Rapport Therapeutics, Inc.

Previous wording

We are a clinical-stage biopharmaceutical company with a limited operating history, which may make it difficult to evaluate our current business and predict our future success and viability. We have incurred significant financial losses since our inception and anticipate that we will continue to incur significant financial losses for the foreseeable future.

Current wording

We are a clinical-stage biotechnology company with a limited operating history, which may make it difficult to evaluate our current business and predict our future success and viability. We have incurred significant financial losses since our inception and anticipate that we will continue to incur significant financial losses for the foreseeable future.

Previous wording

We are a clinical-stage biopharmaceutical company with a limited operating history. We were formed in February 2022 and our operations to date have been limited to organizing and staffing our company, business planning, raising capital, developing our receptor associated protein (“RAP”) technology platform and technology, identifying potential product candidates, securing intellectual property rights, and planning and undertaking preclinical studies and clinical trials. Substantially all of our product candidates were initially developed by Janssen Pharmaceutical NV (“Janssen”), which we in-licensed pursuant to the option and license agreement with Janssen (the “Janssen License”), entered into shortly after our formation. We have not yet demonstrated an ability to generate revenues, obtain regulatory approvals, manufacture any product on a commercial scale or arrange for a third party to do so on our behalf or conduct sales and marketing activities necessary for successful product commercialization. Our limited operating history as a company makes any assessment of our future success and viability subject to significant uncertainty. We will encounter risks and difficulties frequently experienced by early-stage biopharmaceutical companies in rapidly evolving fields, and we have not yet demonstrated an ability to successfully overcome such risks and difficulties. If we do not address these risks and difficulties successfully, our business will suffer.

Current wording

We are a clinical-stage biotechnology company with a limited operating history. We were formed in February 2022 and our operations to date have been limited to organizing and staffing our company, business planning, raising capital, developing our receptor associated protein (“RAP”) technology platform and technology, identifying potential product candidates, securing intellectual property rights, and planning and undertaking preclinical studies and clinical trials. Substantially all of our product candidates were initially developed by Janssen Pharmaceutical NV (“Janssen”), which we in-licensed pursuant to the option and license agreement with Janssen (the “Janssen License”), entered into shortly after our formation. We have not yet demonstrated an ability to generate revenues, obtain regulatory approvals, manufacture any product on a commercial scale or arrange for a third party to do so on our behalf or conduct sales and marketing activities necessary for successful product commercialization. Our limited operating history as a company makes any assessment of our future success and viability subject to significant uncertainty. We will encounter risks and difficulties frequently experienced by early-stage biotechnology companies in rapidly evolving fields, and we have not yet demonstrated an ability to successfully overcome such risks and difficulties. If we do not address these risks and difficulties successfully, our business will suffer.

Previous wording

The success of our business depends primarily upon our ability to identify, develop, and commercialize product candidates based on our RAP technology platform. We do not know whether we will be able to develop any product candidates that succeed through preclinical and clinical development or products of commercial value. We have no products approved for commercial sale and have not generated any revenue from product sales to date. We will continue to incur significant research and development and other expenses related to our preclinical and clinical development and ongoing operations. As a result, we are not profitable and have incurred losses in each period since our inception. Net losses and negative cash flows have had, and will continue to have, an adverse effect on our stockholders’ equity and working capital. Our net losses totaled $10.7 million and $34.8 million for the period from February 10, 2022 (inception) to December 31, 2022 and for the year ended December 31, 2023, respectively. Our net losses totaled $58.3 million and $21.3 million for the nine months ended September 30, 2024 and 2023, respectively. As of September 30, 2024, we have not yet generated revenues and had an accumulated deficit of $103.8 million. We expect to continue to incur significant losses for the foreseeable future, and we expect these losses to increase as we continue our research and development of, and seek regulatory approvals for, our product candidates.

Current wording

The success of our business depends primarily upon our ability to identify, develop, and commercialize product candidates based on our RAP technology platform. We do not know whether we will be able to develop any product candidates that succeed through preclinical and clinical development or products of commercial value. We have no products approved for commercial sale and have not generated any revenue from product sales to date. We will continue to incur significant research and development and other expenses related to our preclinical and clinical development and ongoing operations. As a result, we are not profitable and have incurred losses in each period since our inception. Net losses and negative cash flows have had, and will continue to have, an adverse effect on our stockholders’ equity and working capital. Our net losses totaled $24.1 million and $22.7 million for the three months ended March 31, 2025 and 2024, respectively. As of March 31, 2025, we have not yet generated revenues and had an accumulated deficit of $147.8 million. We expect to continue to incur significant losses for the foreseeable future, and we expect these losses to increase as we continue our research and development of, and seek regulatory approvals for, our product candidates.

Previous wording

Biopharmaceutical product development entails substantial upfront capital expenditures and significant risk that any potential product candidate will fail to demonstrate adequate efficacy or an acceptable safety profile, gain regulatory approval, secure market access and reimbursement and become commercially viable, and therefore any investment in us is highly speculative. Accordingly, before making an investment in us, our prospects, factoring in the costs, uncertainties, delays and difficulties frequently encountered by companies in clinical development, especially clinical-stage biopharmaceutical companies such as ours, should be carefully considered. Any predictions about our future success or viability may not be as accurate as they would otherwise be if we had a longer operating history or a history of successfully developing and commercializing pharmaceutical products. We may encounter unforeseen expenses, difficulties, complications, delays and other known or unknown factors in achieving our business objectives.

Current wording

Biotechnology product development entails substantial upfront capital expenditures and significant risk that any potential product candidate will fail to demonstrate adequate efficacy or an acceptable safety profile, gain regulatory approval, secure market access and reimbursement and become commercially viable, and therefore any investment in us is highly speculative. Accordingly, before making an investment in us, our prospects, factoring in the costs, uncertainties, delays and difficulties frequently encountered by companies in clinical development, especially clinical-stage biotechnology companies such as ours, should be carefully considered. Any predictions about our future success or viability may not be as accurate as they would otherwise be if we had a longer operating history or a history of successfully developing and commercializing pharmaceutical products. We may encounter unforeseen expenses, difficulties, complications, delays and other known or unknown factors in achieving our business objectives.

Previous wording

Additionally, our expenses could increase beyond our expectations if we are required by the Food and Drug Administration (“FDA”), European Medicines Agency (“EMA”), or other comparable regulatory authorities to perform clinical trials in addition to those that we currently expect, or if there are any delays in establishing appropriate manufacturing arrangements for or in completing our clinical trials or the development of any of our product candidates.

Current wording

Additionally, our expenses could increase beyond our expectations if we are required by the U.S. Food and Drug Administration (the “FDA”), European Medicines Agency (“EMA”), Medicines and Healthcare products Regulatory Agency (“MHRA”) or other comparable regulatory authorities to perform clinical trials in addition to those that we currently expect, or if there are any delays in establishing appropriate manufacturing arrangements for or in completing our clinical trials or the development of any of our product candidates.

Previous wording

Developing biopharmaceutical products, including conducting preclinical studies and clinical trials, is a very time-consuming, expensive and uncertain process that takes years to complete. We expect our expenses to continue to increase in connection with our ongoing activities, particularly as we conduct clinical trials of, and seek regulatory and marketing approval for, our product candidates. Even if our current or future product candidates are approved for commercial sale, we anticipate incurring significant costs associated with commercializing any approved product candidate. To date, we have funded our operations principally through private financings and our initial public offering (“IPO”) and concurrent private placement, which closed in June 2024. We expect our expenses to increase in connection with our ongoing activities, particularly as we continue the clinical and preclinical development of our product candidates, continue to identify additional targets using our RAP technology platform, commence additional preclinical studies and clinical trials, and continue to identify and develop additional product candidates either through internal development or through acquisitions or in-licensing product candidates.

Current wording

Developing biotechnology products, including conducting preclinical studies and clinical trials, is a very time-consuming, expensive and uncertain process that takes years to complete. We expect our expenses to continue to increase in connection with our ongoing activities, particularly as we conduct clinical trials of, and seek regulatory and marketing approval for, our product candidates. Even if our current or future product candidates are approved for commercial sale, we anticipate incurring significant costs associated with commercializing any approved product candidate. To date, we have funded our operations principally through private financings and our initial public offering (“IPO”) and concurrent private placement, which closed in June 2024. We expect our expenses to increase in connection with our ongoing activities, particularly as we continue the clinical and preclinical development of our product candidates, continue to identify additional targets using our RAP technology platform, commence additional preclinical studies and clinical trials, and continue to identify and develop additional product candidates either through internal development or through acquisitions or in-licensing product candidates.

Previous wording

As of September 30, 2024, we had $320.7 million of cash, cash equivalents and short-term investments, excluding restricted cash. Based upon our current operating plan, we believe that our existing cash, cash equivalents and short-term investments will enable us to fund our operating expenses and capital expenditure requirements through the end of 2026. We have based this estimate on assumptions that may prove to be wrong, and we could utilize our available capital resources sooner than we expect. We may also raise additional financing on an opportunistic basis in the future. For example, we may seek additional capital due to favorable market conditions or strategic considerations even if we believe we have sufficient funds for our current or future operating plans. Attempting to secure additional financing may divert our management from our day-to-day activities, which may adversely affect our ability to develop our product candidates. Our future capital requirements will depend on many factors, including but not limited to:

Current wording

As of March 31, 2025, we had $285.4 million of cash, cash equivalents and short-term investments, excluding restricted cash. Based upon our current operating plan, we believe that our existing cash, cash equivalents and short-term investments will enable us to fund our operating expenses and capital expenditure requirements through the end of 2026. We have based this estimate on assumptions that may prove to be wrong, and we could utilize our available capital resources sooner than we expect. We may also raise additional financing on an opportunistic basis in the future. For example, we may seek additional capital due to favorable market conditions or strategic considerations even if we believe we have sufficient funds for our current or future operating plans. Attempting to secure additional financing may divert our management from our day-to-day activities, which may adversely affect our ability to develop our product candidates. Our future capital requirements will depend on many factors, including but not limited to:

Previous wording

To date, as an organization, we have not completed the development of any product candidates and nearly all of our candidates remain in early-stage clinical or preclinical development. Our future success and ability to generate revenue from our product candidates is dependent on our ability to successfully develop, obtain regulatory approval for and commercialize one or more of our product candidates. All of our product candidates will require substantial additional investment for clinical development, regulatory review and approval in one or more jurisdictions. If any of our product candidates, particularly RAP-219, encounters safety or efficacy problems, development delays or regulatory issues or other problems, our development plans and business would be materially harmed.

Current wording

To date, as an organization, we have not completed the development of any product candidates and nearly all of our candidates remain in early-stage clinical or preclinical development. Our future success and ability to generate revenue from our product candidates is dependent on our ability to successfully develop, obtain regulatory approval for and commercialize one or more of our product candidates. All of our product candidates will require substantial additional investment for clinical development, regulatory review and approval in one or more jurisdictions. If any of our product candidates, particularly RAP-219, encounter safety or efficacy problems, development delays or regulatory issues or other problems, our development plans and business would be materially harmed.

Previous wording

our inability to demonstrate to the satisfaction of the FDA, EMA, or other comparable regulatory authorities that our product candidates are safe and effective;

Current wording

our inability to demonstrate to the satisfaction of the FDA, EMA, MHRA or other comparable regulatory authorities that our product candidates are safe and effective;

Previous wording

delays in submitting an Investigational New Drug (“IND”) application or other regulatory submission to the FDA, EMA, or other comparable regulatory authorities, or delays or failure in obtaining the necessary approvals from regulators to commence a clinical trial or a suspension or termination, or hold, of a clinical trial once commenced;

Current wording

delays in submitting an Investigational New Drug (“IND”) application or other regulatory submission to the FDA, EMA, MHRA or other comparable regulatory authorities, or delays or failure in obtaining the necessary approvals from regulators to commence a clinical trial or a suspension or termination, or hold, of a clinical trial once commenced;

Previous wording

conditions imposed by the FDA, EMA, or other comparable regulatory authorities regarding the scope or design of our clinical trials;

Current wording

conditions imposed by the FDA, EMA, MHRA or other comparable regulatory authorities regarding the scope or design of our clinical trials;

Previous wording

unfavorable FDA, EMA or comparable regulatory authority inspection and review of our clinical trial sites;

Current wording

unfavorable FDA, EMA MHRA or comparable regulatory authority inspection and review of our clinical trial sites;

Previous wording

varying interpretations of data by the FDA, EMA, or other comparable regulatory authorities.

Current wording

varying interpretations of data by the FDA, EMA, MHRA or other comparable regulatory authorities.

Previous wording

In addition, clinical trials conducted in one country may not be accepted by regulatory authorities in other countries, and regulatory approval in one country does not guarantee regulatory approval in any other country. We expect to conduct one or more of our clinical trials with one or more trial sites that are located outside the United States. Although the FDA may accept data from clinical trials conducted outside the United States, acceptance of this data is subject to conditions imposed by the FDA, and there can be no assurance that the FDA will accept data from trials conducted outside of the United States. If the FDA does not accept the data from any trial that we conduct outside the United States, it would likely result in the need for additional trials, which would be costly and time-consuming and could delay or permanently halt our development of the applicable product candidates.

Current wording

In addition, clinical trials conducted in one country may not be accepted by regulatory authorities in other countries, and regulatory approval in one country does not guarantee regulatory approval in any other country. Although the FDA may accept data from clinical trials conducted outside the United States, acceptance of this data is subject to conditions imposed by the FDA, and there can be no assurance that the FDA will accept data from trials conducted outside of the United States. If the FDA does not accept the data from any trial that we conduct outside the United States, it would likely result in the need for additional trials, which would be costly and time-consuming and could delay or permanently halt our development of the applicable product candidates.

Previous wording

failure to receive the necessary regulatory approvals or a delay in receiving such approvals, which, among other things, may be caused by patients who fail the trial screening process, slow enrollment in clinical trials, patients dropping out of trials, patients lost to follow-up, length of time to achieve trial endpoints, additional time requirements for data analysis or New Drug Application (“NDA”) or similar foreign application preparation, discussions with the FDA, EMA, or other comparable regulatory authority an FDA, EMA, or other comparable regulatory request for additional preclinical or clinical data (such as long-term toxicology studies) or unexpected safety or manufacturing issues;

Current wording

failure to receive the necessary regulatory approvals or a delay in receiving such approvals, which, among other things, may be caused by patients who fail the trial screening process, slow enrollment in clinical trials, patients dropping out of trials, patients lost to follow-up, length of time to achieve trial endpoints, additional time requirements for data analysis or New Drug Application (“NDA”) or similar foreign application preparation, discussions with the FDA, EMA, MHRA or other comparable regulatory authority an FDA, EMA, MHRA or other comparable regulatory request for additional preclinical or clinical data (such as long-term toxicology studies) or unexpected safety or manufacturing issues;

Previous wording

For example, in the fourth quarter of 2024, we were notified by the FDA that the IND submitted by us for the initiation of a Phase 2a proof-of-concept trial of RAP-219 for the treatment of DPNP was placed on clinical hold. The FDA requested additional information and amendments specific to the protocol design. We are working with the FDA to provide the requested information. Should our response to the clinical hold not be satisfactory to the FDA, the clinical hold may not be lifted on a timely basis, or at all. Furthermore, in December 2023, we withdrew the development of another TARPg 8 targeted molecule (RAP-482) in-licensed from Janssen that received a clinical hold from the FDA prior to initiation of a Phase 1 trial, in order to prioritize development of our lead product candidate, RAP-219, and our other development candidates and programs. Furthermore, the length of time necessary to complete clinical trials and submit an application for marketing approval for a final decision by a regulatory authority varies significantly from one product candidate to the next and from one country or jurisdiction to the next and may be difficult to predict.

Current wording

For example, in the fourth quarter of 2024, we were notified by the FDA that the IND submitted by us for the initiation of a Phase 2a proof-of-concept trial of RAP-219 in diabetic peripheral neuropathic pain (“DPNP”) was placed on clinical hold. The FDA requested additional information and amendments specific to the protocol design. We are working with the FDA to provide the requested information. Should our response to the clinical hold not be satisfactory to the FDA, the clinical hold may not be lifted on a timely basis, or at all. Furthermore, in December 2023, we withdrew the development of another TARPg 8 targeted molecule (RAP-482) in-licensed from Janssen that received a full clinical hold from the FDA prior to initiation of a Phase 1 trial, in order to prioritize development of our lead product candidate, RAP-219, and our other development candidates and programs. Furthermore, the length of time necessary to complete clinical trials and submit an application for marketing approval for a final decision by a regulatory authority varies significantly from one product candidate to the next and from one country or jurisdiction to the next and may be difficult to predict.

Previous wording

We have completed phase 1 clinical development of our lead product candidate, RAP-219, for the treatment of focal epilepsy, and patient recruitment and screening is underway for our Phase 2a trial of RAP-219. We also intend to initiate additional Phase 2a trials of RAP-219 for the treatment of peripheral neuropathic pain and bipolar disorder. Our other product candidates and programs are at various stages of preclinical development. We seek to rapidly advance discovery and development of transformational small molecule medicines for patients suffering from central nervous system disorders.

Current wording

We have completed phase 1 clinical development of our lead product candidate, RAP-219, in multiple indications and are currently conducting a Phase 2a trial of RAP-219 in refractory focal epilepsy. We also intend to initiate additional Phase 2a trials of RAP-219 in bipolar mania and diabetic peripheral neuropathic pain. Our other product candidates and programs are at various stages of preclinical development. We seek to rapidly advance discovery and development of transformational small molecule medicines for patients suffering from central nervous system disorders.

Previous wording

Due to the significant resources required for the development of our product candidates, we must decide which product candidates and indications to pursue and advance and the amount of resources to allocate to each. Our decisions concerning the allocation of research, development, collaboration, management and financial resources toward particular product candidates, therapeutic areas or indications may not lead to the development of viable commercial products and may divert resources away from better opportunities. If we make incorrect determinations regarding the viability or market potential of any of our product candidates or misread trends in the pharmaceutical industry, in particular for disorders of the brain and nervous system, our business, financial condition and results of operations could be materially and adversely affected. As a result, we may fail to capitalize on viable commercial products or profitable market opportunities, be required to forego or delay pursuit of opportunities with other product candidates or other diseases and disease pathways that may later prove to have greater commercial potential than those we choose to pursue, or relinquish valuable rights to such product candidates through collaboration, licensing or royalty arrangements in cases in which it would have been advantageous for us to invest additional resources to retain sole development and commercialization rights.

Current wording

Due to the significant resources required for the development of our product candidates, we must decide which product candidates and indications to pursue and advance and the amount of resources to allocate to each. Our decisions concerning the allocation of research, development, collaboration, management and financial resources toward particular product candidates, therapeutic areas or indications may not lead to the development of viable commercial products and may divert resources away from better opportunities. If we make incorrect determinations regarding the viability or market potential of any of our product candidates or misread trends in the pharmaceutical industry, in particular for disorders of the nervous system, our business, financial condition and results of operations could be materially and adversely affected. As a result, we may fail to capitalize on viable commercial products or profitable market opportunities, be required to forego or delay pursuit of opportunities with other product candidates or other diseases and disease pathways that may later prove to have greater commercial potential than those we choose to pursue, or relinquish valuable rights to such product candidates through collaboration, licensing or royalty arrangements in cases in which it would have been advantageous for us to invest additional resources to retain sole development and commercialization rights.

Previous wording

At the state level, numerous U.S. states have enacted comprehensive privacy laws that impose certain obligations on covered businesses, including providing specific disclosures in privacy notices and affording individuals certain rights concerning their personal data. Similar laws are being considered in several other states, as well as at the federal and local levels, and we expect more states to pass similar laws in the future. While these states exempt some data processed in the context of clinical trials, these developments may further complicate compliance efforts, and increase legal risk and compliance costs for us and the third parties upon whom we rely.

Current wording

Similar laws have been passed and proposed in numerous states, as well as at the federal and local levels, and we expect more states to pass similar laws in the future. Such proposed legislation, if enacted, may add additional complexity, variation in requirements, restrictions and potential legal risk, require additional investment of resources in compliance programs, impact strategies and the availability of previously useful data and could result in increased compliance costs and/or changes in business practices and policies. The existence of comprehensive privacy laws in different states in the country would make our compliance obligations more complex and costly and may increase the likelihood that we may be subject to enforcement actions or otherwise incur liability for noncompliance. While these states exempt some data processed in the context of clinical trials, these developments may further complicate compliance efforts, and increase legal risk and compliance costs for us and the third parties upon whom we rely.

Previous wording

Additionally, we may be subject to new laws governing the privacy of consumer health data. For example, Washington’s My Health My Data Act broadly defines consumer health data, creates a private right of action to allow individuals to sue for violations of the law, imposes stringent consent requirements and grants consumers certain rights with respect to their health data, including to request deletion of their information. Connecticut and Nevada have also passed similar laws regulating consumer health data. These various privacy and data security laws may impact our business activities, including our identification of research subjects, relationships with business partners and ultimately the marketing and distribution of our products.

Current wording

Additionally, we may be subject to new laws governing the privacy of consumer health data. For example, Washington’s My Health My Data Act, which went into effect on March 31, 2024 broadly defines consumer health data, creates a private right of action to allow individuals to sue for violations of the law, imposes stringent consent requirements and grants consumers certain rights with respect to their health data, including to request deletion of their information. Connecticut and Nevada have also passed similar laws regulating consumer health data. These various privacy and data security laws may impact our business activities, including our identification of research subjects, relationships with business partners and ultimately the marketing and distribution of our products. In addition, other states have proposed and/or passed legislation that regulates the privacy and/or security of certain other specific types of information. For example, a small number of states have passed laws that regulate biometric data specifically. State laws are changing rapidly and there have been a number of proposals in the U.S. Congress for a new comprehensive federal data privacy law to which we may likely become subject to, if enacted.

Previous wording

The EU GDPR and the UK GDPR (together, “GDPR”) establish stringent requirements regarding the processing of personal data, including strict requirements relating to processing of sensitive data (such as health data), ensuring there is a legal basis or condition to justify the processing of personal data, where required strict requirements relating to obtaining consent of individuals, transparent disclosures about how personal data is to be used, limitations on retention of information, implementing safeguards to protect the security and confidentiality of personal data, where required providing notification of data breaches, maintaining records of processing activities and documenting data protection impact assessments where there is high risk processing and taking certain measures when engaging third-party processors.

Current wording

The EU GDPR and the UK GDPR (together, “GDPR”) establish stringent requirements regarding the processing of personal data, including strict requirements relating to processing sensitive data (such as health data), ensuring there is a legal basis or condition to justify the processing of personal data, where required obtaining consent from individuals, transparent disclosures about how personal data is to be used, limitations on retention of information, implementing safeguards to protect the security and confidentiality of personal data, where required providing notification of data breaches, maintaining records of processing activities and documenting data protection impact assessments where there is high risk processing and taking certain measures when engaging third-party processors.

Previous wording

Under GDPR, companies may face temporary or definitive bans on data processing and other corrective activities, fines of up to €20 million (£17.5 million GBP) or 4% of annual global revenues, whichever is greater, and private litigation related to processing of personal data brought by classes of data subjects or consumer protection organizations authorized at law to represent their interests. Non-compliance could also result in a material adverse effect on our business, financial position and results of operations.

Current wording

Under GDPR, companies may face temporary or definitive bans on data processing and other corrective activities, fines of up to €20 million (£17.5 million GBP) or 4% of annual global revenues, whichever is greater, and private litigation related to processing of personal data brought by data subjects or consumer protection organizations authorized at law to represent their interests. Non-compliance could also result in a material adverse effect on our business, financial position and results of operations.

Previous wording

UK’s International Data Transfer Agreement / Addendum, and the EU-U.S. Data Privacy Framework and the UK extension thereto (which allows for transfers to relevant U.S.-based organizations who self-certify compliance and participate in the Framework), these mechanisms are subject to legal challenges, and there is no assurance that we can satisfy or rely on these measures to lawfully transfer personal data to the United States. If there is no lawful manner for us to transfer personal data from the EEA, the UK, or other jurisdictions to the United States, or if the requirements for a legally-compliant transfer are too onerous, we could face significant adverse consequences, including the interruption or degradation of our operations, the need to relocate part of or all of our business or data processing activities to other jurisdictions (such as Europe) at significant expense, increased exposure to regulatory actions, substantial fines and penalties, the inability to transfer data and work with partners, vendors and other third parties, and injunctions against our processing or transferring of personal data necessary to operate our business. Additionally, companies that transfer personal data out of the EEA and UK to other jurisdictions, particularly to the United States, are subject to increased scrutiny from regulators, individual litigants, and activities activist groups. Some European regulators have ordered certain companies to suspend or permanently cease certain transfers of personal data out of Europe for allegedly violating the GDPR’s cross-border data transfer limitations.

Current wording

from regulators, individual litigants, and activist groups. Some European regulators have ordered certain companies to suspend or permanently cease certain transfers of personal data out of Europe for allegedly violating the GDPR’s cross-border data transfer limitations.

Previous wording

Although the UK is regarded as a third country under the EU GDPR, the European Commission has issued an adequacy decision recognizing the UK as providing adequate protection under the EU GDPR and, therefore, transfers of personal data originating in the EEA to the UK remain unrestricted. Likewise, the UK government has confirmed that personal data transfers from the UK to the EEA remain free flowing. Further, potential changes to UK data protection laws may alter the similarities between the UK and EEA data protection regime and threaten the UK adequacy decision from the European Commission. The potential of the respective provisions and enforcement of the EU GDPR and UK GDPR further diverging in the future creates additional regulatory challenges and uncertainties for us. The lack of clarity on future UK laws and regulations and their interaction with EU laws and regulations could add legal risk, uncertainty, complexity and cost to our handling of European personal data and our privacy and data security compliance programs and could require us to implement different compliance measures for the UK and the EEA.

Current wording

Although the UK is regarded as a third country under the EU GDPR, the European Commission has issued an adequacy decision recognizing the UK as providing adequate data protection and, therefore, transfers of personal data originating in the EEA to the UK remain unrestricted. Likewise, the UK government has confirmed that personal data transfers from the UK to the EEA remain free flowing. However, the UK government is planning to reform its data protection law with the Data (Use and Access) Bill, which it has introduced to Parliament on 24 October 2024. These potential future changes to UK data protection laws may alter the similarities between the UK and EEA data protection regime and threaten the UK adequacy decision from the European Commission. The potential of the EU GDPR and UK GDPR further diverging in the future creates additional regulatory challenges and uncertainties for us. The lack of clarity on future UK laws and regulations and their interaction with EU laws and regulations could add legal risk, uncertainty, complexity and cost to our handling of European personal data and our privacy and data security compliance programs and could require us to implement different compliance measures for the UK and the EEA.

Previous wording

Our information technology systems and infrastructure, or those of our collaborators and service providers, or our data, may be subject to cyber-attacks, security breaches, compromises or other incidents, which could result in additional costs, loss of revenue, significant liabilities, harm to our brand, material disruption of our development programs and operations, or other adverse consequences.

Current wording

Our information technology systems and infrastructure, or those of our collaborators and service providers, or our data, may be subject to cyber-attacks, cybersecurity incidents or breaches, compromises or other interruptions, which could result in additional costs, loss of revenue, significant liabilities, harm to our brand, material disruption of our development programs and operations, or other adverse consequences.

Previous wording

In the ordinary course of our business, we and the third parties upon which we rely, process sensitive data, and, as a result, we and the third parties upon which we rely face a variety of evolving threats that could cause cyber-attacks, security breaches, compromises, or other incidents. Although we take steps to develop and maintain systems and controls designed to protect our sensitive data, systems and infrastructure, there can be no assurance that our internal technology systems and infrastructure, or those of third parties upon which we rely, will be sufficient to protect against a cyber-attack, security breach, compromise or other incident such as an industrial espionage attack, ransomware, or insider threat attack, which may compromise our system infrastructure or lead to the loss, destruction, alteration or dissemination of, or damage to, our sensitive data. Such threats are prevalent and continue to rise, are increasingly difficult to detect, and come from a variety of sources, including traditional computer “hackers,” threat actors, “hacktivists,” organized criminal threat actors, personnel (such as through theft or misuse), sophisticated nation states, and nation-state-supported actors.

Current wording

In the ordinary course of our business, we and the third parties upon which we rely, process sensitive data, and, as a result, we and the third parties upon which we rely face a variety of evolving threats that could cause cyber-attacks, cybersecurity incidents, breaches, compromises, or other interruptions. Although we take steps to develop and maintain systems and controls designed to protect our sensitive data, systems and infrastructure, there can be no assurance that our internal technology systems and infrastructure, or those of third parties upon which we rely, will be sufficient to protect against a cyber-attack, cybersecurity breach, compromise or other incident such as an industrial espionage attack, ransomware, or insider threat attack, which may compromise our system infrastructure or lead to the loss, destruction, alteration or dissemination of, or damage to, our sensitive data. Such threats are prevalent and continue to rise, are increasingly difficult to detect, and come from a variety of sources, including traditional computer “hackers,” threat actors, “hacktivists,” organized criminal threat actors, personnel (such as through theft or misuse), sophisticated nation states, and nation-state-supported actors.

Previous wording

The risk of a cyber-attack, security breach, compromise, or other incident has generally increased as the number, intensity and sophistication of attempted attacks and intrusions from around the world have increased. Such risks come from a variety of evolving threats, including but not limited to, social-engineering attacks (including through deep fakes, which may be increasingly more difficult to identify as fake, and phishing attacks), malicious code (such as viruses and worms), malware (including as a result of advanced persistent threat intrusions), denial-of-service attacks, credential stuffing, credential harvesting, personnel misconduct or error, ransomware attacks, supply-chain attacks, software bugs, server malfunctions, software or hardware failures, loss of data or other information technology assets, adware, attacks enhanced or facilitated by AI, telecommunications failures, earthquakes, fires, floods, and other similar threats.

Current wording

The risk of a cyber-attack, cybersecurity incident, breach, compromise, or other interruption has generally increased as the number, intensity and sophistication of attempted attacks and intrusions from around the world have increased. Such risks come from a variety of evolving threats, including but not limited to, social-engineering attacks (including through deep fakes, which may be increasingly more difficult to identify as fake, and phishing attacks), malicious code (such as viruses and worms), malware (including as a result of advanced persistent threat intrusions), denial-of-service attacks, credential stuffing, credential harvesting, personnel misconduct or error, ransomware attacks, supply-chain attacks, software bugs, server malfunctions, software or hardware failures, loss of data or other information technology assets, adware, attacks enhanced or facilitated by artificial intelligence (“AI”), telecommunications failures, earthquakes, fires, floods, and other similar threats.

Previous wording

We also face increased risks of a cyber-attack, security breach, compromise, or other incident due to our reliance on internet technology and the number of our employees who work on a hybrid basis at home, in the office, or other public spaces. This may create additional opportunities for cyber criminals to exploit vulnerabilities. Additionally, business transactions (such as acquisitions or integrations) could expose us to additional cybersecurity risks and vulnerabilities, as our systems could be negatively affected by vulnerabilities present in acquired or integrated entities’ systems and technologies that were not found during due diligence of such acquired or integrated entities.

Current wording

We also face increased risks of a cyber-attack, cybersecurity incident, breach, compromise, or other interruption due to our reliance on internet technology and the number of our employees who work on a hybrid basis at home, in the office, or other public spaces. This may create additional opportunities for cyber criminals to exploit vulnerabilities. Additionally, business transactions (such as acquisitions or integrations) could expose us to additional cybersecurity risks and vulnerabilities, as our systems could be negatively affected by vulnerabilities present in acquired or integrated entities’ systems and technologies that were not found during due diligence of such acquired or integrated entities.

Previous wording

In addition, our reliance on third-party service providers could introduce new cybersecurity risks and vulnerabilities, including supply-chain attacks. We rely on third-party service providers and technologies to operate critical business systems to process sensitive data in a variety of contexts and our ability to monitor these third parties’ information security practices is limited. These third parties may not have adequate information security measures in place and if our third-party service providers experience a cyber-attack, security breach, compromise or incident, or other interruption, we could experience adverse consequences. While we may be entitled to damages if our third-party service providers fail to satisfy their privacy or security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such award.

Current wording

In addition, our reliance on third-party service providers could introduce new cybersecurity risks and vulnerabilities, including supply-chain attacks. We rely on third-party service providers and technologies to operate critical business systems to process sensitive data in a variety of contexts and our ability to monitor these third parties’ information security practices is limited. These third parties may not have adequate information security measures in place and if our third-party service providers experience a cyber-attack, cybersecurity incident, breach, compromise, or other interruption, we could experience adverse consequences. While we may be entitled to damages if our third-party service providers fail to satisfy their privacy or security-related obligations to us, any award may be insufficient to cover our damages, or we may be unable to recover such award.

Previous wording

We may be unable to detect vulnerabilities in our information technology systems and infrastructure on a timely basis or until after a cyber-attack, security breach, compromise, or other incident has occurred. Further, we may experience delays in developing and deploying remedial measures designed to adequately address any such identified vulnerabilities.

Current wording

We may be unable to detect vulnerabilities in our information technology systems and infrastructure on a timely basis or until after a cyber-attack, cybersecurity incident, breach, compromise, or other interruption has occurred. Further, we may experience delays in developing and deploying remedial measures designed to adequately address any such identified vulnerabilities.

Previous wording

We have in the past experienced threats and security incidents related to our data and systems, and we may in the future experience additional threats, compromises, breaches or incidents. If we, or a third party upon whom we rely, experience a cyber-attack, security breach, compromise, or other incident, or are perceived to have experienced a cyber-attack, security breach, compromise, or other incident, we may experience adverse consequences, such as government enforcement actions (for example, investigations, fines, penalties, audits, and inspections); additional reporting requirements and/or oversight; restrictions on processing sensitive information (including personal data); litigation (including individual and group claims); indemnification obligations; negative publicity; reputational harm; monetary fund diversions; interruptions in our operations (including availability of data); financial loss; and other potentially significant harms. Our contracts may not contain limitations of liability, and even where they do, there can be no assurance that limitations of liability in our contracts are sufficient to protect us from liabilities, damages, or claims related to our privacy and data security obligations.

Current wording

We have in the past experienced threats and security incidents related to our data and systems, and we may in the future experience additional threats, compromises, breaches or incidents. If we, or a third party upon whom we rely, experience a cyber-attack, cybersecurity incident, breach, compromise, or other interruption, or are perceived to have experienced a cyber-attack, cybersecurity incident, breach, compromise, or other interruption, we may experience adverse consequences, such as government enforcement actions (for example, investigations, fines, penalties, audits, and inspections); additional reporting requirements and/or oversight; restrictions on processing sensitive information (including personal data); litigation (including individual and group claims); indemnification obligations; negative publicity; reputational harm; monetary fund diversions; interruptions in our operations (including availability of data); financial loss; and other potentially significant harms. Our contracts may not contain limitations of liability, and even where they do, there can be no assurance that limitations of liability in our contracts are sufficient to protect us from liabilities, damages, or claims related to our privacy and data security obligations.

Previous wording

Further, applicable privacy and data security obligations may require us to notify relevant stakeholders of a cyber-attack, security breach, compromise, or other incident. Such disclosures are costly, and the disclosure or the failure to comply with such requirements could lead to adverse consequences. In addition, cyber-attacks, security breaches, compromises, or other incidents may cause stakeholders (including investors and potential customers) to stop supporting our business, deter new customers from using our products, and negatively impact our ability to grow and operate our business.

Current wording

Further, applicable privacy and data security obligations may require us to notify relevant stakeholders of a cyber-attack, cybersecurity incident, breach, compromise, or other interruption. Such disclosures are costly, and the disclosure or the failure to comply with such requirements could lead to adverse consequences. In addition, cyber-attacks, cybersecurity incidents, breaches, compromises, or other interruptions may cause stakeholders (including investors and potential customers) to stop supporting our business, deter new customers from using our products, and negatively impact our ability to grow and operate our business.

Previous wording

If we were to experience a cyber-attack, security breach, compromise, or other incident that causes interruptions in our operations, it could result in a material disruption of our product development programs.

Current wording

If we were to experience a material cyber-attack, cybersecurity incident, breach, compromise, or other interruption that causes interruptions in our operations, it could result in a material disruption of our product development programs.

Previous wording

The use of new and evolving technologies, such as artificial intelligence (“AI”) and machine learning (“ML”), in our operations, and the operations of third parties upon which we rely, may result in spending additional resources and present new risks and challenges that can impact our business including by posing security and other risks to our sensitive data, and as a result we may be exposed to reputational harm, other adverse consequences, and liability.

Current wording

The use of new and evolving technologies, such as AI and machine learning (“ML”), in our operations, and the operations of third parties upon which we rely, may result in spending additional resources and present new risks and challenges that can impact our business including by posing security and other risks to our sensitive data, and as a result we may be exposed to reputational harm, other adverse consequences, and liability.

Previous wording

The use of new and evolving technologies, such as AI/ML, in our operations, and the operations of third parties upon which we rely presents new risks and challenges that could negatively impact our business. The use of certain AI/ML technologies can give rise to intellectual property risks, including compromises to proprietary intellectual property and intellectual property infringement. Additionally, several jurisdictions around the globe, including Europe and certain U.S. states, have proposed, enacted, or are considering, laws governing the development and use of AI/ML, such as the European Union’s AI Act. We expect other jurisdictions will adopt similar laws. Additionally, certain privacy laws extend rights to consumers (such as the right to delete certain personal data) and regulate automated decision making, which may be incompatible with our use of AI/ML. These obligations may make it harder for us to conduct our business using AI/ML, lead to regulatory fines or penalties, require us to change our business practices, retrain our AI/ML, or prevent or limit our use of AI/ML. For example, the Federal Trade Commission has required other companies to turn over (or disgorge) valuable insights or trainings generated through the use of AI/ML where they allege the company has violated privacy and consumer protection laws. If we cannot use AI/ML or that use is restricted, our business may be less efficient, or we may be at a competitive disadvantage.

Current wording

Likewise, in the U.S., several states, including Colorado and California, passed laws that will take effect in 2026, to regulate various uses of artificial intelligence, including to make consequential decisions. In addition, various federal regulators have issued guidance and focused enforcement efforts on the use of AI in regulated sectors. The U.S. Food and Drug Administration, for example, issued guidance on the use of artificial intelligence in medical devices, requiring detailed risk management and review processes to obtain approvals. If we develop or use AI systems governed by these laws or regulations, we will need to meet higher standards of data quality, transparency, monitoring and human oversight, and we would need to adhere to specific and potentially burdensome and costly ethical, accountability, and administrative requirements, with the potential for significant enforcement or litigation in the event of any perceived non-compliance. Additionally, certain privacy laws extend rights to consumers (such as the right to delete certain personal data) and regulate automated decision making, which may be incompatible with our use of AI/ML. These obligations may make it harder for us to conduct our business using AI/ML, lead to regulatory fines or penalties, require us to change our business practices, retrain our AI/ML, or prevent or limit our use of AI/ML. For example, the Federal Trade Commission has required other companies to turn over (or disgorge) valuable insights or trainings generated through the use of AI/ML where they allege the company has violated privacy and consumer protection laws. If we cannot use AI/ML or that use is restricted, our business may be less efficient, or we may be at a competitive disadvantage.

Previous wording

The regulatory approval processes of the FDA, EMA, and other comparable regulatory authorities are lengthy, time-consuming and inherently unpredictable, and if we are ultimately unable to obtain regulatory approval for our product candidates, our business will be substantially harmed.

Current wording

The regulatory approval processes of the FDA, EMA, MHRA and other comparable regulatory authorities are lengthy, time-consuming and inherently unpredictable, and if we are ultimately unable to obtain regulatory approval for our product candidates, our business will be substantially harmed.

Previous wording

We are not permitted to commercialize, market, promote or sell any product candidate in the United States without obtaining regulatory approval from the FDA. Foreign regulatory authorities, such as the EMA, impose similar requirements. The time required to obtain approval by the FDA, EMA, or other comparable regulatory authorities is inherently unpredictable, but typically takes many years following the commencement of clinical trials and depends upon numerous factors, including substantial discretion of the regulatory authorities. In addition, approval policies, regulations, or the type and amount of clinical data necessary to gain approval may change during the course of a product candidate’s clinical development and may vary among jurisdictions. For instance, jurisdictions outside of the United States, such as the European Union or Japan, may have different requirements for regulatory approval, which may require us to conduct additional clinical, nonclinical or chemistry, manufacturing and control studies. Moreover, the U.S. Supreme Court’s July 2024 decision to overturn prior established case law giving deference to regulatory agencies’ interpretations of ambiguous statutory language has introduced uncertainty regarding the extent to which FDA’s regulations, policies, and decisions may become subject to increasing legal challenges, delays, and/or changes. To date, we have not submitted an NDA to the FDA or similar drug approval submissions to comparable foreign regulatory authorities for any product candidate. We must complete additional preclinical studies and clinical trials to demonstrate the safety and efficacy of our product candidates in humans before we will be able to obtain these approvals.

Current wording

We are not permitted to commercialize, market, promote or sell any product candidate in the United States without obtaining regulatory approval from the FDA. Foreign regulatory authorities, such as the EMA and MHRA, impose similar requirements. The time required to obtain approval by the FDA, EMA, MHRA or other comparable regulatory authorities is inherently unpredictable, but typically takes many years following the commencement of clinical trials and depends upon numerous factors, including substantial discretion of the regulatory authorities. In addition, approval policies, regulations, or the type and amount of clinical data necessary to gain approval may change during the course of a product candidate’s clinical development and may vary among jurisdictions. For instance, jurisdictions outside of the United States, such as the European Union or Japan, may have different requirements for regulatory approval, which may require us to conduct additional clinical, nonclinical or chemistry, manufacturing and control studies. Moreover, the U.S. Supreme Court’s July 2024 decision to overturn prior established case law giving deference to regulatory agencies’ interpretations of ambiguous statutory language has introduced uncertainty regarding the extent to which FDA’s regulations, policies, and decisions may become subject to increasing legal challenges, delays, and/or changes. To date, we have not submitted an NDA to the FDA or similar drug approval submissions to comparable foreign regulatory authorities for any product candidate. We must complete additional preclinical studies and clinical trials to demonstrate the safety and efficacy of our product candidates in humans before we will be able to obtain these approvals.

Previous wording

Clinical testing is expensive, difficult to design and implement, can take many years to complete and is inherently uncertain as to outcome. We cannot guarantee that any clinical trials will be conducted as planned or completed on schedule, if at all. The clinical development of our initial and potential additional product candidates is susceptible to the risk of failure inherent at any stage of development, including failure to demonstrate efficacy in a clinical trial or across a broad population of patients, the occurrence of AEs that are severe or medically or commercially unacceptable, failure to comply with protocols or applicable regulatory requirements and determination by the FDA, EMA, or other comparable regulatory authorities that a product candidate may not continue development or is not approvable. It is possible that even if any of our product candidates have a beneficial effect, that effect will not be detected during clinical evaluation as a result of one or more of a variety of factors, including the size, duration, design, measurements, conduct or analysis of our clinical trials. Conversely, as a result of the same factors, our clinical trials may indicate an apparent positive effect of such product candidate that is greater than the actual positive effect, if any. Similarly, in our clinical trials we may fail to detect toxicity of, or intolerability caused by, such product candidate, or mistakenly believe that our product candidates are toxic or not well tolerated when that is not in fact the case. Serious AEs or other AEs, as well as tolerability issues, could hinder or prevent market acceptance of the product candidate at issue.

Current wording

Clinical testing is expensive, difficult to design and implement, can take many years to complete and is inherently uncertain as to outcome. We cannot guarantee that any clinical trials will be conducted as planned or completed on schedule, if at all. The clinical development of our initial and potential additional product candidates is susceptible to the risk of failure inherent at any stage of development, including failure to demonstrate efficacy in a clinical trial or across a broad population of patients, the occurrence of AEs that are severe or medically or commercially unacceptable, failure to comply with protocols or applicable regulatory requirements and determination by the FDA, EMA, MHRA or other comparable regulatory authorities that a product candidate may not continue development or is not approvable. It is possible that even if any of our product candidates have a beneficial effect, that effect will not be detected during clinical evaluation as a result of one or more of a variety of factors, including the size, duration, design, measurements, conduct or analysis of our clinical trials. Conversely, as a result of the same factors, our clinical trials may indicate an apparent positive effect of such product candidate that is greater than the actual positive effect, if any. Similarly, in our clinical trials we may fail to detect toxicity of, or intolerability caused by, such product candidate, or mistakenly believe that our product candidates are toxic or not well tolerated when that is not in fact the case. Serious AEs or other AEs, as well as tolerability issues, could hinder or prevent market acceptance of the product candidate at issue.

Previous wording

the FDA, EMA, or other comparable regulatory authorities may disagree as to the design or implementation of our clinical trials;

Current wording

the FDA, EMA, MHRA or other comparable regulatory authorities may disagree as to the design or implementation of our clinical trials;

Previous wording

we may be unable to demonstrate to the satisfaction of the FDA, EMA, or other comparable regulatory authorities that a product candidate is safe and effective for its proposed indication;

Current wording

we may be unable to demonstrate to the satisfaction of the FDA, EMA, MHRA or other comparable regulatory authorities that a product candidate is safe and effective for its proposed indication;