have effective internal control over financial reporting in accordance with Section 404 of the Sarbanes-Oxley Act.

Any failure to achieve and maintain an effective system of internal control could result in materially misstated consolidated financial statements and a failure to meet our reporting obligations, which would likely cause investors to lose confidence in our reported financial information.

This could result in significant expenses to remediate any internal control deficiency and lead to a decline in the price of our common stock.

We previously concluded that certain periods of our historical financial statements should no longer be relied upon and should be restated to reflect the correct accounting for the sale of future royalties pursuant to the Ultomiris Royalty Sale Agreement and to account for additional tax liabilities.

In addition, on February 7, 2025, RSM informed us that disclosure should be made or action should be taken to prevent future reliance on RSM’s audit report filed with the Original Form 10-K for the year ended December 31, 2023 and completed interim review related to previously issued financial statements included in our Quarterly Reports on Form 10-Q for the quarters ended March 31, 2024, June 30, 2024 and September 30, 2024.

In connection with this restatement, our management re-evaluated the effectiveness of our disclosure controls and procedures and internal control over financial reporting as of December 31, 2023.

Our Chief Executive Officer and Chief Financial Officer concluded that our disclosure controls and procedures were not effective as of December 31, 2023, and our management concluded that our internal control over financial reporting was not effective as of December 31, 2023 due to material weaknesses (a material weakness is a deficiency, or a combination of deficiencies, in internal control over financial reporting, such that there is a reasonable possibility that a material misstatement of our annual or interim financial statements will not be prevented or detected on a timely basis) related to the design of controls related to the review of the accounting treatment of the non-routine transactions and the evaluation of certain tax legislation.

These material weaknesses led to the restatement of our audited financial statements for the year ended December 31, 2023 and the unaudited financial statements for the quarterly periods ended March 31, 2024, June 30, 2024 and September 30, 2024.

On February 24, 2025, we filed an Annual Report on Form 10-K/A for the year ended December 31, 2023 and Quarterly Reports on Form 10-Q/As for the quarterly periods ended March 31, 2024, June 30, 2024 and September 30, 2024.

We are in the process of implementing remediation plans to address these material weaknesses.

While we believe these efforts will improve our internal controls and address the root causes of the material weaknesses, the material weaknesses cannot be considered completely remediated until applicable controls have been designed, implemented, have operated for a sufficient period of time and management has concluded, through testing, that these controls are operating effectively.

We cannot be certain that the steps we are taking will be sufficient to remediate the control deficiencies that led to the material weaknesses in our internal control over financial reporting or prevent future material weaknesses or control deficiencies from occurring.

In addition, we cannot be certain that we have identified all material weaknesses in our internal control over financial reporting, or that in the future we will not have additional material weaknesses in our internal control over financial reporting.

For more information related to the material weaknesses and their remediation, see Part II, Item 9A Controls and Procedures of this Form 10-K.

Risks Related to Our Intellectual Property

If we are unable to obtain, maintain and enforce intellectual property protection covering our products, others may be able to make, use or sell products substantially the same as ours, which could adversely affect our ability to compete in the market.

Our commercial success depends, in part, on our ability to obtain, maintain and enforce patents, trade secrets, trademarks and other intellectual property rights and to operate without having third parties infringe, misappropriate or circumvent the rights that we own or license.

If we are unable to obtain, maintain and enforce intellectual property protection covering our products and any future products we may develop, others may be able to make, use or sell products substantially the same as ours, which could adversely affect our ability to compete in the market.

circumvent the rights that we own or license.

The value of many of our partnered licensing arrangements is based on the underlying intellectual property and related patents.

If we are unable to obtain, maintain and enforce intellectual property protection covering our products or underlying technologies, others may be able to make, use or sell products that are substantially the same as ours without incurring the sizeable development and licensing costs that we have incurred, which would adversely affect our ability to compete in the market.

As of December 31, 2023, we held over 1,500 issued patents and pending patent applications.

We file patent applications in the United States, Canada, Japan, Europe and other major markets either directly or via the Patent Cooperation Treaty.

3 unchanged sentences

patent laws have recently changed, there have been changes regarding how patent laws are interpreted, and the U.S.

Patent and Trademark Office (the PTO) has also implemented changes to the

patent system.

Patent and Trademark Office (the PTO) has also implemented changes to the patent system.

Some of these changes are currently being litigated, and we cannot accurately determine the outcome of any such proceedings or predict future changes in the interpretation of patent laws or changes to patent laws which might be enacted into law.

50 unchanged sentences

Our existing license agreements impose, and we expect that future license agreements will impose, various diligence, milestone payment, royalty and other obligations on us.

If there is any conflict, dispute, disagreement or issue of non-performance between us and our licensing partners regarding our rights or obligations under the license agreements, including any such conflict, dispute or disagreement arising from our failure to satisfy payment obligations under any such agreement, we may owe damages, our licensor may have a right to terminate the affected license, and our and our partners' ability to utilize the affected intellectual property in our drug discovery and development efforts, and our ability to enter into collaboration or marketing agreements for an affected product or therapeutic candidate, may be adversely affected.

agreement, we may owe damages, our licensor may have a right to terminate the affected license, and our and our partners' ability to utilize the affected intellectual property in our drug discovery and development efforts, and our ability to enter into collaboration or marketing agreements for an affected product or therapeutic candidate, may be adversely affected.

We generally also are subject to all of the same risks with respect to protection of intellectual property that we license, as we are for intellectual property that we own, which are described in this “Risk Factors” section.

If we or our licensors fail to adequately protect this intellectual property, our business, results of operations and financial condition could be adversely affected.

We may be required to reduce the scope of our intellectual property due to third-party intellectual property claims.

7 unchanged sentences

patent laws under the America Invents Act resulted in the United States changing from a “first to invent” country to a “first to file” country.

result, we may lose the ability to obtain a patent if a third-party files with the PTO first and could become involved in proceedings before the PTO to resolve disputes related to inventorship.

As a result, we may lose the ability to obtain a patent if a third-party files with the PTO first and could become involved in proceedings before the PTO to resolve disputes related to inventorship.

We may also become involved in similar proceedings in other jurisdictions.

10 unchanged sentences

(Merus) that may relate to and claim components of our bispecific antibody product candidates and partnered bispecific product candidates, including plamotamab, vudalimab and XmAb819 will putatively expire in 2033.

It is possible that the patent terms could be extended, for example, as a result of patent term restoration to compensate for regulatory delays.

While we believe that our current development of these candidates currently falls into the “safe harbor” of non-infringement under 35 U.S.C.

§271(e)(1), this protection terminates upon commercialization.

In addition, there can be no assurance that our interpretation of this statutory exemption would be upheld.

We believe there exists reasonable arguments of invalidity for the Merus patents;

however, we cannot assure that if challenged in litigation for infringement of these patents that we would prevail.

In order to successfully challenge the validity of any issued U.S.

patent, we would need to overcome a presumption of validity.

This burden is a high one requiring us to present clear and convincing evidence as to the invalidity of such claims.

There is no assurance that a court would find these claims to be invalid or not infringed.

In August 2024, Merus filed suit against us in the United States District Court of the District of Delaware alleging that we have infringed three of its patents.

We maintain that our development of these candidates currently falls into the “safe harbor” of non-infringement under 35 U.S.C.

This protection, however, would not be available upon commercialization nor can we give assurances on how the Court would rule on this issue.

We also believe we have strong defenses to Merus’s claims, including defenses of invalidity and/or non-infringement for the Merus patents, but there is no guarantee that we will prevail.

If we are found to infringe the Merus patents, we may be ordered by a court to cease commercializing the applicable product candidates, which could materially harm our business.

In addition, we could be found liable for monetary damages, including treble damages and attorneys’ fees if we are found to have willfully infringed the Merus patents.

In addition, as the biopharmaceutical industry expands and more patents are issued, the risk increases that there may be patents issued to third parties that relate to our products and technology of which we are not aware or that we must challenge to continue our operations as currently contemplated.

1 unchanged sentence

Because some patent applications in the United States may be maintained in secrecy until the patents are issued, because patent applications in the United States and many foreign jurisdictions are typically not published until eighteen months after filing and because publications in the scientific literature often lag behind actual discoveries, we cannot be certain that others have not filed patents that may cover our technologies, our product candidates or their use.

Additionally, pending patent applications which have been published can, subject to certain limitations, be later amended in a manner that could cover our technologies, our products or the use of our products.

Additionally, pending patent applications which have been published can, subject to certain limitations, be later amended in

a manner that could cover our technologies, our products or the use of our products.

We may become party to, or threatened with, future adversarial proceedings or litigation regarding intellectual property rights with respect to our products and technology.

8 unchanged sentences

However, we may not be able to obtain any required license on commercially reasonable terms or at all.

Even if we were able to obtain a license, it could be non-exclusive, thereby giving our competitors access to the same technologies licensed to us and could require us to make

substantial royalty payments.

Even if we were able to obtain a license, it could be non-exclusive, thereby giving our competitors access to the same technologies licensed to us and could require us to make substantial royalty payments.

We could also be forced, including by court order, to cease commercializing the infringing technology or product.

19 unchanged sentences

Similar extensions as compensation for patent term lost during regulatory review processes are also available in certain foreign countries and territories, such as in Europe under a Supplementary Patent Certificate.

However, we may not be granted an extension in the United States and/or foreign countries and territories because of, for example, failing to exercise due diligence during the testing phase or regulatory review process, failing to apply within applicable deadlines, failing to apply prior to expiration of relevant patents, or otherwise failing to satisfy applicable requirements.

applicable deadlines, failing to apply prior to expiration of relevant patents, or otherwise failing to satisfy applicable requirements.

Moreover, the applicable time period or the scope of patent protection afforded could be less than we request.

3 unchanged sentences

While we normally seek and gain the right to fully prosecute the patents relating to our product candidates, there may be times when patents relating to our product candidates are controlled by our licensors.

We may also have limited control over the maintenance and prosecution of in-licensed patents and patent applications, activities or any other intellectual property that may be related to our in-licensed intellectual property.

For example, such activities by these licensors may not have been or may not be conducted in compliance with applicable laws and regulations or will result in valid and enforceable patents and other intellectual property rights.

Our licensors may not successfully prosecute the patent applications to which we are licensed in a manner consistent with the best interests of our business.

We have limited control over the manner in which our licensors initiate an infringement proceeding against a third-party infringer of the intellectual property rights, or defend certain of the intellectual property that is licensed to us.

It is possible that the licensors’ infringement proceeding or defense activities may be less vigorous than had we conducted them ourselves.

We rely on third-party manufacturers to manufacture our product candidates and provide supplies for our studies.

1 unchanged sentence

The manufacture of biopharmaceutical products is complex and requires significant expertise and capital investment, including the development of advanced manufacturing techniques and process controls.

We and our contract

manufacturers must comply with cGMP regulations and guidelines.

We and our contract manufacturers must comply with cGMP regulations and guidelines.

Manufacturers of biopharmaceutical products often encounter difficulties in production, particularly in scaling up and validating initial production and contamination.

10 unchanged sentences

We may also have to take inventory write-offs and incur other charges and expenses for product candidates or products that fail to meet specifications, undertake costly remediation efforts or seek more costly manufacturing alternatives.

Accordingly, failures or difficulties faced at any level of our supply chain could materially adversely affect our business and delay or impede the development and commercialization of any of our product candidates or products and could have a material adverse effect on our business, prospects, financial condition and results of operations.

Certain of our third-party manufactures are located outside the United States, and our ability to continue to receive drug material for our development candidates would be at-risk in the event of instability or geopolitical problems between the United States and the country's where these manufacturers are located.

or products and could have a material adverse effect on our business, prospects, financial condition and results of operations.

Certain of our third-party manufacturers are located outside the United States, and our ability to continue to receive drug material for our development candidates would be at-risk in the event of instability or geopolitical problems between the United States and the country's where these manufacturers are located.

During the last few years, there have also been significant changes to U.S.

and other countries’ trade policies, export control laws, sanctions, legislation, treaties and tariffs.

There is currently significant uncertainty about the future of trade relationships around the world, including potential changes to trade laws and regulations, trade policies, and tariffs.

We cannot predict what additional actions may ultimately be taken by the United States or other governments with respect to tariffs or trade relations, what products may be subject to such actions (including subject to U.S.

export control restrictions), or what actions may be taken by the other countries in retaliation.

As a result of these dynamics, we cannot predict the impact to our relationships with third-party manufacturers or our business of any future changes to the United States’ or other countries’ trading relationships or the impact of new laws or regulations adopted by the United States or other countries.

Our existing partnerships are important to our business, and future partnerships may also be important to us.

5 unchanged sentences

collaborators have significant discretion in determining the efforts and resources that they will apply to these partnerships;

our Janssen Agreement provides for cost-sharing on development costs for the bispecific candidate, plamotamab.

Such an arrangement may require us to incur substantial costs in excess of our available resources;

such arrangements may include cost-sharing obligations that require us to incur substantial costs in excess of our available resources;

collaborators may not pursue development and commercialization of any product candidates that achieve regulatory approval or may elect not to continue or renew development or commercialization programs based on clinical trial results, changes in the collaborators’ strategic focus or available funding, or external factors, such as an acquisition, that divert resources or create competing priorities;

3 unchanged sentences

disagreements with collaborators, including disagreements over proprietary rights, contract interpretation or the preferred course of development, might cause delays or termination of the research, development or commercialization of product candidates, might lead to additional responsibilities for us with respect to product candidates, or might result in litigation or arbitration, any of which would be time-consuming and expensive;

while we have generally retained the right to maintain and defend our intellectual property under our agreements with collaborators, certain collaborators may not properly maintain or defend certain of our intellectual property rights or may use our proprietary information in such a way as to invite litigation that could jeopardize or invalidate our intellectual property or proprietary information;

intellectual property rights or may use our proprietary information in such a way as to invite litigation that could jeopardize or invalidate our intellectual property or proprietary information;

collaborators may infringe the intellectual property rights of third parties, which may expose us to litigation and potential liability;

23 unchanged sentences

We also have engaged, and may in the future engage, a CRO to run all aspects of a clinical trial on our behalf.

There is no assurance that such individuals or organizations will be able to provide the functions, tests, biologic supply or services as agreed upon or in a quality fashion and we could suffer significant delays in the development of our products or processes.

There is no assurance that such individuals or organizations will be able to provide the functions, tests, biologic

supply or services as agreed upon or in a quality fashion and we could suffer significant delays in the development of our products or processes.

In some cases, there may be only one or few providers of such services, including clinical data management or manufacturing services.

19 unchanged sentences

Risks Related to Our Industry

Clinical trials are expensive and take years to conduct and the outcome of such clinical trials is uncertain.

Clinical trials are expensive and take years to conduct, the outcome of such clinical trials is uncertain and results of earlier studies and trials may not be predictive of future trial results.

Clinical trials may fail to prove our product candidates are safe and effective.

1 unchanged sentence

Clinical trials at any stage in development may fail to demonstrate the safety, efficacy or pharmacologic properties needed to be a viable product candidate in patients.

Early clinical trials may fail to demonstrate the safety and pharmacokinetic characteristics needed to invest in larger later stage clinical studies.

Early clinical trials are expensive and can take many years to complete and may fail to demonstrate the safety and pharmacokinetic characteristics needed to invest in larger later stage clinical studies.

Alternatively, success in preclinical testing and early clinical trials does not ensure that later clinical trials will generate the same results or otherwise provide adequate data to demonstrate the safety and effectiveness of a product candidate .

Later clinical studies that are larger may not demonstrate the desired safety and efficacy profile needed to be of benefit to patients.

5 unchanged sentences

If we elect or are required to delay, suspend or terminate any clinical trial of any product candidates that we develop, the commercial prospects of such product candidates will be harmed and our ability to generate product revenues from any of these product candidates will be delayed or eliminated.

If our product candidates are associated with adverse events in clinical trials or have side effects or other characteristics that are serious or unexpected, we may need to abandon their development or limit development to more narrow uses in which the adverse events, side effects or other characteristics are less prevalent, less severe or more acceptable from a risk-benefit perspective.

We may also be required to modify our trial plans based on findings in our ongoing clinical trials.

The FDA may also require that we conduct additional studies regarding the safety and efficacy of our product candidates which we have not planned or anticipated.

Such findings could further result in regulatory authorities failing to provide marketing authorization for our product candidates or limiting the scope of the approved indication, if approved.

Many product candidates that initially showed promise in early stage testing have later been found to cause side effects that prevented further development of such product candidates.

Treatment-related side effects could also affect subject recruitment or the ability of enrolled subjects to complete the trial or result in potential product liability claims.

In addition, these side effects may not be appropriately recognized or managed by the treating medical staff.

Furthermore, we may be required to expend time and incur costs to train medical personnel using our product candidates to understand the side effect profiles for our clinical trials and upon any commercialization of any of our product candidates.

There can be no assurance that we will resolve any issues related to any product-related adverse events to the satisfaction of the FDA or comparable foreign regulatory authorities in a timely manner or at all.

Serious adverse events observed in clinical trials could hinder or prevent market acceptance of the product candidate at issue.

5 unchanged sentences

Enrollment delays in our clinical trials may result in increased development costs for our product candidates and in delays to commercially launching our product candidates, if approved, which would cause the value of our company to decline and limit our ability to obtain additional financing.

Delays in the commencement or completion of clinical trials could result in increased costs to us and delay our ability to establish strategic collaborations.

Delays in the commencement or completion of clinical trials could significantly impact our drug development costs.

We do not know whether planned clinical trials will begin on time or be completed on schedule, if at all.

The commencement of clinical trials can be delayed for a variety of reasons, including, but not limited to, delays related to:

• obtaining regulatory approval to commence one or more clinical trials;

• reaching agreement on acceptable terms with prospective CROs and clinical trial sites;

• manufacturing sufficient quantities of a drug candidate or other materials necessary to conduct clinical trials, as well as receiving the supplies and materials needed to conduct our clinical trials, including interruptions in global shipping that may affect the transport of clinical materials;

• obtaining institutional review Board of Directors approval to conduct one or more clinical trials at a prospective site;

• recruiting and enrolling patients to participate in one or more clinical trials, especially as patients may be reluctant or unable to visit clinical sites, or may delay seeking treatment for chronic conditions;

• the failure of our collaborators to adequately resource our drug candidates due to their focus on other programs or as a result of general market conditions;

• recruiting clinical site investigators, clinical site staff and potential closure or defunding of clinical facilities;

• changes in regulations, which may require us to change the ways in which our clinical trials are conducted.

In addition, once a clinical trial has begun, it may be suspended or terminated by us, our collaborators, the institutional review boards or data safety monitoring boards charged with overseeing our clinical trials, the FDA, EMA or comparable foreign authorities due to a number of factors, including:

• failure to conduct the clinical trial in accordance with regulatory requirements or clinical protocols;

• inspection of the clinical trial operations or clinical trial site by the FDA, EMA or comparable foreign authorities resulting in the imposition of a clinical hold;

• unforeseen safety issues;

• lack of adequate funding to continue the clinical trial.

If we experience delays in the completion or termination of any clinical trial of our product candidates, the commercial prospects of our product candidates will be harmed, and our ability to commence product sales and generate product revenues from any of our product candidates will be delayed.

In addition, any delays in completing our clinical trials will increase our costs and slow down our product candidate development and approval process.

Delays in completing our clinical trials could also allow our competitors to obtain marketing approval before we do or shorten the patent protection period during which we may have the exclusive right to commercialize our product candidates.

Any of these occurrences may harm our business, financial condition and prospects significantly.

In addition, many of the factors that cause, or lead to, a delay in the commencement or completion of clinical trials may also ultimately lead to the denial of regulatory approval of our product candidates.

Our industry is subject to competition for skilled personnel and the challenges we face to identify and retain key personnel could impair our ability to effectively conduct and grow our operations.

6 unchanged sentences

Further, we do not maintain “key person” insurance for any of our executives or other employees.

The loss of the services of any of our executive officers and our inability to find suitable replacements could harm our business, financial condition, prospects and ability to achieve the successful development or

commercialization of our product candidates.

Our success also depends on our ability to continue to attract, retain and motivate highly skilled scientific and medical personnel at all levels.

5 unchanged sentences

There can be no assurance that these individuals are retainable.

While we have been able to attract and retain skilled and experienced personnel and consultants in the past, no assurance can be given that we will be able to do so in the future.

have been able to attract and retain skilled and experienced personnel and consultants in the past, no assurance can be given that we will be able to do so in the future.

The development and commercialization of biologic products is subject to extensive regulation, and we may not obtain regulatory approvals for any of our product candidates.

The clinical development, manufacturing, labeling, packaging, storage, recordkeeping, advertising, promotion, export, import, marketing and distribution and other possible activities relating to our current lead antibody product candidates, as well as any other antibody product candidate that we may develop in the future, are subject to extensive regulation in the United States and outside the US as biologics.

as biologics.

If we experience delays in obtaining approval, or if we fail to obtain approval of our product candidates, the commercial prospects for our product candidates may be harmed and our ability to generate revenues will be materially impaired which would adversely affect our business, prospects, financial condition and results of operations.

21 unchanged sentences

We will not be able to successfully commercialize our product candidates without establishing sales and marketing capabilities internally or through collaborators.

Our current and future relationships with healthcare professionals, principal investigators, consultants, customers and third-party payors in the United States and elsewhere may be subject, directly or indirectly, to applicable anti-kickback, fraud and abuse, false claims, physician payment transparency, health information privacy and security and other healthcare laws and regulations, which could expose us to penalties.

fraud and abuse, false claims, physician payment transparency, health information privacy and security and other healthcare laws and regulations, which could expose us to penalties.

Healthcare providers, physicians and third-party payors in the United States and elsewhere will play a primary role in the recommendation and prescription of any product candidates for which we obtain marketing approval.

13 unchanged sentences

Current and future legislation may significantly change the approval requirements in ways that could involve additional costs and cause delays in obtaining approvals.

Some countries

require approval of the sale price of a product before it can be marketed.

Some countries require approval of the sale price of a product before it can be marketed.

In many countries, the pricing review period begins after marketing or product licensing approval is granted.

32 unchanged sentences

Even if we are successful in proving in a court of law that a third party is infringing one or more of our issued patents or trademarks there can be no assurance that we would be successful in halting their infringing activities, for example, through a permanent injunction, or that we would be fully or even partially financially compensated for any harm to our business.

We may be forced to enter into a license or other agreement with the infringing

third party at terms less profitable or otherwise commercially acceptable to us than if the license or agreement were negotiated under conditions between those of a willing licensee and a willing licensor.

We may be forced to enter into a license or other agreement with the infringing third party at terms less profitable or otherwise commercially acceptable to us than if the license or agreement were negotiated under conditions between those of a willing licensee and a willing licensor.

We may not become aware of a third-party infringer within legal timeframes for compensation or at all, thereby possibly losing the ability to be compensated for any harm to our business.

4 unchanged sentences

Such third-party infringer products could irreparably harm the reputation of our products thereby resulting in substantial loss in market share and profits.

We may not have or be able to obtain or maintain sufficient and affordable insurance coverage to cover product liability claims, and without sufficient coverage any claim brought against us could have a materially adverse effect on our business, financial condition or results of operations.

business, financial condition or results of operations.

We run clinical trials through investigators that could be negligent through no fault of our own and which could affect patients, cause potential liability claims against us and result in delayed or stopped clinical trials.

15 unchanged sentences

Our business could be negatively impacted by cybersecurity threats and other disruptions, including the theft of our intellectual property, and could compromise our information and expose us to liability, which would cause our business and reputation to suffer.

We are increasingly dependent on information technology systems and infrastructure, including mobile technologies, to operate our business.

We and our third-party vendors and suppliers are increasingly dependent on information technology systems and infrastructure, including mobile technologies, to operate our business.

In the ordinary course of our business, we use our data centers and our networks to store and access confidential and proprietary business information.

The information includes, among other things, our intellectual property and proprietary information, the confidential information of our collaborators and licensees and the personally identifiable information of our employees, and the individually identified health information of patients participating in our clinical trials.

The information includes, among other things, our intellectual property and proprietary information, the confidential information of our collaborators and licensees and the personal data of our employees, and the individually identified health information of patients participating in our clinical trials.

It is important to our operations and business strategy that this electronic information remains secure and is perceived to be secure.

1 unchanged sentence

Information security risks have significantly increased in recent years in part due to the proliferation of new technologies and the increased sophistication and activities of organized crime, hackers, terrorists and other external parties, including foreign state actors.

We face various cybersecurity threats, including cybersecurity attacks to our

information technology infrastructure and attempts by others to gain access to our proprietary or sensitive information.

A security breach or privacy violation that leads to disclosure or modification of or prevents access to personally identifiable information or other protected information could harm our reputation, compel us to comply with federal and/or state breach notification laws and foreign law equivalents, subject us to mandatory corrective action, require us to verify the correctness of database contents and otherwise subject us to liability under laws and regulations that protect personal data, resulting in increased costs or loss of revenue.

We face various cybersecurity threats, including cybersecurity attacks to our information technology infrastructure and attempts by others to gain access to our proprietary or sensitive information.

Our technology systems and those of our current partners and third-party vendors are vulnerable to attack, damage and interruption from computer viruses and malware (e.g.

ransomware), malicious code, cybersecurity threats (such as denial or degradation-of-service attacks, cyber-attacks or cyber-intrusions over the Internet, hacking, phishing and other social engineering attacks), unauthorized access or use, natural disasters, terrorism, war and telecommunication and electrical failures, employee theft or misuse, human error, fraud, and sophisticated nation-state and nation-state-supported actors.

A security breach or privacy violation that leads to disclosure or modification of or prevents access to personal data or other protected information could harm our reputation, compel us to comply with federal and/or state breach notification laws and foreign law equivalents, subject us to mandatory corrective action, require us to verify the correctness of database contents and otherwise subject us to liability under laws and regulations that protect personal data, resulting in increased costs or loss of revenue.

Similarly, the loss of clinical trial data from completed or ongoing or planned clinical trials could result in delays in our regulatory approval efforts and significantly increase our costs to recover or reproduce the data.

Moreover, a security breach that exposes our confidential intellectual property could compromise our patent portfolio.

Additionally, theft of our intellectual property or proprietary business information could require substantial expenditures to remedy.

Additionally, theft of our intellectual property or proprietary business information could require substantial expenditures to

If we are unable to prevent such security breaches or privacy violations or implement satisfactory remedial measures, our operations could be disrupted, and we may suffer loss of reputation, financial loss and other regulatory penalties because of lost or misappropriated information.

15 unchanged sentences

The regulatory framework for the collection, use, safeguarding, sharing, transfer and other processing of information worldwide is rapidly evolving and is likely to remain uncertain for the foreseeable future.

For example, the EU’s General Data Protection Regulation (GDPR), imposes strict obligations on the processing of personal data, including personal health data, and the free movement of such data.

The GDPR applies to any company established in the EU as well as any company outside the EU that processes personal data in connection with the offering of goods or services to individuals in the EU or the monitoring of their behavior.

As such, the GDPR will apply to us in connection with any clinical trials we conduct in the EU.

The GDPR enhances data protection obligations for processors and controllers of personal data, including, for example, obligations relating to:

processing health and other sensitive data;

obtaining consent of individuals;

providing notice to individuals regarding data processing activities;

responding to data subject requests;

taking certain measures when engaging third-party processors;

notifying data subjects and regulators of data breaches;

implementing safeguards to protect the security and confidentiality of personal data;

and transferring personal data to countries outside the EU, including the U.S.

The GDPR imposes substantial fines for breaches of data protection requirements, which can be up to four percent of global revenue or

20 million euros, whichever is greater, and it also confers a private right of action on data subjects for breaches of data protection requirements.

Transfers of personal information out of the European Union face a constantly shifting set of requirements, as courts in Europe have invalidated intergovernmental agreements and European regulators have required changes to standard contracting terms, which themselves do not fit all situations.

As a result, significant uncertainty exists with respect to GDPR compliance and the attendant obligations going forward as the regulatory environment is rapidly developing.

In addition, from January 1, 2021, companies have had to comply with both the GDPR and the GDPR as incorporated into United Kingdom national law, the latter regime having the ability to separately fine up to the greater of £17.5 million or 4% of global turnover.

The EC has adopted an adequacy decision in favor of the United Kingdom, enabling data transfers from EU member states to the United Kingdom without additional safeguards.

However, the UK adequacy decision will automatically expire in June 2025 unless the EC re-assesses and renews/extends that decision.

Outside Europe, significant data privacy regulatory regimes exist in major markets including Brazil, India, China, and elsewhere.

The ever-shifting landscape of global data privacy regulation requires significant investment and attention to avoid significant noncompliance liabilities.

The GDPR and other changes in laws or regulations associated with the enhanced protection of certain types of sensitive data, such as healthcare data or other personal information from our clinical trials, could require us to change our business practices or lead to government enforcement actions, private litigation or significant penalties against us and could have a material adverse effect on our business, financial condition or results of operations.

Additionally, the California Consumer Privacy Act (CCPA), which took effect in January 2020, created new individual privacy rights for consumers (as that word is broadly defined in the law) and places increased privacy and security obligations on entities handling personal data of consumers or households and requires covered companies to provide new disclosures to California consumers, and provides such consumers new ways to opt-out of certain sales of personal information.

The CCPA provides for civil penalties for violations, as well as a private right of action for data breaches that is expected to increase data breach litigation.

Further, the California Privacy Rights Act (CPRA) revised and expanded the CCPA, adding additional data protection obligations on covered businesses, including additional consumer rights processes, limitations on data uses, new audit requirements for higher risk data, and opt outs for certain uses of sensitive data.

It also created a new California data protection agency authorized to issue substantive regulations and could result in increased privacy and information security enforcement.

The CPRA is in full effect as of January 1, 2023, and similar laws passed in Virginia, Colorado, Connecticut, and Utah took effect in 2023.

Additionally, Delaware, Indiana, Iowa, Montana, Oregon, Tennessee and Texas have adopted privacy laws, which take effect from July 1, 2024 through 2026.

Further, Washington’s My Health My Data Act, taking effect July 1, 2024, imposes similar requirements specific to consumer health data.

As a result, additional compliance investment and potential business process changes may be required.

In the event that we are subject to or affected by HIPAA, the CCPA, the CPRA or other domestic privacy and data protection laws, any liability from failure to comply with the requirements of these laws could adversely affect our financial condition.

Additional legislation proposed at the federal level and in other states, along with increased regulatory action, reflect a trend toward more stringent privacy legislation in the United States.

Globally, virtually every jurisdiction in which we operate has established its own data security and privacy frameworks with which we must comply.

Depending on our activities and operations we may be subject to privacy laws in other jurisdictions.

For example, the collection, use, disclosure, transfer, or other processing of personal data regarding individuals in the European Union (the EU) including personal health data, is subject to the EU General Data Protection Regulation (GDPR) which took effect across all member states of the European Economic Area (EEA) in May 2018.

The GDPR is wide-ranging in scope and imposes numerous requirements on companies that process personal data, including requirements relating to processing health and other sensitive data, obtaining consent of the individuals to whom the personal data relates, providing information to individuals regarding data processing activities, implementing safeguards to protect the security and confidentiality of personal data, providing notification of data breaches, and taking certain measures when engaging third-party processors.

In addition, the GDPR imposes strict rules on the transfer of personal data to countries outside the EU, which includes the United States and, as a result, increases the scrutiny that clinical trial sites located in the EEA should apply to transfers of personal data from such sites to countries that are considered to lack an adequate level of data protection, such as the United States.

The GDPR also permits data protection authorities to require destruction of improperly gathered or used personal data and/or impose substantial fines for violations of the GDPR, which can be up to 4% of global revenues or €20 million, whichever is greater, and it also confers a private right of action on data subjects and consumer associations to lodge complaints with supervisory authorities, seek judicial remedies, and obtain compensation for damages resulting from violations of the GDPR.

In addition, the GDPR provides that EU member states may make their own additional laws and regulations limiting the processing of personal data, including genetic, biometric or health data.

The European Data Protection Board continues to release guidelines for industries and impose fines related to the GDPR, some of which have been very significant.

To improve coordination among EU supervisory authorities, the European Commission has proposed a new regulation that would help to streamline enforcement of the GDPR in cross-

border cases.

Meanwhile, there continues to be persistent uncertainty relating to the transfer of personal data from Europe to the U.S., or other non-adequate countries, following the Schrems II decision.

On July 10, 2023, the European Commission adopted its adequacy decision on the EU-U.S.

Data Privacy Framework (DPF).

The decision, which took effect on the day of its adoption, concludes that the United States ensures an adequate level of protection for personal data transferred from the EEA to companies certified to DPF.

However, it remains too soon to tell how the future of DPF will evolve and what impact it will have on our international activities.

At least one challenge to the DPF is pending before the Court of Justice of the European Union.

Further, Brexit has led and could also lead to legislative and regulatory changes that may increase our compliance costs.

As of January 1, 2021 and the expiry of transitional arrangements agreed to between the UK and the EU, data processing in the UK is governed by a UK version of the GDPR (combining the GDPR and the Data Protection Act 2018), exposing us to two parallel regimes, each of which authorizes similar fines and other potentially divergent enforcement actions for certain violations.

On June 28, 2021, the European Commission adopted an Adequacy Decision for the UK, allowing for the relatively free exchange of personal data between the EU and the UK (as the UK correspondingly allows transfers back to the EU).

However, the European Commission may suspend the Adequacy Decision if it considers that the UK no longer provides for an adequate level of data protection.

A bill to amend the existing UK framework has been reintroduced (in a different form) by the new UK Government and was announced as a bill which will be introduced into Parliament at the King’s Speech on July 17, 2024.

At this time, there is no specific clarity on the provisions of the bill, or the extent to which it will amend the UK framework, beyond general descriptions on its intended purpose.

Similar actions are either in place or under way in the United States.

There are a broad variety of data protection and breach notification laws that are applicable to our activities, and a wide range of enforcement agencies at both the state and federal levels that can review companies for privacy and data security concerns based on general consumer protection laws.

Each of these laws is subject to varying interpretations and the legislative landscape is constantly evolving and the Federal Trade Commission (FTC) and state Attorneys General all are aggressive in reviewing privacy and data security protections for consumers.

At the federal level, for example, the Health Insurance Portability and Accountability Act of 1996 (HIPAA), which establishes privacy and security standards that limit the use and disclosure of individually identifiable health information, or protected health information, and require the implementation of administrative, physical and technological safeguards to protect the privacy of protected health information and ensure the confidentiality, integrity and availability of electronic protected health information.

We may obtain health information from third parties (including research institutions from which we obtain clinical trial data) that are subject to privacy and security requirements under HIPAA.

Depending on the facts and circumstances, we could be subject to civil, criminal, and administrative penalties if we knowingly obtain, use, or disclose individually identifiable health information maintained by a HIPAA-covered entity in a manner that is not authorized or permitted by HIPAA.

Requirements for compliance under HIPAA are also subject to change, as the U.S.

Department of Health and Human Services Office of Civil Rights issued a proposed rule that would amend certain security compliance requirements for covered entities and business associates.

Even when HIPAA does not apply, according to the FTC, failing to take appropriate steps to keep consumers’ personal data secure constitutes unfair acts or practices in or affecting commerce in violation of Section 5(a) of the Federal Trade Commission Act.

The FTC expects a company’s data security measures to be reasonable and appropriate in light of the sensitivity and volume of consumer information it holds, the size and complexity of its business, and the cost of available tools to improve security and reduce vulnerabilities.

Individually identifiable health information is considered sensitive data that merits stronger safeguards.

In 2024, the FTC finalized updates to the Health Breach Notification Rule that, among other things, clarified its applicability to health apps and other similar technologies and expanded the information the breach notification requirements for entities subject to the rule which may add additional complexity to compliance obligations going forward.

Additionally, new laws also are being considered at both the state and federal levels and several states have passed comprehensive privacy laws.

For example, the California Consumer Privacy Act (CCPA), which went into effect on January 1, 2020, and as was later amended and expanded, is creating similar risks and obligations as those created by the GDPR, though the CCPA does exempt certain clinical trial data.

The CCPA may increase our compliance costs and potential liability, and we cannot yet predict the impact of the CCPA on our business.

Similar laws passed in various other states such as Virginia, Colorado, Connecticut, New Jersey and Texas, with effective dates through 2026.

Some state laws also minimize what data can be collected from consumers and how businesses may use and disclose it.

These state privacy laws also require businesses to make disclosures to consumers about data collection, use and sharing practices.

In addition, some of these laws (including the CCPA), along with other standalone health privacy laws, subject health-related information to additional safeguards and disclosures and some specifically regulate consumer health data, such as the Washington My Health My Data Act, which became effective in 2023 and 2024, Nevada’s Consumer Health Data Privacy Law, which became effective in 2024, and Connecticut’s amendments to its privacy law to address health data, which became effective in 2023.

Additionally, a broad range of legislative measures also have been introduced at the federal

Accordingly, failure to comply with federal and state laws (both those currently in effect and future legislation) regarding privacy and security of personal data could expose us to fines and penalties under such laws.

There also is the threat of consumer class actions related to these laws and the overall protection of personal data.

Our employees and personnel use generative artificial intelligence, or AI, technologies to perform their work, and the disclosure and use of personal data in generative AI technologies is subject to various privacy laws and other privacy obligations.

Governments have passed and are likely to pass additional laws regulating generative AI.

Our use of this technology could result in additional compliance costs, regulatory investigations and actions, and lawsuits.

If we are unable to use generative AI, it could make our business less efficient and result in competitive disadvantages.

Given the breadth and depth of changes in data protection obligations, preparing for and complying with these requirements is rigorous and time intensive and requires significant resources and a review of our technologies, systems and practices, as well as those of any third-party collaborators, service providers, CROs, contractors or consultants that process or transfer personal data collected in the EU.

The GDPR and other changes in laws or regulations associated with the enhanced protection of certain types of sensitive data, such as healthcare data or other personal data from our clinical trials, and access to certain data such as the European Health Data Space Regulation, could require us to change our business practices and put in place additional compliance mechanisms, may interrupt or delay our development, regulatory and commercialization activities and increase our cost of doing business, and could lead to government enforcement actions, private litigation and significant fines and penalties against us and could have a material adverse effect on our business, financial condition or results of operations.

Similarly, failure to comply with federal and state laws regarding privacy and security of personal data could expose us to fines and penalties under such laws.

Even if we are not determined to have violated these laws, government investigations into these issues typically require the expenditure of significant resources and generate negative publicity, which could harm our reputation and our business.

We may be vulnerable to disruption, damage and financial obligation as a result of system failures.

6 unchanged sentences

We are exposed to the risk of employee fraud or other misconduct.

Misconduct by employees could include intentional failures to comply with FDA regulations, to provide accurate information to the FDA, to comply with manufacturing standards we have established, to comply with federal and state healthcare fraud and abuse laws and

regulations, or to report financial information or data accurately or disclose unauthorized activities to us.

In particular, sales, marketing and business arrangements in the healthcare industry are subject to extensive laws and regulations intended to prevent fraud, misconduct, kickbacks, self-dealing and other abusive practices.

8 unchanged sentences

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1A. Risk Factors