ASSEMBLY BIOSCIENCES, INC.

Previous wording

In October 2023, we entered into the Gilead Collaboration Agreement with Gilead, whereby Gilead exclusively licensed to us its HPI program and NNPI program, while retaining opt-in rights to these programs, and has an option to take an exclusive license, on a program-by-program basis, to all of our other current and future pipeline programs during the collaboration term. In connection with the entry into the Gilead Collaboration Agreement, we and Gilead also entered into a common stock purchase agreement and an investor rights agreement, which were both amended in June 2024. Also in June 2024, we and Gilead subsequently entered into a securities purchase agreement and warrant agreement. In December 2024, Gilead purchased additional shares of our common stock at a premium pursuant to the terms of the common stock purchase agreement, and we amended the Gilead Collaboration Agreement in connection with an updated development plan for 6250. Our agreements and relationship with Gilead pose a number of risks, including, but not limited to, the following:

Current wording

In October 2023, we entered into the Gilead Collaboration Agreement with Gilead, whereby Gilead exclusively licensed to us its HPI program and NNPI program, while retaining opt-in rights to these programs, and has an option to take an exclusive license, on a program-by-program basis, to all of our other current and future pipeline programs during the collaboration term. In connection with the entry into the Gilead Collaboration Agreement, we and Gilead also entered into a common stock purchase agreement and an investor rights agreement, which were both amended in June 2024. Also in June 2024, we and Gilead subsequently entered into a securities purchase agreement and warrant agreement. In December 2024, Gilead purchased additional shares of our common stock at a premium pursuant to the terms of the common stock purchase agreement, and we amended the Gilead Collaboration Agreement in connection with an updated development plan for 6250. In August 2025, Gilead purchased additional shares of our common stock and warrants to purchase additional shares of our common stock. Our agreements and relationship with Gilead pose a number of risks, including, but not limited to, the following:

Previous wording

We will be heavily dependent on Gilead for further development and commercialization of the investigational products from the programs that it opts into.

Current wording

We will be heavily dependent on Gilead for further development and commercialization of the investigational products from the programs that it opts into, and transition of these programs to Gilead, if Gilead opts in, could delay these programs' clinical and approval timelines.

Previous wording

Gilead has the right to designate (and has designated) two directors for appointment to our board of directors pursuant to the terms of the investor rights agreement and owns approximately 29.9% of our outstanding common stock. Gilead also has the right to acquire additional shares in the open market, up to an amount resulting in Gilead owning a total of 35% of our outstanding common stock. As a result, Gilead may be able to exert significant influence over us.

Current wording

Gilead has the right to designate (and has designated) two directors for appointment to our board of directors pursuant to the terms of the investor rights agreement and owns approximately 29% of our outstanding common stock. Gilead also has the right to acquire additional shares in the open market, up to an amount resulting in Gilead owning a total of 35% of our outstanding common stock. As a result, Gilead may be able to exert significant influence over us.

Previous wording

different regulatory requirements for drug approvals or increased scrutiny on CROs located in foreign countries, including China;

Current wording

increased scrutiny or prohibitions on CROs located in foreign countries, including China;

Previous wording

We collect and maintain information in digital form and are increasingly dependent on information technology systems and infrastructure to operate our business. In the ordinary course of our business, we collect, store and transmit large amounts of confidential information, including intellectual property, proprietary business information and personal information. It is critical that we do so in a secure manner to maintain the confidentiality and integrity of such confidential information. We have outsourced elements of our information technology infrastructure and, as a result, a number of third-party vendors may or could have access to our confidential information. Our internal information technology systems and infrastructure, and those of our current and any future collaborators, contractors and consultants and other third parties on which we rely, are vulnerable to damage from computer viruses, malware, natural disasters, system outages, terrorism, war, telecommunication and electrical failures, cyberattacks, cybersecurity incidents or cyber intrusions over the Internet, attachments to emails, persons inside our organization, or persons with access to systems inside our organization.

Current wording

We collect and maintain information in digital form and are increasingly dependent on information technology systems and infrastructure to operate our business. In the ordinary course of our business, we collect, store and transmit large amounts of confidential information, including intellectual property, proprietary business information and personal data. It is critical that we do so in a secure manner to maintain the confidentiality and integrity of such confidential information. We have outsourced elements of our information technology infrastructure and, as a result, a number of third-party vendors may or could have access to our confidential information. Our internal information technology systems and infrastructure, and those of our current and any future collaborators, contractors and consultants and other third parties on which we rely, are vulnerable to damage from computer viruses, malware, natural disasters, system outages, terrorism, war, telecommunication and electrical failures, cyberattacks, cybersecurity incidents or cyber intrusions over the Internet, attachments to emails, persons inside our organization, or persons with access to systems inside our organization.

Previous wording

Under Sections 382 and 383 of the Internal Revenue Code of 1986, as amended (the Code), a corporation that undergoes an “ownership change” (generally defined as a greater than 50% change (by value) in its equity ownership over a three-year period) is subject to annual limitations on its ability to use its pre-change net operating loss carryforwards and other pre-change tax attributes (such as research tax credits) to offset its post-change income or taxes. We have experienced ownership changes in the past, and future equity issuances may result in additional ownership change. Accordingly, some of our net operating losses or credits could expire unutilized, and our ability to utilize our net operating losses or credits to offset U.S. federal taxable income could be limited, which would result in increased future tax liability to us. We may also be subject to similar limitations at the state level.

Current wording

Under Sections 382 and 383 of the Internal Revenue Code of 1986, as amended (the Code), a corporation that undergoes an “ownership change” (generally defined as a greater than 50% change (by value) in its equity ownership over a three-year period) is subject to annual limitations on its ability to use its pre-change net operating loss carryforwards and other pre-change tax attributes (such as research tax credits) to offset its post-change income or taxes. We have experienced ownership changes in the past, most recently in August 2025, and future equity issuances may result in additional ownership change. Accordingly, some of our net operating losses or credits could expire unutilized, and our ability to utilize our net operating losses or credits to offset U.S. federal taxable income could be limited, which would result in increased future tax liability to us. We may also be subject to similar limitations at the state level.

Previous wording

We and our collaborators may be subject, directly or indirectly, to applicable U.S. federal and state anti-kickback, false claims laws, physician payment transparency laws, fraud and abuse laws or similar healthcare and security laws and regulations, and health information privacy and security laws, which could expose us or them to criminal sanctions, civil penalties, exclusion or suspension from federal and state healthcare programs, contractual damages, reputational harm and diminished profits and future earnings.

Current wording

We and our collaborators may be subject, directly or indirectly, to applicable U.S. federal and state anti-kickback, false claims laws, physician payment transparency laws, other fraud and abuse laws or similar healthcare and security laws and regulations, and health information privacy and security laws, which could expose us or them to criminal sanctions, civil penalties, exclusion or suspension from federal and state healthcare programs, contractual damages, reputational harm and diminished profits and future earnings.

Previous wording

Healthcare providers, physicians and others play a primary role in the recommendation and prescription of any products for which we obtain regulatory approval. If we obtain FDA approval for any of our drug candidates and begin commercializing those drugs in the United States, our operations may be subject to various federal and state fraud and abuse laws, including the federal Anti-Kickback Statute, the federal False Claims Act, and physician payment sunshine laws and regulations. Additionally, we are subject to state and non-U.S. equivalents of each of the healthcare laws described above, among others, some of which may be broader in scope and may apply regardless of the payor. These laws may impact, among other things, our proposed sales, marketing and education programs. In addition, we may be subject to patient privacy regulation by both the federal government and the states and foreign jurisdictions in which we conduct our business. If we fail to comply with any applicable federal, state or foreign legal requirement, we could be subject to penalties.

Current wording

Healthcare providers, physicians and others play a primary role in the recommendation and prescription of any products for which we obtain regulatory approval. If we obtain FDA approval for any of our drug candidates and begin commercializing those drugs in the United States, our operations may be subject to various federal and state fraud and abuse laws, including the federal Anti-Kickback Statute, the federal False Claims Act, and physician payment sunshine laws and regulations. Additionally, we are subject to state and non-U.S. equivalents of each of the healthcare laws described above, among others, some of which may be broader in scope and may apply regardless of the payor. These laws may impact, among other things, our proposed sales, marketing and education programs. For example, there are federal and state healthcare laws and regulations that govern prescription drug marketing practices, including off-label promotion, and increased scrutiny of direct-to-consumer advertisements. In addition, we may be subject to patient privacy regulation by both the federal government and the states and foreign jurisdictions in which we conduct our business. If we fail to comply with any applicable federal, state or foreign legal requirement, we could be subject to penalties.

Previous wording

Regulators globally are imposing greater monetary fines for privacy violations. The EU GDPR applies to any company established in the EU as well as to those outside the EU if they collect and use personal data in connection with the offering of goods or services to individuals in the EU or the monitoring of their behavior. The EU GDPR enhances data protection obligations for processors and controllers of personal data, including, for example, expanded disclosures about how personal information is to be used, limitations on retention of information, mandatory data breach notification requirements and onerous new obligations on services providers. Noncompliance with the EU GDPR may result in monetary penalties of up to €20 million or 4% of worldwide revenue, whichever is higher. The EU GDPR may increase our responsibility and liability in relation to personal data that we process and we may be required to put in place additional mechanisms to ensure compliance with the EU GDPR, including as implemented by individual countries. Compliance with the EU GDPR and other changes in laws or regulations associated with the enhanced protection of certain types of personal data, such as healthcare data or other sensitive information, could greatly increase our cost of developing our products or even prevent us from offering certain products in jurisdictions that we may operate in.

Current wording

Regulators globally are imposing greater monetary fines for privacy violations. Privacy laws such as the EU GDPR and UK General Data Protection Regulation (UK GDPR) impose strict obligations on lawful processing, transparency and cross-border transfers of personal data (i.e., information which identifies an individual or from which an individual is identifiable). The EU GDPR applies to any company established in the EU as well as to those outside the EU if they process personal data in connection with the offering of goods or services to EU residents or the monitoring of their behavior within the EU, wherever such processing occurs. The EU GDPR includes operational requirements for companies that receive or process personal data of EU residents. The EU GDPR enhances data protection obligations for processors and controllers of personal data, including, for example, expanded disclosures about how personal data is to be used, limitations on retention of information, mandatory data breach notification requirements and notable obligations on services providers. Noncompliance with the EU GDPR may result in monetary penalties of up to €20 million or 4% of worldwide revenue, whichever is higher. The EU GDPR may increase our responsibility and liability in relation to personal data that we process and we may be required to implement additional mechanisms to ensure compliance with the EU GDPR, including as implemented by individual countries. In addition to the foregoing, a breach of the EU GDPR could result in regulatory investigations, reputational damage, fines and sanctions, orders to cease or change the processing of our data, enforcement notices, or assessment notices (for a compulsory audit). We may also face civil claims including representative actions and other class action type litigation (where individuals have suffered harm), potentially amounting to significant compensation or damages liabilities, as well as associated costs, diversion of internal resources, and reputational harm as the EU GDPR confers a private right of action on data subjects and consumer associations to lodge complaints with supervisory authorities, seek judicial remedies, and obtain compensation for damages resulting from violations.

Previous wording

The California Consumer Privacy Act (CCPA) also created new individual privacy rights for California consumers (as defined in the law) and places increased privacy and security obligations on entities handling personal data of consumers or households. The CCPA requires covered companies to provide certain disclosures to consumers about its data collection, use and sharing practices, and to provide affected California residents with ways to opt-out of certain sales or transfers of personal information. While there is currently an exception for protected health information that is subject to HIPAA and clinical study regulations, as currently written, the CCPA may impact our business activities. The uncertainty surrounding the implementation of the CCPA exemplifies the vulnerability of our business to the evolving regulatory environment related to personal data and protected health information.

Current wording

Many U.S. states have also enacted comprehensive privacy laws that impose certain obligations on covered businesses, including providing specific disclosures in privacy notices and affording residents of a given state certain rights concerning their personal data. Such rights may include the right to access, correct or delete certain personal data, and opt-out of certain data processing activities, such as targeted advertising, profiling and automated decision-making. The exercise of these rights may or may not impact our business and our ability to provide our products and services. Certain states impose stricter requirements for processing certain personal data, including sensitive personal data, for example by requiring that data privacy impact assessments be conducted prior to processing such data. These state laws also allow statutory fines for noncompliance. For example, the California Consumer Privacy Act (CCPA) places increased privacy and security obligations on entities handling personal data of consumers or households, employees and business representatives. The CCPA requires covered businesses to provide certain disclosures to consumers about their data collection, use and sharing practices, and to provide affected California residents with ways to opt-out of certain sales or transfers of personal data. The CCPA provides for fines of up to $7,988 per intentional violation and potentially allows private litigants affected by certain types of data breaches to recover significant statutory damages. While there is currently an exception for protected health information that is subject to HIPAA and clinical study regulations, as currently written, the CCPA may impact our business activities. The uncertainty surrounding the implementation of the CCPA exemplifies the vulnerability of our business to the evolving regulatory environment related to personal data and protected health information.

Previous wording

Our employees, independent contractors, consultants, collaborators and CROs may engage in misconduct or other improper activities, including noncompliance with regulatory standards and requirements, which could result in significant liability for us and harm our reputation.

Current wording

Our employees, independent contractors, consultants, collaborators and CROs may engage in misconduct or other improper activities, including noncompliance with regulatory standards and requirements for which we may be held responsible and which could result in significant liability for us and harm our reputation.