MCKESSON CORP

We operate in many highly regulated environments and are subject to oversight by various federal, state, and local governmental entities in the U.S. and elsewhere. We incur significant expense and make large capital expenditures and investments to enable us to comply with laws and guidance promulgated by governmental entities.

The regulatory framework affecting our business and industry is continually evolving and influenced by conditions such as public policy developments; shifts in governmental priorities, initiatives, and focus areas, including due to changes in federal, state, and local representation; and varied interpretations of laws and agency rulemaking conventions. These conditions create uncertainties for our business, and we are unable to predict the impact of future changes to the regulatory framework, or any prolonged uncertainty, on our operations and compliance costs.

See “Risk Factors” in Item 1A of Part I below for additional information regarding material risks associated with our compliance with governmental regulations.

Operational Licenses and Permits; Controlled Substances: We are subject to the operating and security standards of the U.S. Drug Enforcement Administration (“DEA”), the U.S. Food and Drug Administration (“FDA”), the U.S. Department of Health and Human Services (“HHS”), the Centers for Medicare & Medicaid Services (“CMS”), various state boards of pharmacy, state health departments, and comparable agencies in the U.S. and other countries. Certain of our businesses may be required to register for permits and/or licenses with governmental agencies, depending upon the type of operations and location of product development, manufacture, distribution, and sale. For example, we are required to hold valid DEA and state-level registrations and licenses, meet various security and operating standards, and comply with the Controlled Substances Act and its accompanying regulations governing the sale, marketing, packaging, holding, distribution, and disposal of controlled substances. We maintain extensive controlled substance monitoring and reporting programs at considerable expense in order to help us meet those standards.

Government Contracts: Our contracts with governmental entities typically are subject to procurement laws that include socio-economic, employment practices, environmental protection, recordkeeping and accounting, and other requirements. These statutory and regulatory requirements complicate our business and increase our compliance burden. We are subject to audits, investigations, and oversight proceedings about our compliance with contractual and legal requirements.

Healthcare Program Regulation: Federal, state, and local governmental entities in the U.S. and elsewhere continue to strengthen their position on, and scrutiny of, practices that they believe may indicate fraud, waste, and abuse affecting government healthcare programs such as Medicare and Medicaid. Our relationships with pharmaceutical and medical-surgical product manufacturers, healthcare providers, and other companies and individuals, as well as our provision of products and services to governmental entities, subject our business to statutes, regulations, and government guidance that are intended to prevent fraud and abuse. Among other things, those laws: (1) prohibit persons from soliciting, offering, receiving, or paying any remuneration in order to induce the referral of an individual for, or to induce the ordering or purchasing of, items or services that are in any way paid for by Medicare, Medicaid, or other government healthcare programs; (2) prohibit physicians from referring certain “designated health services” to an entity with which they have a financial relationship, unless an exception applies; (3) prohibit knowingly submitting, or causing to be submitted, a false or fraudulent claim for payment to the

government; and (4) require certain entities to report and return an overpayment by Medicare or Medicaid within 60 days of identifying the overpayment.

Many of these healthcare fraud and abuse laws are vague or indefinite, and are often subject to varied and evolving interpretations by courts, regulators, and enforcing agencies and, as such, may be interpreted or applied by a prosecutorial, regulatory, or judicial authority in a manner that could require us to make changes in our operations at added expense.

The healthcare industry continues to be impacted by reform efforts aimed at reducing costs and government spending, as well as by challenges to those efforts. In the U.S., the Patient Protection and Affordable Care Act (“ACA”) significantly expanded health insurance coverage to uninsured Americans and changed the way healthcare is financed by both governmental and private payors. The ACA has faced scrutiny since its adoption, and we cannot predict the impact of any initiatives to change or repeal its provisions. Further, the ACA’s enhanced premium subsidies expired on December 31, 2025, and remain subject to ongoing Congressional review. The nonrenewal of, or any modifications to, these subsidies may reduce the availability of insurance coverage for certain patients and, in turn, impact our customers and our business. The Inflation Reduction Act of 2022 (“IRA”) made meaningful changes affecting benefit design and how Medicare pays for drugs, which are all intended to reduce the price of drugs. Three central features of the IRA have authorized the government to negotiate drug prices for certain Medicare Part B and Medicare Part D drugs over time, establish an inflation rebate program, and cap patient cost sharing under Medicare Part D. The ongoing implementation of the IRA may significantly affect the pharmaceutical value chain as manufacturers, pharmacy benefit managers, managed care organizations, and other stakeholders adapt their business models. Considerable uncertainty remains, including due to any future regulations and guidance.

The One Big Beautiful Bill (“OBBBA”), enacted in July 2025, includes provisions expected to reduce Medicaid enrollment and federal funding to state Medicaid programs, which may limit coverage or payment for products and services and impact the financial stability of our customers. Executive Order 14297, “Delivering Most-Favored-Nation Prescription Drug Pricing to American Patients,” issued in May 2025, seeks to facilitate manufacturers’ sale of certain drugs in the U.S. at no higher than the lowest prices paid in other developed countries. It also directs HHS to enable direct-to-consumer purchasing programs for prescription drugs at most-favored-nation prices, which may bypass supply chain intermediaries. Separately, CMS adopted a rule, effective January 1, 2026, on bona fide service fees (“BFSFs”) paid by drug manufacturers, including wholesaler distribution fees. The rule requires manufacturers to obtain certifications from wholesalers and other fee recipients that the fee recipient does not pass on the fee to a client or customer. Manufacturers are required to submit these certifications to CMS as part of their quarterly average sales price reporting. This rule creates a risk that certifications, when and if given, could be challenged, and that manufacturers may seek modifications to their service agreements. CMS waived the initial Q1 2026 reporting deadline that had been set for April 30, 2026. As of the date of this report, the form and scope of the certification requirements remain subject to change. CMS may also pursue additional changes to BFSF requirements in future rulemaking cycles that may impact fee recipients, including wholesalers.

CMS also proposed two rules in December 2025 that, if finalized, would implement mandatory manufacturer rebate models for certain Medicare Part B and Medicare Part D drugs based on international pricing benchmarks. These models would be tested in select geographic areas over a multi-year trial period.

There are ongoing developments with respect to the 340B Drug Pricing Program (the “340B program”) administered by the Health Resources and Services Administration (“HRSA”). The 340B program requires manufacturers to offer discounts on certain drugs purchased by “covered entities” such as safety-net providers, and some of our customers are covered entities or contract pharmacies for covered entities. Various manufacturers have unilaterally restricted sales under the 340B program to a limited number of contract pharmacies, and these practices are the subject of ongoing litigation. Further, HRSA continues to evaluate the potential implementation of a retrospective rebate model to effectuate 340B pricing in lieu of upfront discounts. A coalition of covered entities successfully challenged HRSA’s previously proposed rebate model pilot program, which had been scheduled to take effect on January 1, 2026. HRSA announced that pilot program amid separate litigation over its refusal to approve alternative rebate models proposed by manufacturers, and this litigation continues. These developments could, for example, limit the availability of 340B pricing or discounts for our customers. It is uncertain whether other changes to the 340B program may be effected through legislation, regulation, or judicial decision, or whether manufacturers will reduce their participation in or take other approaches to the 340B program. The cumulative impact of the foregoing on our customers and our business is difficult to predict.

Additionally, some states have enacted or are considering laws imposing caps or limits on the price of certain drugs distributed by wholesalers in those states. If upheld or enacted, these laws could encourage similar measures in other jurisdictions and could, directly or indirectly, affect wholesaler distribution economics. We continue to monitor these and other state reform initiatives and their potential impact on our business.

Outside the U.S., provincial governments in Canada that provide partial funding for the purchase of pharmaceuticals and independently regulate the sale and reimbursement of drugs have sought to reduce the costs of publicly funded health programs. For example, these governments have taken steps to reduce consumer prices for generic pharmaceuticals and, in some provinces, change professional allowances paid to pharmacists by generic drug manufacturers.

FDA Regulation and Supply Chain Integrity: In the U.S., the FDA is the principal federal authority that regulates the safety, efficacy, quality, testing, premarket approval, manufacture, labeling, storage, distribution, and post-market surveillance of healthcare products, such as drugs and medical devices, foods, and cosmetics.

Federal and state laws regulate the pharmaceutical drug supply chain in order to prevent the distribution of counterfeit, stolen, contaminated, or otherwise harmful prescription drugs in interstate commerce. At the federal level, the Drug Supply Chain Security Act (“DSCSA”), among other things, requires standardized, unit-level traceability of pharmaceutical products along the entire drug supply chain and requires all trading partners to cooperate in an electronic, interoperable prescription drug traceability system. The DSCSA also sets forth national standards for the licensure of wholesale drug distributors and third-party logistic providers and other requirements applicable to these entities and the FDA has issued a proposed rule with respect to these requirements. These federal and state regulatory requirements have increased, and may further increase, our compliance burden and distribution costs.

Additionally, federal and state governments may adopt other laws intended to protect the integrity of the supply chain, and those laws could affect our distribution business. For example, the Federal Trade Commission (“FTC”) and HHS issued a request for public comment in 2024 on how the practices of pharmaceutical wholesalers and group purchasing organizations impact generic drug shortages. Various industry stakeholders responded to this request, but no further action has been taken by the FTC or HHS.

Cybersecurity, Data Security, Privacy, and AI: We are subject to many cybersecurity, privacy, and data protection laws that change frequently and have requirements that vary from jurisdiction to jurisdiction. Our efforts to comply with these laws complicate our operations and add to our costs. We are subject to significant compliance obligations under privacy laws such as the Health Insurance Portability and Accountability Act of 1996, the General Data Protection Regulation in the European Union, the Personal Information Protection and Electronic Documents Act in Canada, and an expanding list of comprehensive state privacy laws in the U.S. Some privacy laws may prohibit the transfer of personal information to certain other jurisdictions or otherwise limit our use and disclosure of data. Many of these laws also require us to provide access or other data rights (modification, deletion, portability, etc.) to consumers’ and patients’ individual personal data records within specified periods of time. Cybersecurity laws such as the federal Cyber Incident Reporting for Critical Infrastructure Act of 2022, proposed changes to the Federal Acquisition Regulation, and SEC reporting requirements may require us to provide notifications of certain cybersecurity incidents within short timeframes. Regulations and guidance targeting critical infrastructure entities, including McKesson, continue to be a focus of regulators. We are subject to privacy and data protection compliance audits or investigations by various governmental agencies. Additionally, AI laws and guidance are rapidly expanding and changing, with potential differences or conflicts across jurisdictions. This creates uncertainty and regulatory risk, including for healthcare-related uses of AI. If we or our third-party providers are restricted from using AI as a result of any laws, regulatory views, or other measures, it could impact our operations and competitiveness, increase our compliance expense and burden (including related to any documentation, risk management, or transparency measures), and cause us to modify our use, development, or deployment of AI and incur substantial costs. We also could be subject to increased litigation and enforcement risks. The cumulative impact of these evolving requirements on our business is difficult to predict.

Environmental Regulation: We are subject to requirements in various jurisdictions concerning the environment, including laws addressing discharges into the air and water, the management and disposal of hazardous substances and wastes, and the remediation of contaminated sites, as well as laws governing the operation of radiation-emitting equipment at the U.S. Oncology Network practices.

We sold our chemical distribution operations in 1987 and retained responsibility for certain environmental obligations. Agreements with the U.S. Environmental Protection Agency and certain states have required and may require environmental assessments and remediation at several sites. These matters are described further in Financial Note 17, “Commitments and Contingent Liabilities,” to the consolidated financial statements included in this Annual Report.

Climate Change Regulation: Governments in the U.S. and abroad have adopted or are considering new or expanded policies and laws to address climate change. Such policies and laws may necessitate reductions in greenhouse gas (“GHG”) emissions; mandate that companies implement processes and controls to monitor and disclose climate-related matters; and impose additional taxes or offset charges on specified energy sources, among other requirements. Compliance with climate-related policies and laws may be further complicated by disparate regulatory approaches in various jurisdictions. New or expanded climate-related policies and laws could impose costs on us, including capital expenditures to develop or modify data gathering and reporting systems, third-party attestations, and additional GHG reduction measures. Until the timing and extent of climate-related policies and laws are clarified, including due to legal challenges, we cannot predict their potential effect on our capital expenditures, results of operations, or competitive position.

Competition and Related Laws: Antitrust and competition laws (“competition laws”) in the U.S. and elsewhere prohibit types of conduct, practices, or arrangements deemed to be anti-competitive. Enforcement of competition laws in the healthcare industry remains a focus of the FTC and the U.S. Department of Justice. Some of our strategic transactions may require review by competition regulators, with potential delays or other unfavorable outcomes. Violations of competition laws can result in sanctions and other adverse actions, including criminal and civil penalties. Private plaintiffs also may bring civil lawsuits for alleged violations of competition laws, including claims for treble damages. Additionally, laws may be proposed to restrict certain healthcare ownership structures or arrangements, such as vertical integration involving physician practice administrative or management services and pharmaceutical distribution services, where traditional antitrust standards might not be implicated. Competition and related laws contribute to our compliance efforts and expense, and the enforcement, enactment, expansion, or application of any of the foregoing types of laws might materially adversely affect our operations and growth strategy.