Outset Medical, Inc.

You should carefully consider the risk factors discussed in Part I, “Item 1A. Risk Factors” in our 2024 Annual Report, as updated by the risk factors discussed in Part II, “Item 1A. Risk Factors” in our Quarterly Reports on Form 10-Q for the fiscal quarters ended March 31, 2025 (Q1 2025 Quarterly Report) and June 30, 2025 (Q2 2025 Quarterly Report), which could materially affect our business, financial position, or future results of operations. There have been no material changes to the risk factors described in our 2024 Annual Report, as updated by our Q1 2025 Quarterly Report and Q2 2025 Quarterly Report, except as set forth below. The risks described in our 2024 Annual Report and Q1 2025 Quarterly Report, as updated below, are not the only risks that we face. Additional risks and uncertainties not precisely known to us, or that we currently deem to be immaterial, may also arise and materially impact our business. If any of these risks occur, our business, results of operations and financial condition could be materially and adversely affected and the trading price of our common stock could decline.

With a significant portion of our manufacturing operations located outside of the United States, we may experience manufacturing disruptions, and be subject to additional risks associated with international manufacturing operations, including uncertain or changing regulatory and/or labor requirements.

We have insourced the production of Tablo consoles, and a majority of Tablo cartridges, at our manufacturing facility in Tijuana, Mexico which we operate in collaboration with our outsourced business administration service provider, TACNA. Under our arrangement with TACNA, we control the operations, engineering, quality and materials supply functions at the facility, while TACNA provides manufacturing space, the workforce, utilities, cross-border logistics, local permits and licenses. We are subject to a number of additional risks associated with operating our Mexico-based manufacturing facility, and many of these risks may heighten to the extent we continue to ramp our cartridge manufacturing capabilities and increase our dependence on our Mexico-based manufacturing operations. We may experience strikes, work stoppages, work slowdowns, high personnel turnover, grievances, complaints, claims of unfair labor practices, other collective bargaining disputes or other labor disputes at our new facility. Our manufacturing operations at the facility may also suffer disruptions from global or regional public health crises such as the COVID-19 pandemic, natural disasters, cyber security attacks, vandalism, terrorism or other political hostilities. Any such occurrences could negatively impact our ability to produce Tablo consoles and cartridges.

We are also subject to a variety of foreign laws and regulations, including trade and labor restrictions and laws relating to importation, exportation and taxation of goods, and U.S. laws and regulations relating to foreign operations, including anti-corruption, anti-bribery and anti-money laundering laws. For example, the new administration has advocated greater restrictions on trade generally and, in particular, tariff increases on certain goods imported into the United States, including from Mexico and China. In February 2025, the current administration issued executive orders imposing additional 25% tariffs on products imported from Mexico and additional 10% tariffs on products imported from China. While the tariffs on products from China went into effect in February 2025 (and increased from 10% to 20% in March 2025), the tariffs on products from Mexico were suspended for an additional month. These tariffs could potentially impact certain areas of our supply chain, including raw materials entering Mexico, raw materials entering the United States from China for use by our United States-based suppliers, and finished goods imported from Mexico into the United States. We currently do not believe we have exposure to these tariffs as Tablo, TabloCart and Tablo cartridge are covered under a special exemption. However, in September 2025, the U.S. Department of Commerce initiated an investigation under Section 232 of the Trade Expansion Act of 1962 to assess the national security implications of imports of personal protective equipment, medical consumables, and medical equipment, including medical devices. The outcome of this investigation could result in additional tariffs or other trade restrictions. While we continue to believe our products will remain exempt, the scope and outcome of the investigation are uncertain and could affect existing exemptions or expand coverage to additional product categories. We cannot predict what actions may ultimately be taken with respect to tariffs or trade relations between the United States and other countries (including Mexico and China), which products may become subject to such actions, or how other countries may respond in retaliation. The adoption and expansion of trade restrictions, the occurrence of a trade war, other governmental action related to tariffs or trade agreements or policies, or the related uncertainties, has the potential to adversely impact our supply chain and distribution costs, which could in turn adversely affect our business, financial condition, and results of operations, including our ability to expand gross margins.

Furthermore, while proposals to amend Mexico’s federal labor law, including a reduction in maximum workweek hours from 48 to 40 hours, were rejected by the Mexican Congress in 2024, these initiatives remain a legislative priority. In 2025, the Mexican government publicly announced its intention to pursue this change through a phased implementation, with the goal of reaching a 40-hour workweek by 2030, although the specific details, timing and scope of implementation remain under discussion. If enacted, these potential legislative changes are expected to increase our labor costs and, ultimately, could potentially negatively impact the productivity of our manufacturing operations to the extent our efforts to mitigate the impact of the changes are not successful. In addition, because certain of our Mexico-based manufacturing operations incur costs that are denominated in Mexican Pesos (MXN), we are exposed to additional risk of currency fluctuations between the U.S. dollars (USD) and MXN, which could increase our product and labor costs, thus reducing our gross profit. Moreover, while certain members of our management team have some manufacturing experience, as an organization, we do not have any prior experience in this type of manufacturing arrangement, and we could accordingly experience other risks, the nature and magnitude of which we are unable to assess precisely at this time. Furthermore, we are subject to increased risks related to changes in export or import regulation, other trade barriers, security measures and uncertainties impacting the cost and the ability to move inventory and manufacturing equipment across the United States-Mexico border. These risks may disrupt our Mexico-based manufacturing operations, subject us to increased costs, restrict or delay our ability to deliver products to our customers and meet our customers’ demand on a timely basis, and result in customer dissatisfaction, all of which would adversely impact our results of operations.

In addition, we continue to rely on a contract manufacturing partner in Southeast Asia, for the production of a portion of our Tablo cartridges. If this contract manufacturing partners’ facilities were disrupted, by labor disputes, work stoppages, public health crises such as the COVID-19 pandemic, riots, terrorism, vandalism, cyber security attacks, natural disaster, regulatory action or otherwise, it could cause substantial delays in our operations and result in our having insufficient Tablo cartridge in inventory to fulfill orders. For example, in late 2021, supply chain disruptions exacerbated by COVID-19 outbreaks and protocols escalated, and we faced increased supply constraints, which increased freight costs associated with the transportation of Tablo cartridges. Further, to the extent we seek to renew or renegotiate our arrangements with our contract manufacturing partner, and cannot agree to the terms and conditions of future contract manufacturing arrangements, our ability to produce and sell Tablo cartridges could be delayed until we are able to ramp our own in-house manufacturing capabilities to meet demand, or until an alternative manufacturing partner or arrangement is identified, a new contract manufacturing agreement is negotiated and new production lines are established.

We may face additional costs, loss of revenue, significant liabilities, harm to our brand, decreased use of our platform and business disruption if there are any security or data privacy breaches or other unauthorized or improper access.

In connection with various facets of our business, we collect and use a variety of personal information as part of the Tablo data ecosystem, such as name, street address, email addresses, mobile telephone number, and prescription information. Security breaches, computer malware and computer hacking attacks have become more prevalent across industries and may occur on our systems or those of our third-party service providers, suppliers or other partners. Despite the implementation of security measures, our internal computer systems and those of our third-party service providers, suppliers and other partners are vulnerable to damage from computer viruses, hacking and other means of unauthorized access, denial of service and other attacks, natural disasters, terrorism, war and telecommunication and electrical failures. Attacks upon information technology systems are increasing in their frequency, levels of persistence, sophistication and intensity, and are being conducted by sophisticated and organized groups and individuals with a wide range of motives and expertise. Further, we may face increased cybersecurity risks due to our reliance on internet technology and the number of our employees who may work remotely, which may create additional opportunities for cybercriminals to exploit vulnerabilities. In addition to unauthorized access to or acquisition of personal information, confidential information, intellectual property or other sensitive information, such attacks could include the deployment of harmful malware and ransomware, and may use a variety of methods, including denial-of-service attacks, social engineering and other means, to attain such unauthorized access or acquisition or otherwise affect service reliability and threaten the confidentiality, integrity and availability of information. Any failure to prevent or mitigate security breaches or improper access to, or use or disclosure of, our data or consumers’ personal information, including information hosted by third party service providers such as Amazon Web Services (AWS), could result in significant liability under applicable data protection laws, such as state breach notification laws and the HIPAA and its implementing regulations. Such an incident may also cause a material loss of revenue from the potential adverse impact to our reputation and brand, affect our ability to retain or attract new users of Tablo and potentially disrupt our business, as well as require significant expenditure of resources to contain, mitigate and remediate the incident. Because the techniques used to obtain unauthorized access, disable or degrade service or sabotage systems change frequently or may be designed to remain dormant until a predetermined or other future event and often are not recognized until launched against a target, we and our partners may be unable to anticipate these techniques or to implement adequate preventative measures. Further, we do not have any direct control over the operations of the facilities or technology of AWS or our other cloud and service providers. Our systems, servers and platforms, those of our cloud service providers, and Tablo’s two-way wireless communication system, may be vulnerable to computer viruses or physical or electronic break-ins that our or their security measures may not detect or effectively block, and may be breached due to the actions of outside parties, employee error or misconduct, malfeasance, or a combination of these and, as a result, an unauthorized party may obtain access to our data or the personal information maintained by us or on our behalf. Additionally, outside parties may attempt to fraudulently induce employees to disclose sensitive information in order to gain access to the data and personal information we maintain, including through phishing or other social engineering attacks. Threat actors, including individuals, criminal groups, state sponsored actors or others may be able to circumvent such security measures and misappropriate our confidential or proprietary information, disrupt our operations, corrupt our data, damage our computers or otherwise impair our reputation and business. Although we currently invest in our resources and infrastructure, we may need to expend significant resources and make significant capital investment in the future to protect against security breaches or to mitigate the impact of any such breaches. In addition, to the extent that our cloud and other service providers experience security breaches that result in the unauthorized or improper use of confidential information, employee information or personal information, we may not be indemnified for any losses resulting from such breaches. Moreover, we are engaging a leading third-party information security consulting firm for virtual CISO advisory services to support our information security program, which will continue to be overseen by our VP of Information Technology. While this consulting firm has significant experience in supporting and managing information security programs, is already involved in various aspects of our cybersecurity risk management program and ongoing cybersecurity operations, and the engagement is designed to enhance our program, there can be no assurance that the integration of external resources for virtual CISO advisory services will be seamless or free of operational or security risks, which could result in unforeseen vulnerabilities or costs. If we are unable to prevent or mitigate the impact of security breaches or other cyber events that impact our operations, our ability to attract and retain new customers, patients, and other partners could be harmed, as they may be reluctant to entrust us with their data, and we could be exposed to litigation and governmental investigations, which could lead to a potential disruption to our business or other adverse consequences.