JOHNSON & JOHNSON

The Company’s businesses are subject to varying degrees of governmental regulation in the countries in which operations are conducted, and the general trend is toward increasingly stringent regulation and enforcement. The Company is subject to costly and complex U.S. and foreign laws and governmental regulations and any adverse regulatory action may materially adversely affect the Company's financial condition and business operations. In the U.S., the pharmaceutical product and medical technology industries have long been subject to regulation by various federal and state agencies, primarily as to product safety, efficacy, manufacturing, advertising, labeling and safety reporting. The exercise of broad regulatory powers by the U.S. Food and Drug Administration (the U.S. FDA) continues to result in increases in the amounts of testing and documentation required for U.S. FDA approval of new drugs and devices and a corresponding increase in the expense of product introduction. Similar trends are also evident in major markets outside of the U.S.

The new medical device regulatory framework and the evolving privacy, data localization, and emerging cyber security laws and regulations around the world are examples of such increased regulation. Within the U.S., an increasing number of U.S. States have enacted comprehensive privacy laws and federal regulators (e.g., the U.S. FDA, FTC and HHS) continue to stress the intersection of health and privacy as a compliance and enforcement priority. In the EU, multiple directives and laws (including NIS2, EHDS, the Data Act, the Cyber Resilience Act, and the AI Act) are rapidly changing privacy and cybersecurity compliance requirements while introducing new enforcement risks. In addition, China has introduced broad personal information protection and data security regulations, with more anticipated, thereby increasing China’s scrutiny of company compliance and data transfer practices. With other jurisdictions enacting similar privacy laws, local data protection authorities will force greater accountability on the collection, access and use of personal data in the healthcare industry. These laws can also restrict transfers of data across borders, potentially impacting how data-driven health care solutions are developed and deployed globally in a compliant manner. Moreover, as a result of the broad scale release and availability of Artificial Intelligence (AI) technologies such as generative AI, a global trend towards more comprehensive and nuanced regulation (e.g., White House’s Executive Order on the Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence; the EU AI Act) to ensure the ethical use, privacy, and security of AI is underway that includes standards for transparency, accountability, and fairness, which will require compliance developments or enhancements.

The regulatory agencies under whose purview the Company operates have administrative powers that may subject it to actions such as product withdrawals, recalls, seizure of products and other civil and criminal sanctions. In some cases, the Company’s subsidiaries may deem it advisable to initiate product recalls regardless of whether it has been required or directed to.

The U.S. FDA and regulatory agencies around the globe are also increasing their enforcement activities. If the U.S. FDA were to conclude that we are not in compliance with applicable laws or regulations, or that any of our pharmaceutical products or medical technologies are ineffective or pose an unreasonable health risk, the U.S. FDA could ban such products, detain or seize adulterated or misbranded products, order a recall, repair, replacement, or refund of such products, refuse to grant pending applications for marketing authorization or require certificates of foreign governments for exports, and/or require us to notify health professionals and others that the products present unreasonable risks of substantial harm to the public health. The U.S. FDA may also assess civil or criminal penalties against us, our officers or employees and impose operating restrictions on a company-wide basis, or enjoin and/or restrain certain conduct resulting in violations of applicable law. The U.S. FDA may also recommend prosecution to the U.S. Department of Justice. Any adverse regulatory action, depending on its magnitude, may restrict us from effectively marketing and selling our products and limit our ability to obtain future clearances or approvals, and could result in a substantial modification to our business practices and operations. Equivalent enforcement mechanisms exist in different countries in which we conduct business.

The costs of human healthcare have been and continue to be a subject of study, investigation and regulation by governmental agencies and legislative bodies around the world. In the U.S., attention has been focused by states, regulatory agencies and Congress on prices, profits, overutilization and the quality and costs of healthcare generally. Laws and regulations have been enacted to require adherence to strict compliance standards and prevent fraud and abuse in the healthcare industry. There is increased focus on interactions and financial relationships between healthcare companies and healthcare providers. Various state and federal transparency laws and regulations require disclosures of payments and other transfers of value made to certain healthcare practitioners, including physicians, teaching hospitals, and certain non-physician practitioners. Federal and foreign laws governing international business practices require strict compliance with anti-bribery standards and certain prohibitions with respect to payments to any foreign government official. Payors and Pharmacy Benefit Managers (PBMs) are a potent force in the marketplace, and increased attention is being paid to the impact of PBM practices on healthcare cost and access in the U.S.

Our business has been and continues to be affected by federal and state legislation that alters the pricing, coverage, and reimbursement landscape. At the federal level, in August 2022, President Biden signed into law the Inflation Reduction Act

4

(IRA), which includes provisions that effectively authorize the government to establish prices for certain high-spend single-source drugs and biologics reimbursed by the Medicare program, starting in 2026 for Medicare Part D drugs and 2028 for Medicare Part B drugs. On August 29, 2023, the Centers for Medicare & Medicaid Services (“CMS”) published the first “Selected Drug” list, which includes XARELTO and STELARA as well as IMBRUVICA, which is developed in collaboration and co-commercialized in the U.S. with Pharmacyclics LLC, an AbbVie company. The Selected Drug list also included other medicines targeting disease states that are prevalent in the Medicare population. There remains uncertainty, however, regarding how the federal government will establish prices for the selected products, as the IRA specifies a ceiling price but not a minimum price. In any event, we anticipate that the selected products will be subjected to a government-established price for the Medicare population.

The IRA also contains provisions that impose rebates if certain prices increase at a rate that outpaces the rate of inflation, beginning October 1, 2022, for Medicare Part D drugs and January 1, 2023, for Medicare Part B drugs. Separate IRA provisions redesign the Medicare Part D benefit in various ways, including by shifting a greater portion of costs to manufacturers within certain coverage phases and replacing the Part D coverage gap discount program with a new manufacturer discounting program. Failure to comply with IRA provisions may subject manufacturers to various penalties, including civil monetary penalties.

In July 2023, Janssen Pharmaceuticals, Inc. (Janssen) filed litigation against the U.S. Department of Health and Human Services as well as the Centers for Medicare and Medicaid Services challenging the constitutionality of the Inflation Reduction Act’s (IRA) Medicare Drug Price Negotiation Program. The litigation requests a declaration that the IRA violates Janssen’s rights under the First Amendment and the Fifth Amendment to the Constitution and therefore that Janssen is not subject to the IRA’s mandatory pricing scheme. The impact of the IRA on our business and the broader pharmaceutical industry remains uncertain, as litigation filed by Janssen and other pharmaceutical companies remains ongoing and CMS has yet to publicly announce the maximum fair price for each of the selected drugs.

Additionally, we expect continued scrutiny on drug pricing and government price reporting from Congress, agencies, and other bodies at the federal and state levels, which may result in additional regulations or other mechanisms to increase pricing transparency and controls.

There are a number of additional bills pending in Congress and healthcare reform proposals at the state level that would affect drug pricing, including in the Medicare and Medicaid programs. This changing legal landscape has both positive and negative impacts on the U.S. healthcare industry with much remaining uncertain as to how various provisions of federal and state law, and potential modification or repeal of these laws, will ultimately affect the industry. The IRA and any other federal or state legislative change could affect the pricing and market conditions for our products.

In addition, business practices in the healthcare industry have come under increased scrutiny, particularly in the U.S., by government agencies and state attorneys general, and resulting investigations and prosecutions carry the risk of significant civil and criminal penalties. Of note is the increased enforcement activity by data protection authorities in various jurisdictions, particularly in the European Union, where significant fines have been levied on companies for data breaches, violations of privacy requirements, and unlawful cross-border data transfers. In the U.S., the Federal Trade Commission has stepped up enforcement of data privacy with several significant settlements (including settlements concerning the downstream sharing of personal information and use and disclosure of personal health data) and there have been a material increase in class-action lawsuits linked to the collection and use of biometric data and use of tracking technologies.

Further, the Company relies on global supply chains, and production and distribution processes, that are complex, and subject to increasing regulatory requirements that may affect sourcing, supply and pricing of materials used in the Company's products. These processes also are subject to complex and lengthy regulatory approvals.