ILLUMINA INC

We recognize the importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. Our cybersecurity risk management strategy is integrated into our established enterprise risk management program, which includes defined risk, assessment, mitigation, and reporting processes. Our information security team has deployed multiple technical and operational processes to aid in our ability to continuously identify and respond to cybersecurity threats and incidents. Our cybersecurity incident management process includes impact assessment, containment, mitigation and recovery strategies.

In addition to our continuous monitoring of our information systems, we utilize third parties to provide external threat intelligence and evaluation of incident notifications in order to identify potential threats or incidents that could impact us. We also evaluate our cybersecurity program against the National Institute of Standards and Technology’s Cybersecurity Framework. For all suspected cybersecurity incidents, the information security team conducts a preliminary assessment to determine the severity and impact extent of the incident and, once appropriate, a materiality assessment is made. Upon a confirmed cybersecurity incident, the information security team initiates an incident response process with goals to contain, respond, recover, protect and minimize any impacts caused by the incident. The response process includes deployment of short term and long-term technical and procedural actions as appropriate. Further, we have established a third party risk management program to monitor suppliers who have access to our information.

Our Audit Committee, a committee of our Board of Directors, is responsible for governing management’s review and assessment of our cybersecurity and other information technology risks, controls, and procedures, including management’s incident resolution process and any specific cybersecurity issues that could affect the adequacy of our internal controls. Our Chief Information Officer provides regular updates to the Audit Committee and to the Board of Directors. The information provided includes a review of any security risk events and improvements in our security controls.

Our information security team, under the Chief Information Officer, is led by our Chief Information Security Officer (CISO) and is responsible for assessing and managing risks from cybersecurity threats. Our CISO has over 20 years of information security experience, including as a leader of information security programs at other large enterprises, and is supported by a team of professionals focused on information security. Our information security team regularly meets to review our cybersecurity posture, the broader cybersecurity landscape and any identified cybersecurity incidents. Our information security team has procedures in place for reviewing suspected cybersecurity incidents, as well as monitoring cybersecurity risks and ongoing mitigation strategies, the status of prevention, detection, and mitigation controls and any planned future control enhancements.

We believe that risks from prior cybersecurity threats to information systems owned and used by us, including as a result of any previous cybersecurity incidents, have not materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations, or financial condition. We maintain a cybersecurity insurance policy which may mitigate certain financial impacts of a cybersecurity incident. Please refer to“Risks Relating to Information Technology Security and Continuity” within the “Risk Factors” within the Business & Market Information Section of this report.

Environmental Matters

As a global corporate citizen, we recognize the importance of the environment to a healthy, sustainable future for our business, our patients, and communities. We are committed to the protection of our employees and the environment with an approach to continuously strengthen our environmental stewardship. We believe that we are in material compliance with current applicable laws and regulations. However, we could be held liable for damages and fines should contamination of the environment or individual exposures to hazardous substances occur. In addition, we cannot predict how changes in these laws and regulations, or the development of new laws and regulations, will affect our business operations or the cost of compliance. Further, regulators are considering, and in some cases have implemented, new environmental disclosure rules. For example, the SEC and other regulators have proposed amendments to its disclosure rules regarding climate-related disclosure requirements, and California has recently enacted new disclosure rules. The cost of complying with any new disclosure regimes is uncertain. In addition, climate change may impact our business by increasing operating costs due to additional regulatory requirements, physical risks to our facilities, energy limitations, and disruptions to our supply chain. These potential risks are accounted for in our business planning, including investment in renewable energy, reducing energy and water consumption, greenhouse gas emissions, and waste production. As part of our climate action plan, we established emission reduction targets in line with a 1.5 degree pathway, established Net Zero emission commitments by 2050, and had those targets verified by the Sciences Based Target Initiative. Additional information is included in our annual ESG Report located on our website at www.Illumina.com/csr.

Government Regulation

As we expand product lines to address the diagnosis of disease, regulation by governmental authorities in the United States and other countries will become an increasingly significant factor in development, testing, production, and marketing. Products that we develop in the molecular diagnostic markets, depending on their intended use, may be regulated as medical devices or in vitro diagnostic products (IVDs) by the FDA and comparable agencies in other countries. In the United States, certain of our products may require FDA clearance following a pre-market notification process, also known as a 510(k) clearance, or premarket approval (PMA) from the FDA. The usually shorter 510(k) clearance process, which we used for the FDA-cleared assays that are run on our FDA-regulated MiSeqDx instrument, generally takes from three to six months after submission, but it can take significantly longer. The longer PMA process, which we used for our FDA-cleared RAS panel that is also run on our MiSeqDx instrument, is typically much more costly and uncertain. It can take from 9 to 18 months after a complete filing, but it can take significantly longer and requires conducting clinical studies that are generally more extensive than those required for 510(k) clearance. All of the products that are currently regulated by the FDA as medical devices and IVDs are also subject to the FDA Quality System Regulation (QSR). Obtaining the requisite regulatory approvals, including the FDA quality system inspections that are required for PMA approval, can be expensive and may involve considerable delay.

In the U.S., the products we develop for oncology and non-invasive prenatal testing will be regulated by the PMA process. We cannot be certain which of our other planned molecular diagnostic products will be subject to the shorter 510(k) clearance process, or which of these will need to go through the PMA process.

The regulatory approval process for such products may be significantly delayed, may be significantly more expensive than anticipated, and may conclude without such products being approved by the FDA. Without timely regulatory approval, we will not be able to launch or successfully commercialize such products, which would adversely affect our earnings and competitive position. Many of the products that we are developing are the first of their kind, such as the Galleri test that has been developed by GRAIL. The regulatory approval pathways for such products, like the Galleri test, do not currently exist and therefore have a high degree of uncertainty. Core Illumina and GRAIL are separately collaborating with regulatory bodies to navigate this regulatory landscape.

Changes to the current regulatory framework, including the imposition of additional or new regulations, could arise at any time during the development or marketing of our products. This may negatively affect our ability to obtain or maintain FDA or comparable regulatory clearance or approval of our products. In addition, regulatory agencies may introduce new requirements that may change the regulatory requirements for us or our customers, or both. For example, the proposed rule published by the FDA in 2023 would allow the FDA to regulate laboratory developed tests (LDTs). Under the proposed rule, our customers would be required to either submit their current test for FDA approval or find an IVD manufacturer to supply them with IVDs.

If our products labeled as “For Research Use Only,” or RUO, are used, or could be used, for the diagnosis of disease, the regulatory requirements related to marketing, selling, and supporting such products could be uncertain. This is true even if such use by our customers occurs without our consent. If the FDA or other regulatory authorities assert that any of our RUO products are subject to regulatory clearance or approval, our business, financial condition, or results of operations could be adversely affected.

Our products sold as medical devices or IVDs in Europe are now regulated under the In Vitro Diagnostics Regulation (EU) 2017/746, the IVDR, that went into full enforcement in May 2022. These regulations include requirements for both presentation and review of performance data and quality-system requirements.

Certain of our products are currently available through laboratories that are certified under the Clinical Laboratory Improvements Amendments (CLIA) of 1988. These products are commonly called “laboratory developed tests,” or LDTs. For a number of years, the FDA has exercised its regulatory enforcement discretion not to regulate LDTs as medical devices if created and used within a single laboratory. However, the FDA is continually reexamining this regulatory approach and changes to the agency’s handling of LDTs could impact our business in ways that cannot be predicted at this time. We cannot predict the nature or extent of the FDA's final guidance or regulation of LDTs, in general, or with respect to our or our customers’ LDTs, in particular. However, recent activity by the FDA indicates an increased intention to regulate LDTs in the near future.

Certification of CLIA laboratories includes standards in the areas of personnel qualifications, administration, and participation in proficiency testing, patient test management, and quality control procedures. CLIA also mandates that, for high complexity labs such as ours, to operate as a lab, we must have an accreditation by an organization recognized by CLIA such as the College of Pathologists (CAP), which we have obtained and must maintain. If we were to lose our CLIA certification or CAP accreditation, our business, financial condition, or results of operations could be adversely affected. In addition, state laboratory licensing and inspection requirements may also apply to our products, which, in some cases, are more stringent than CLIA requirements.