ASSEMBLY BIOSCIENCES, INC.

Current report

problems with the integrity of data collected in the study;

Current report

Any third-party manufacturers with whom we contract might be unable to manufacture or obtain from other third parties the active pharmaceutical ingredient needed to manufacture the finished dosage form of our product candidates.

Current report

The risk of a cybersecurity incident or security breach or disruption, particularly through cyberattacks or cyber intrusion, has escalated as the frequency, intensity and sophistication of attempted attacks and intrusions from around the world have increased, become increasingly difficult to detect and could be enhanced or facilitated by artificial intelligence. In addition, the prevalent use of mobile devices that access confidential information increases the risk of data security breaches. A successful cyberattack could cause serious negative consequences for us, including, without limitation, the disruption of operations, the theft, misappropriation, destruction or other compromises of confidential or proprietary information (including financial information, corporate strategic plans, trade secrets and other intellectual property and data), improper access to, use or disclosure of personal and patient health information, other misappropriation of assets, and financial loss. Although we devote resources to protect our information systems, we realize that cyberattacks remain a threat, and there can be no assurance that our efforts (or those of our employees, contractors, consultants and the third-party providers on which we rely) will prevent security breaches that would result in business, legal, financial or reputational harm to us, or would have a material adverse effect on our results of operations and financial condition. In addition, although we carry cyber insurance, in the event of a material security incident, such coverage may not be sufficient to cover all losses. Any failure to prevent or mitigate security breaches or improper access to, use of, or disclosure of our clinical data or patients’ personal data could result in significant liability under various U.S. state and federal laws and regulations and laws of foreign jurisdictions regarding data privacy and security (or require notification to governmental agencies, the media or individuals pursuant to such laws) and may cause a material adverse impact to our reputation, affect our ability to use collected data, conduct new studies and potentially disrupt our business.

Current report

Our internal computer systems, or those of our third-party CROs or other contractors or consultants, may fail or suffer other disruptions, which could result in a material disruption of our current or future product candidates’ development programs. Despite the implementation of security, business continuity and back-up measures, in addition to cyberattacks and security incidents described above, our internal computer systems and those of our third-party CROs and other contractors and consultants are vulnerable to damage from natural disasters, terrorism, war and telecommunication and electrical failures. While we have not experienced any such system failure, or accident to date, if such an event were to occur and cause interruptions in our operations (or those of our business partners or other third parties on which we rely), it could result in a material disruption of our programs. For example, any loss of clinical study data from completed or ongoing or planned clinical studies could result in delays in our regulatory approval efforts and significantly increase our costs to recover or reproduce the data. To the extent that any such disruption results in a loss of or damage to our data or applications, other data or applications relating to our technology or current or future product candidates, or inappropriate disclosure of confidential or proprietary information, we could incur liabilities and the further development of our current or future product candidates could be delayed.

Current report

We and our third-party partners and service providers are subject to stringent privacy laws, information security laws, regulations, policies and contractual obligations related to data privacy and security, and compliance with such laws, regulations, policies and contractual obligations could result in additional costs and liabilities to us and failure to comply could adversely affect our business, financial condition, results of operations and prospects.

Current report

We maintain and process certain confidential, sensitive, or personal information in the operation of our business, and rely on certain third-party vendors to process confidential, sensitive or personal information on our behalf, including in the conduct of our clinical trials. We and our third party partners and service providers, including our CROs and other vendors and contractors, are subject to data privacy and security laws and regulations that govern the collection, transmission, storage, use, processing, destruction, retention and security of personal information, including additional laws or regulations relating to health information. The legislative and regulatory landscape for privacy and data protection continues to evolve in jurisdictions worldwide, and these laws may at times be conflicting. It is possible that these laws may be interpreted or applied in a manner that is inconsistent with the practices we or our third party partners maintain, and any of our efforts to comply with the evolving data protection rules may be unsuccessful. Neither we nor our third party partners can guarantee that we or they are and have been in compliance with all applicable data privacy and protection laws, rules regulations, policies and standards. We may need to devote significant resources to seek to understand and comply with this changing landscape, and it is possible that these ongoing compliance efforts may be costly and require modifications to our policies, procedures and systems over time. Failure, or perceived failure, by us or our third-party partners and service providers to comply with laws and regulations regarding privacy and security of personal information could result in penalties under such laws, such as orders requiring a change in business practices, claims for damages or other liabilities, government investigations and enforcement actions, litigation and significant costs for remediation, any of which could adversely affect our business. Even if it is determined that there was no violation of these laws, government investigations into these issues typically require the expenditure of significant resources and generate negative publicity. Any resulting enforcement actions against us or our third party partners could lead to the imposition of fines, criminal prosecution of employees, claims for damages by affected individuals and reputational damage and loss of goodwill. Additionally, if we and any CROs or third parties we use to conduct clinical trials, are unable to properly protect the privacy and security of personal information, including protected health information, we and they could be found to have breached our and their contracts with certain third parties.

Current report

There are numerous U.S. federal and state laws and regulations related to the privacy and security of personal information. In particular, the Health Insurance Portability and Accountability Act (HIPAA), as amended by HITECH and their respective implementing regulations, establish privacy and security standards for Covered Entities and Business Associates (as defined by HIPAA) that limit the use and disclosure of individually identifiable health information, or protected health information, and require the implementation of administrative, physical and technological safeguards to protect the privacy of protected health information and ensure the confidentiality, integrity and availability of electronic protected health information. We do not believe that we are currently acting as a covered entity or business associate under HIPAA and thus are not directly subject to its requirements or penalties. However, we may obtain health information from third parties, including research institutions from which we obtain clinical trial data, that are subject to privacy and security requirements under HIPAA. Determining whether protected health information has been handled in compliance with applicable privacy standards and contractual obligations can be complex and may be subject to changing interpretation. If we or our third party partners fail to comply with applicable privacy laws, including applicable HIPAA privacy and security standards, we could face civil and criminal penalties. HHS enforcement activity can result in financial liability and reputational harm, and responses to such enforcement activity can consume significant internal resources; the HHS also has discretion to impose penalties without attempting to first resolve violations. In addition, state attorneys general are authorized pursuant to certain federal and state laws to bring civil actions seeking either injunctions or damages in response to violations that threaten the privacy of state residents. We cannot be sure how these laws and regulations will be interpreted, enforced or applied to our operations or the operations of our third party partners.

Current report

Certain U.S. state laws may be more stringent or broader in scope, or offer greater individual rights, with respect to sensitive and personal information than international, federal, or other state laws, and such laws may differ from each other, which may complicate compliance efforts. For example, in June 2018, California enacted the California Consumer Privacy Act (CCPA), which broadly defines personal information, gives California residents expanded privacy rights and protections, including the right to access and delete certain personal information, as well as the right to opt-out of certain sales of personal information, and provides for civil penalties for violations and a private right of action for data breaches. Additional states have passed privacy laws, such as the Virginia Consumer Data Protection Act and the Colorado Privacy Act, which are similar to the CCPA. Such new privacy laws add further complexity in interpreting and implementing data privacy requirements and restrictions and thus create additional potential legal risk, require additional investment in resources for compliance programs, and could impact business strategies and the availability of previously useful data. This complexity applies to data security as well. Certain other states, including California, Massachusetts and Nevada have adopted laws requiring the implementation of certain security measures to protect personal information, and all 50 states and the District of Columbia, Puerto Rico, the U.S. Virgin Islands and Guam have adopted laws including obligations to provide notification of security breaches of computer databases that contain personal information to affected individuals, state officers and others. We may also be subject to U.S. federal rules, regulations and guidance with respect to data privacy and security practices. According to the Federal Trade Commission (FTC), failing to take appropriate steps to keep consumers’ personal information secure constitutes unfair acts or practices in or affecting commerce in violation of Section 5(a) of the Federal Trade Commission Act, 15 U.S.C § 45(a). The FTC expects a company’s data security measures to be reasonable and appropriate in light of the sensitivity and volume of consumer information it holds, the size and complexity of its business, and the cost of available tools to improve security and reduce vulnerabilities. These federal and state laws regarding data privacy and security may differ from one another, and the interplay between them may be subject to varying interpretations by courts and government agencies, increasing our costs of compliance and exposing us to potential legal risk.

Current report

In the European Union (EU), the processing of personal data, including personal health data, is governed by the provisions of the EU General Data Protection Regulation (EU GDPR), in addition to other applicable laws and regulations. The EU GDPR, together with national legislation, regulations and guidelines of the EU Member States governing the processing of personal data, impose strict obligations with respect to, and restrictions on, the collection, use, retention, protection, disclosure, transfer and processing of personal data. The EU GDPR also imposes strict rules on the transfer of personal data to countries outside the EU that are not deemed to have adequate protections for personal information, including the United States. The EU GDPR authorizes fines for certain violations that are in addition to any civil litigation claims by data subjects. Separately, Brexit has led and could lead to further legislative and regulatory changes and may increase our compliance costs. Data processing in the United Kingdom (UK) is governed by the UK General Data Protection Regulation (UK GDPR), creating two parallel regimes, each of which authorizes similar fines and other potentially divergent enforcement actions for certain violations. Failure to comply with the EU GDPR or the UK GDPR can result in significant fines and other liability, including, under the EU GDPR, fines of up to €20 million (or £17.5 million under the UK GDPR) or four percent (4%) of global revenue, whichever is greater.

Current report

Other jurisdictions worldwide are similarly introducing or enhancing privacy and data security laws, rules and regulations, which could increase our compliance costs and the risks associated with noncompliance. Compliance with data protection laws and regulations in the U.S. and internationally could require us to take on more onerous obligations in our contracts, restrict our ability to collect, use and disclose data, or in some cases, impact our ability to operate in certain jurisdictions. Although we work to comply with applicable laws, regulations and standards, our contractual obligations and other legal obligations, these requirements are evolving and may be modified, interpreted and applied in an inconsistent manner from one jurisdiction to another, and may conflict with one another or other legal obligations with which we must comply. Any failure or perceived failure by us or our employees, representatives, contractors, consultants, CROs, collaborators, development partners or other third party partners and service providers to comply with such requirements or adequately address privacy and security concerns, even if unfounded, could have a material adverse effect on our business, financial condition, results of operations and prospects. We cannot guarantee that we and our employees, representatives, contractors, consultants, CROs, collaborators, development partners and other third parties on whom we rely are, and will be, in compliance with all applicable international laws and regulations as they are enforced now or as such laws and regulations evolve or are interpreted.

Previous report

The ongoing shutdown of the U.S. government could prevent government agencies, including U.S. Customs and Border Protection (CBP) and FDA from performing normal business functions on which the operation of our business relies, which could negatively impact our business.

Previous report

The ongoing U.S. government shutdown has resulted in certain regulatory agencies, including the FDA, having to furlough critical employees and stop critical activities, including accepting application submissions for review. Other agencies, such as CBP, have been deemed “essential” and are continuing to operate. Disruptions at the CBP, FDA and other agencies, including furloughs and reductions in workforce, are subject to the political process, which is inherently unpredictable.

Previous report

Although we have yet to encounter significant delays at ports of entry due to the shutdown, in past government shutdowns, CBP delays were common in areas requiring manual review or discretionary approvals. If the current shutdown continues, the resulting delays and other disruptions could have a material adverse effect on our business.

Previous report

Our clinical studies require shipping clinical samples from our clinical study sites around the world to the United States for analysis and processing. CBP delays in import operations and CBP delays in inspecting imports, including difficulties with these samples clearing customs, may delay or otherwise adversely affect our ongoing clinical studies and their timelines, many of which have been communicated publicly.

Previous report

The risk of a cybersecurity incident or security breach or disruption, particularly through cyberattacks or cyber intrusion, has escalated as the number, intensity and sophistication of attempted attacks and intrusions from around the world have increased. In addition, the prevalent use of mobile devices that access confidential information increases the risk of data security breaches, which could lead to the loss of confidential information or other intellectual property. The costs to us to mitigate network security problems, bugs, viruses, worms, malicious software programs, system outages and security vulnerabilities or incidents could be significant, and our efforts to address these problems may not be successful. If unsuccessful, these problems could cause interruptions, delays, cessation of service and other harm to our business and our competitive position, including material disruption of our product development programs. For example, any loss of clinical study data from completed or ongoing or planned clinical studies could result in delays in our regulatory approval efforts and significantly increase our costs to recover or reproduce the data.

Previous report

If a computer security breach affects our systems or results in the unauthorized release of personally identifiable information, our reputation could be materially damaged. In addition, such a breach may require notification to governmental agencies, the media or individuals pursuant to various federal, state and non-U.S. privacy and security laws, if applicable, including the Health Insurance Portability and Accountability Act of 1996 (HIPAA), as amended by the Health Information Technology for Clinical Health Act of 2009, and its implementing rules and regulations, as well as regulations promulgated by the Federal Trade Commission, state breach notification law and the European Union (EU) General Data Protection Regulation (EU GDPR). We would also be exposed to a risk of loss or litigation and potential liability, which could materially adversely affect our business, results of operations and financial condition.

Previous report

Regulators globally are imposing greater monetary fines for privacy violations. Privacy laws such as the EU GDPR and UK General Data Protection Regulation (UK GDPR) impose strict obligations on lawful processing, transparency and cross-border transfers of personal data (i.e., information which identifies an individual or from which an individual is identifiable). The EU GDPR applies to any company established in the EU as well as to those outside the EU if they process personal data in connection with the offering of goods or services to EU residents or the monitoring of their behavior within the EU, wherever such processing occurs. The EU GDPR includes operational requirements for companies that receive or process personal data of EU residents. The EU GDPR enhances data protection obligations for processors and controllers of personal data, including, for example, expanded disclosures about how personal data is to be used, limitations on retention of information, mandatory data breach notification requirements and notable obligations on services providers. Noncompliance with the EU GDPR may result in monetary penalties of up to €20 million or 4% of worldwide revenue, whichever is higher. The EU GDPR may increase our responsibility and liability in relation to personal data that we process and we may be required to implement additional mechanisms to ensure compliance with the EU GDPR, including as implemented by individual countries. In addition to the foregoing, a breach of the EU GDPR could result in regulatory investigations, reputational damage, fines and sanctions, orders to cease or change the processing of our data, enforcement notices, or assessment notices (for a compulsory audit). We may also face civil claims including representative actions and other class action type litigation (where individuals have suffered harm), potentially amounting to significant compensation or damages liabilities, as well as associated costs, diversion of internal resources, and reputational harm as the EU GDPR confers a private right of action on data subjects and consumer associations to lodge complaints with supervisory authorities, seek judicial remedies, and obtain compensation for damages resulting from violations.

Previous report

The European Economic Area (EEA) and United Kingdom impose rules with respect to cross-border transfers of personal data outside of the EEA and the United Kingdom to third countries, including the United States. In July 2020, the EU-U.S. Privacy Shield was invalidated as a valid personal data transfer mechanism between the EU and the U.S., and on June 4, 2021, the European Commission finalized new versions of the Standard Contractual Clauses (New SCCs), which apply to the transfer of personal data outside of the EU to a country not approved by the EU as providing an adequate level of protection for the processing of personal data. The New SCCs must be used for all relevant transfers of personal data outside the EEA (since December 27, 2022). On March 21, 2022, the United Kingdom implemented its own United Kingdom-specific international data transfer agreement (IDTA) and addendum to the New SCCs (UK Addendum) (collectively, the SCCs). Effective July 11, 2023, the new EU-U.S. Data Privacy Framework (DPF) has been recognized as adequate under EU law (a new framework to allow transfers of personal data from the EU to certified companies in the U.S.). The United Kingdom has also approved a United Kingdom extension to the EU-U.S. Data Privacy Framework, which was laid before Parliament on September 21, 2023 and came into force on October 12, 2023. However, the DPF is subject to further legal challenge, just as the EU-U.S. Privacy Shield was, which could cause the legal requirements for personal data transfers from the EU to the U.S. to become uncertain once again. EU data protection authorities have and may again block the use of certain U.S.-based services that involve the transfer of personal data to the U.S. In the EU and other markets, potential new rules and restrictions on the flow of personal data across borders could increase the cost and complexity of doing business in those regions.

Previous report

Following the United Kingdom’s departure from the EU, commonly referred to as “Brexit”, the UK GDPR exists alongside the United Kingdom Data Protection Act 2018, which implements certain derogations in the UK GDPR into United Kingdom law. Under the UK GDPR, companies not established in the United Kingdom but who process personal data in relation to the offering of goods or services to individuals in the United Kingdom, or to monitor their behavior will also be subject to the UK GDPR and will be required to appoint a data protection representative in the United Kingdom, provided certain exceptions are not met. While the EU GDPR and the UK GDPR remain substantially similar for the time being, the government of the United Kingdom has adopted reforms to its data privacy and cybersecurity legal framework in its Data Use and Access Act 2025, which became law on June 19, 2025 (phasing in between June 2025 and June 2026). Compliance with the EU GDPR and UK GDPR and other changes in laws or regulations associated with the enhanced protection of certain types of personal data, such as healthcare data or other sensitive information, could greatly increase our cost of developing our products or even prevent us from offering certain products in jurisdictions that we may operate in.

Previous report

Many U.S. states have also enacted comprehensive privacy laws that impose certain obligations on covered businesses, including providing specific disclosures in privacy notices and affording residents of a given state certain rights concerning their personal data. Such rights may include the right to access, correct or delete certain personal data, and opt-out of certain data processing activities, such as targeted advertising, profiling and automated decision-making. The exercise of these rights may or may not impact our business and our ability to provide our products and services. Certain states impose stricter requirements for processing certain personal data, including sensitive personal data, for example by requiring that data privacy impact assessments be conducted prior to processing such data. These state laws also allow statutory fines for noncompliance. For example, the California Consumer Privacy Act (CCPA) places increased privacy and security obligations on entities handling personal data of consumers or households, employees and business representatives. The CCPA requires covered businesses to provide certain disclosures to consumers about their data collection, use and sharing practices, and to provide affected California residents with ways to opt-out of certain sales or transfers of personal data. The CCPA provides for fines of up to $7,988 per intentional violation and potentially allows private litigants affected by certain types of data breaches to recover significant statutory damages. While there is currently an exception for protected health information that is subject to HIPAA and clinical study regulations, as currently written, the CCPA may impact our business activities. The uncertainty surrounding the implementation of the CCPA exemplifies the vulnerability of our business to the evolving regulatory environment related to personal data and protected health information.