ILLUMINA INC

We recognize the importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. Our cybersecurity risk management strategy isintegrated into our established enterprise risk management program, which includes defined risk, assessment, mitigation, and reporting processes. Our information security team has deployed multiple technical and operational processes to aid in our ability to continuously identify and respond to cybersecurity threats and incidents. Our cybersecurity incident management process includes impact assessment, containment, mitigation and recovery strategies.

In addition to our continuous monitoring of our information systems, weutilize third parties to provide external threat intelligence and evaluation of incident notifications in order to identify potential threats or incidents that could impact us. We also evaluate our cybersecurity program against the National Institute of Standards and Technology’s Cybersecurity Framework. For all suspected cybersecurity incidents, the information security team conducts a preliminary assessment to determine the potential severity and impact extent of the incident and, where appropriate, a materiality assessment is made. Upon a confirmed cybersecurity incident, the information security team initiates an incident response process with goals to contain, respond, recover, protect and minimize any impacts caused by the incident. The response process includes deployment of a variety of short term and long-term technical and procedural actions as appropriate. Further, we have established a third party risk management program to monitor suppliers who have access to our information.

Our Audit Committee, a committee of our Board of Directors, is responsible for governing management’s review and assessment of our cybersecurity and other information technology risks, controls, and procedures, including management’s incident resolution process and any specific cybersecurity issues that could affect the adequacy of our internal controls. Our Chief Information Officer provides regular updates to the Audit Committee and to the Board of Directors, including a review of any security risk events and improvements in our security controls.

Our information security team, under the Chief Information Officer, is led by our Chief Information Security Officer (CISO) and is responsible for assessing and managing risks from cybersecurity threats. Our CISO has over 20 years of information security experience, including as a leader of information security programs at other large enterprises, and is supported by a team of professionals focused on information security. Our information security team regularly meets to review our cybersecurity posture, the broader cybersecurity landscape and any identified cybersecurity incidents. Our information security team has procedures in place for investigating suspected cybersecurity incidents, as well as monitoring cybersecurity risks and ongoing mitigation strategies, the status of prevention, detection, and mitigation controls and any planned future control enhancements.

We believe that risks from prior cybersecurity threats to information systems owned and used by us, including as a result of any previous cybersecurity incidents, have not materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations, or financial condition. We maintain a cybersecurity insurance policy which may mitigate certain financial impacts of a cybersecurity incident. Please refer to “Risks Relating to Information Technology Security and Continuity” within the Risk Factors within the Business & Market Information Section of this report.

Environmental Matters

As a global corporate citizen, we recognize the importance of the environment to a healthy, sustainable future for our business, our patients, and communities. We are committed to the protection of our employees and the environment with an approach to continuously strengthen our environmental stewardship. We believe that we are in material compliance with current applicable laws and regulations. However, we could be held liable for damages and fines should contamination of the environment or individual exposures to hazardous substances occur. In addition, we cannot predict how changes in these laws and regulations, or the development of new laws and regulations, will affect our business operations or the cost of compliance. Further, regulators are considering, and in some cases have implemented, new environmental disclosure rules. For example, California has recently enacted new climate-related disclosure rules and requirements. The cost of complying with any new disclosure regimes is uncertain. In addition, climate change may impact our business by increasing operating costs due to additional regulatory requirements, physical risks to our facilities, energy limitations, and disruptions to our supply chain. These potential risks are accounted for in our business planning, including investment in renewable energy, reducing energy and water consumption, greenhouse gas emissions, and waste production. As part of our climate action plan, we established emission reduction targets in line with a 1.5 degree pathway, established Net Zero emission commitments by 2050, and had those targets verified by the Sciences Based Target Initiative. Additional information is included in our annual CSR Report located on our website at www.Illumina.com/csr.

Government Regulation

As we expand product lines to address the diagnosis of disease, regulation by governmental authorities in the U.S. and other countries will become an increasingly significant factor in development, testing, production, and marketing activities. Products that we develop in the molecular diagnostic markets, depending on their intended use, may be regulated as medical devices or in vitro diagnostic products (IVDs) by the FDA and comparable agencies in other countries. In the U.S., certain of our products may require FDA clearance following a pre-market notification process, also known as a 510(k) clearance, or premarket approval (PMA) from the FDA. The usually shorter 510(k) clearance process, which we used for the FDA-cleared assays that are run on our FDA-regulated MiSeqDx instrument, generally takes from three to six months after submission, but it can take significantly longer. The longer PMA process, which we used for our FDA-approved TruSight Comprehensive Oncology panel that is run on our NextSeq550 Dx instrument, is typically much more costly and uncertain. It can take from 9 to 18 months after a complete filing, but it can take significantly longer and requires conducting clinical studies that are generally more extensive than those required for 510(k) clearance. All of the products that are currently regulated by the FDA as medical devices and IVDs are also subject to the FDA Quality System Regulation (QSR). Obtaining the requisite regulatory approvals, including the FDA quality system inspections that are required for PMA approval, can be expensive and may involve considerable delay. In the U.S., the products we develop for oncology and non-invasive prenatal testing will be regulated by the PMA process. We cannot be certain which of our other planned molecular diagnostic products will be subject to the shorter 510(k) clearance process, or which of these will need to go through the PMA process.

The regulatory approval process for such products may be significantly delayed, may be significantly more expensive than anticipated, and may conclude without such products being approved by the FDA. Without timely regulatory approval, we will not be able to launch or successfully commercialize such products, which would adversely affect our earnings and competitive position. Many of the products that we are developing are the first of their kind. The regulatory approval pathways for such products do not currently exist and therefore have a high degree of uncertainty.

Changes to the current regulatory framework, including the imposition of additional or new regulations, could arise at any time during the development or marketing of our products. This may negatively affect our ability to obtain or maintain FDA or comparable regulatory clearance or approval of our products. In addition, regulatory agencies may introduce new requirements that may change the regulatory requirements for us or our customers, or both. For example, the final rule published by the FDA in 2024 allows the FDA to regulate laboratory developed tests (LDTs). Under the final rule, our customers will be required to either submit their current test for FDA approval or find an IVD manufacturer to supply them with IVDs.

If our products labeled as “For Research Use Only,” or RUO, are used, or could be used, for the diagnosis of disease, the regulatory requirements related to marketing, selling, and supporting such products could be uncertain. This is true even if such use by our customers occurs without our consent. If the FDA or other regulatory authorities assert that any of our RUO products are subject to regulatory clearance or approval, our business, financial condition, or results of operations could be adversely affected.

Our products sold as medical devices or IVDs in Europe are now regulated under the In Vitro Diagnostics Regulation (EU) 2017/746, the IVDR, that went into full enforcement in May 2022. These regulations include requirements for both presentation and review of performance data and quality-system requirements.

Certain of our products are currently available through laboratories that are certified under the Clinical Laboratory Improvements Amendments (CLIA) of 1988. These products are commonly called “laboratory developed tests,” or LDTs. For a number of years, the FDA has exercised its regulatory enforcement discretion not to regulate LDTs as medical devices if created and used within a single laboratory. However, as mentioned above, the FDA published a final rule in 2024 that phases out the enforcement discretion over a 4 year time period. The final rule is effective as of the 2024 publication. While this rule is being challenged in the U.S. court system, if the final rule stands in its current form, laboratories will be required to submit LDTs for FDA approval and will be required to implement a fully compliant Quality Management System (QMS).

Certification of CLIA laboratories includes standards in the areas of personnel qualifications, administration, and participation in proficiency testing, patient test management, and quality control procedures. CLIA also mandates that, for high complexity labs such as ours, to operate as a lab, we must have an accreditation by an organization recognized by CLIA such as the College of Pathologists (CAP), which we have obtained and must maintain. If we were to lose our CLIA certification or CAP accreditation, our business, financial condition, or results of operations could be adversely affected. In addition, state laboratory licensing and inspection requirements may also apply to our products, which, in some cases, are more stringent than CLIA requirements.